Mon ordinateur est-il infecté par un virus ?

[guigui14100]

ok reposte un nouveau log hijackthis stp

[lordraven]

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:10:13, on 16/07/2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Nod32\nod32kui.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Winamp\winampa.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Razer\Lachesis\razerhid.exe

C:\Program Files\Razer\Lycosa\razerhid.exe

C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe

C:\Program Files\Windows Sidebar\sidebar.exe

G:\Program Files\Steam\Steam.exe

C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\TomTom HOME 2\HOMERunner.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\Program Files\UberIcon\UberIcon Manager.exe

C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe

C:\Program Files\Razer\Lachesis\OSD.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Razer\Lycosa\razertra.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Razer\Lachesis\razerofa.exe

C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe

C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe

C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe

C:\Program Files\SpeedFan\speedfan.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Users\Hy3n3\Downloads\HiJackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Vista Ultimate Edition

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Nod32\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QT Lite\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe

O4 - HKLM\..\Run: [Lycosa] "C:\Program Files\Razer\Lycosa\razerhid.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe r

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [steam] "g:\program files\steam\steam.exe" -silent

O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart

O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_SD6DD.tmp" /EF "HKCU"

O4 - HKCU\..\Run: [Core Temp] C:\Users\Hy3n3\Desktop\Core Temp.exe

O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [uberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O4 - Startup: Yahoo! Widgets.lnk = ?

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\Program Files\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)

O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\Program Files\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)

O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\Program Files\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)

O10 - Broken Internet access because of LSP provider 'c:\windows\system32\pnrpnsp.dll' missing

O13 - Gopher Prefix:

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Update Service (gupdate1c8e509fc8d0110) (gupdate1c8e509fc8d0110) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Nod32\nod32krn.exe

O23 - Service: Bosco - Module Esclave (slave) - Unknown owner - C:\Program Files\Bosco\slave.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

 

--

End of file - 8080 bytes

[guigui14100]

Fait un scan avec le scan online de kaspersky

 

http://www.kaspersky.com/virusscanner et post le rapport

[lordraven]

KASPERSKY ONLINE SCANNER 7 REPORT

Wednesday, July 16, 2008

Operating System: Microsoft Windows Vista Ultimate Edition, 32-bit Service Pack 1 (build 6001)

Kaspersky Online Scanner 7 version: 7.0.25.0

Program database last update: Wednesday, July 16, 2008 20:05:06

Records in database: 960465

--------------------------------------------------------------------------------

 

Scan settings:

Scan using the following database: extended

Scan archives: yes

Scan mail databases: yes

 

Scan area - Critical Areas:

C:\Program Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

C:\Users\Hy3n3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

C:\Windows

 

Scan statistics:

Files scanned: 76986

Threat name: 4

Infected objects: 10

Suspicious objects: 0

Duration of the scan: 00:27:55

 

 

File name / Threat name / Threats count

C:\Program Files\Nod32\cache\FND1.NFI Infected: not-a-virus:AdWare.Win32.WebHancer.423 1

C:\Program Files\Nod32\cache\FND1.NFI Infected: not-a-virus:AdWare.Win32.WebHancer.390 3

C:\Program Files\Nod32\infected\4ET0SBAA.NQF Infected: not-a-virus:AdWare.Win32.WebHancer.423 1

C:\Program Files\Nod32\infected\4ET0SBAA.NQF Infected: not-a-virus:AdWare.Win32.WebHancer.390 3

C:\Program Files\Nod32\infected\G5NHP4CA.NQF Infected: Trojan-Downloader.Win32.VB.eyc 1

C:\Windows\YOJNETSUJ.EXE Infected: Trojan.Win32.Agent.tvy 1

 

The selected area was scanned.

[guigui14100]

télécharge sa ftp://ftp.kaspersky.com/devbuilds/AVPTool....2008_00-34.exe installe le et démarre en mode sans échec.

Et fait un scan complet, et supprime les objet détecté puis colle le rapport

[lordraven]

j'ai installé l'avp tool mais quand je le lance il me met une erreur d'application

 

"l'instruction à 0x0040c52b emploie l'adresse mémoire 0x00000004. la mémoire ne peut pas être en état 'read'."

 

 

 

je fais quoi docteur ?

[guigui14100]

A tu redémarrer en mode sans échec?

 

Pour aller en mode sans échec:

Lors du démarrage du PC, appui sur F8 lors de la fenêtre du bios.

Normalement, cela va t'afficher une fenêtre avec ecris mode sans échec que tu sélectionne avec le clavier puis tu fait entrer quand tu es dessus.

Puis windows démarrera

[lordraven]

c est ce que j'ai fait avec le résultat décrit ci dessus : (

[guigui14100]

Ok, essaye en mode normal pour voir

[lordraven]

Ok, essaye en mode normal pour voir

 

 

exactement pareil