SpybotSD.System startup 2 x WinLogon, wlballoon

[turrican3]

voila je joins mon rapport spybotsd :

regardez a la fin du rapport WinLogon, wlballoon est lancé 2 x, est-ce que quelqu'un a deja eu ça ?

 

 

 

--- Spybot - Search & Destroy version: 1.5.2 (build: 20080128) ---

 

2008-01-28 blindman.exe (1.0.0.7)

2008-01-28 SDDelFile.exe (1.0.2.4)

2008-01-28 SDMain.exe (1.0.0.5)

2007-10-07 SDShred.exe (1.0.1.2)

2008-01-28 SDUpdate.exe (1.0.8.

2008-01-28 SDWinSec.exe (1.0.0.11)

2008-01-28 SpybotSD.exe (1.5.2.20)

2008-01-28 TeaTimer.exe (1.5.2.16)

2006-09-26 unins000.exe (51.41.0.0)

2008-02-08 unins001.exe (51.49.0.0)

2008-01-28 Update.exe (1.4.0.6)

2008-01-28 advcheck.dll (1.5.4.5)

2007-04-02 aports.dll (2.1.0.0)

2005-05-31 borlndmm.dll (7.0.4.453)

2005-05-31 delphimm.dll (7.0.4.453)

2007-11-17 DelZip179.dll (1.79.7.4)

2008-01-28 SDFiles.dll (1.5.1.19)

2008-01-28 SDHelper.dll (1.5.0.11)

2008-01-28 Tools.dll (2.1.3.3)

2005-05-31 UnzDll.dll (1.73.1.1)

2005-05-31 ZipDll.dll (1.73.2.0)

2008-06-17 Includes\Adware.sbi

2008-06-18 Includes\AdwareC.sbi

2008-06-03 Includes\Cookies.sbi

2008-06-03 Includes\Dialer.sbi

2008-06-24 Includes\DialerC.sbi

2008-06-03 Includes\HeavyDuty.sbi

2008-06-16 Includes\Hijackers.sbi

2008-06-17 Includes\HijackersC.sbi

2008-06-25 Includes\Keyloggers.sbi

2008-06-24 Includes\KeyloggersC.sbi

2004-11-29 Includes\LSP.sbi

2008-06-24 Includes\Malware.sbi

2008-06-24 Includes\MalwareC.sbi

2008-06-17 Includes\PUPS.sbi

2008-06-24 Includes\PUPSC.sbi

2007-11-07 Includes\Revision.sbi

2008-06-10 Includes\Security.sbi

2008-06-18 Includes\SecurityC.sbi

2008-06-03 Includes\Spybots.sbi

2008-06-03 Includes\SpybotsC.sbi

2008-06-17 Includes\Spyware.sbi

2008-06-17 Includes\SpywareC.sbi

2008-06-03 Includes\Tracks.uti

2008-06-24 Includes\Trojans.sbi

2008-06-25 Includes\TrojansC.sbi

2008-03-04 Plugins\Chai.dll

2008-03-05 Plugins\Fennel.dll

2008-02-26 Plugins\Mate.dll

2007-12-24 Plugins\TCPIPAddress.dll

 

Located: HK_LM:Run, AVG8_TRAY

command: C:\PROGRA~1\AVG\AVG8\avgtray.exe

file: C:\PROGRA~1\AVG\AVG8\avgtray.exe

size: 1177368

MD5: 2AC3626BE28448526942A863C6F1B45C

 

Located: HK_LM:Run, Zone Labs Client

command: "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

file: C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

size: 919280

MD5: 3E1731C55F77D150791D4C7E87AD4E5C

 

Located: HK_LM:Run, Alcmtr (DISABLED)

command: ALCMTR.EXE

file: C:\WINDOWS\ALCMTR.EXE

size: 69632

MD5: 8B4CBBA1EA526830C7F97E7822E2493A

 

Located: HK_LM:Run, IE Privacy Keeper (DISABLED)

command: "C:\Program Files\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe" -startup

file: C:\Program Files\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe

size: 1015808

MD5: 7771618E69C8CC7AE91830F6F0B9D356

 

Located: HK_LM:Run, NvMediaCenter (DISABLED)

command: RunDLL32.exe NvMCTray.dll,NvTaskbarInit

file:

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: HK_LM:Run, nwiz (DISABLED)

command: nwiz.exe /install

file:

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: HK_LM:Run, RTHDCPL (DISABLED)

command: RTHDCPL.EXE

file: C:\WINDOWS\RTHDCPL.EXE

size: 16858112

MD5: 5C0046F7955FCC06B5FC9953BF54ED7C

 

Located: HK_CU:Run, DAEMON Tools Lite

where: S-1-5-21-1645522239-1284227242-725345543-1004...

command: "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

file: C:\Program Files\DAEMON Tools Lite\daemon.exe

size: 486856

MD5: B3507538A9BA346A898150032869A523

 

Located: HK_CU:Run, Wallpaper (DISABLED)

where: S-1-5-21-1645522239-1284227242-725345543-1004...

command: "C:\Program Files\Wallpaper\Wallpaper.exe" Starter

file: C:\Program Files\Wallpaper\Wallpaper.exe

size: 208896

MD5: A432CA3C785521C87AF07F2CF772BCE4

 

Located: Démarrage (désactivé), HP Digital Imaging Monitor.lnk (DISABLED)

command:

file:

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: WinLogon, crypt32chain

command: crypt32.dll

file: crypt32.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: WinLogon, cryptnet

command: cryptnet.dll

file: cryptnet.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: WinLogon, cscdll

command: cscdll.dll

file: cscdll.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: WinLogon, ScCertProp

command: wlnotify.dll

file: wlnotify.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: WinLogon, Schedule

command: wlnotify.dll

file: wlnotify.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: WinLogon, sclgntfy

command: sclgntfy.dll

file: sclgntfy.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: WinLogon, SensLogn

command: WlNotify.dll

file: WlNotify.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: WinLogon, termsrv

command: wlnotify.dll

file: wlnotify.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: WinLogon, wlballoon

command: wlnotify.dll

file: wlnotify.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

 

Located: WinLogon, wlballoon

command: wlnotify.dll

file: wlnotify.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

[turrican3]

personne n'a une idée ?

[Falkra]

Poste un rapport hijackThis dans ta prochaine réponse stp.

 

Clique sur ce lien pour télécharger HijackThis 2.0.2 :

http://www.trendsecure.com/portal/en-US/_d.../HiJackThis.exe

Cette version est sans installateur ou Zip à décompresser, choisis de l'enregistrer sur le bureau.

 

Double-clique sur l'icône HijackThis :

 

HijackThis démarre, c'est le premier bouton qui nous intéresse "Do a system scan and save a logfile" (le fichier "log" est le rapport).

Clique dessus.

 

Copie-colle le contenu du rapport qui va s'afficher dans le Bloc-notes dans ta prochaine réponse.

[turrican3]

voici le rapportet encore merci, je precise que je n'ai aucun slowdown tout est normal.

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:39:02, on 3/07/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2c\RpcAgentSrv.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\gg\Bureau\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1206756616140

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1206756893312

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2c\RpcAgentSrv.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

 

--

End of file - 4334 bytes

[Falkra]

Dis, tu as à la fois Zonealarm comme firewall (pare-feu) + celui de la suite AVG ?

Si oui, ça ne fait un de trop.

 

Ton rapport est ok. J'ai demandé au cas où, car parfois on a des surprises.

Le fichier wlnotify.dll associé à l'entrée que tu évoques est utile à windows pour tout ce qui est arrêt redémarrage du pc et autres tâches importantes. Le doublon évoqué ne poase pas de problème. Que Spybot y voie des fichiers de 0 octets qui ne le sont sans doute pas, l'est plus, mais ça ne concerne que Spybot.

 

Ton système va bien.

Il faut juste voir pour cette question des firewalls.

[turrican3]

Dis, tu as à la fois Zonealarm comme firewall (pare-feu) + celui de la suite AVG ?

Si oui, ça ne fait un de trop.

 

Ton rapport est ok. J'ai demandé au cas où, car parfois on a des surprises.

Le fichier wlnotify.dll associé à l'entrée que tu évoques est utile à windows pour tout ce qui est arrêt redémarrage du pc et autres tâches importantes. Le doublon évoqué ne poase pas de problème. Que Spybot y voie des fichiers de 0 octets qui ne le sont sans doute pas, l'est plus, mais ça ne concerne que Spybot.

 

Ton système va bien.

Il faut juste voir pour cette question des firewalls.

Merci pour ta reponse,

avg est la version free sans firewall donc tout est nickel je pense.

encore merci

[Falkra]

Ok, dans ce cas, impec.