[RESOLU] Rapport hijackthis bizarre !!!

bleuet · le 9 août 2008

Re.....

J'ai supprimé WLM, Incrédimail,(et tous ses gliglis !!) et 2 ou 3 logs qui étaient en travers.

J'avais déjà passé LOP S&D ( #3).

Passé MBAM qui m'a sorti le rapport suivant : pas mal ! >>

Malwarebytes' Anti-Malware 1.24

Version de la base de données: 1035

Windows 5.1.2600 Service Pack 2

14:55:35 09/08/2008

mbam-log-8-9-2008 (14-55-35).txt

Type de recherche: Examen complet (C:\|D:\|H:\|I:\|)

Eléments examinés: 107802

Temps écoulé: 56 minute(s), 4 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 5

Clé(s) du Registre infectée(s): 16

Valeur(s) du Registre infectée(s): 3

Elément(s) de données du Registre infecté(s): 2

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 19

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

C:\WINDOWS\system32\hcehltqy.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\ljJYRIXp.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\mcjxpcwm.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\awlolx.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\qoMccyaW.dll (Trojan.Vundo) -> Delete on reboot.

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d74ec7a-bb80-4d85-ae88-ab59bdfdf41e} (Trojan.Vundo) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{6d74ec7a-bb80-4d85-ae88-ab59bdfdf41e} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7f10c977-58cb-4a54-83aa-7d838d1992bc} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{7f10c977-58cb-4a54-83aa-7d838d1992bc} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4deabe3f-4a61-47c2-a64d-90453dc01542} (Trojan.BHO) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{4deabe3f-4a61-47c2-a64d-90453dc01542} (Trojan.BHO) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\qomccyaw (Trojan.Vundo) -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9cf8f02e (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4deabe3f-4a61-47c2-a64d-90453dc01542} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm9fcbc3b2 (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\ljjyrixp -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\ljjyrixp -> Delete on reboot.

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

Fichier(s) infecté(s):

C:\WINDOWS\system32\ljJYRIXp.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\pXIRYJjl.ini (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\pXIRYJjl.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\awlolx.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\hcehltqy.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\yqtlhech.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mcjxpcwm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mwcpxjcm.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\qoMccyaW.dll (Trojan.BHO) -> Delete on reboot.

C:\WINDOWS\system32\xdwtaoqc.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rfrwxcxe.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ujovnklc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\adukyfrm.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\iwthxhlc.dll (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\BM9fcbc3b2.xml (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\BM9fcbc3b2.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\khfEUkHA.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Le dernier Hijackthis donne le rapport suivant :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:04:39, on 09/08/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\vphc700.exe

C:\WINDOWS\system32\RunDll32.exe

C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe

C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\PROGRA~1\RETURN~1\Returnil\Returnil.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\CTSvcCDA.EXE

C:\Program Files\WinRoll\winroll.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\CursorXP\CursorXP.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\Creative\MediaSource\GO\CTCMSGo.exe

C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\MRU-Blaster\scheduler.exe

C:\Program Files\MioNet\MioNetManager.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Program Files\MioNet\jvm\bin\MioNet.exe

C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe

C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe

C:\Documents and Settings\Annie\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [phc710] C:\WINDOWS\vphc700.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"

O4 - HKLM\..\Run: [Rvsystem] C:\PROGRA~1\RETURN~1\Returnil\Returnil.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [WinRoll] C:\Program Files\WinRoll\winroll.exe

O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - HKCU\..\Run: [Creative MediaSource Go] C:\Program Files\Creative\MediaSource\GO\CTCMSGo.exe /SCB

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [sTYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Startup: MRU-Blaster Scheduler.lnk = C:\Program Files\MRU-Blaster\scheduler.exe

O4 - Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: bw+0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw+0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: bwg0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwg0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0s - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: offline-8876480 - {516FE8E2-DCFE-4DB7-8A98-F92D328103CF} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe

O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--

End of file - 20239 bytes

Il n'y a plus aucune pub. La ligne :

O4 - HKCU\..\Run: [forhope] C:\DOCUME~1\Annie\APPLIC~1\1BLAHM~1\Boldaimgreat.exe a bien sauté avec aussi :

O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\

que tu avais relevé à ton # 6.

Ce rapport me semble pas mal. Mais ton diagnostic ?...

J'ai cette série de 018 qui sont semblent liés à un pack clavier (avec diverses touches médias, tél.) et souris.

Je sais pas trop si je les fait sauter ou les laisse... Dans ajout/suppression programmes, il vaudrait mieux ?

J'ai eu en prime un superbe "NTLDR manque" résolu par la console de récupération. Ouf !!

voilà. @++

Falkra · le 9 août 2008

Les O18 c'est logitech desktop messenger, pas indispensable mais si ton ami en a besoin...

Cela dit, Pidgin par exemple est open source et multi protocle et ne subira pas les attaques contre MSN/WLM...

Le rapport est clean. C'est après un redémarrage ?

Il faut mettre à jour IE, là c'est IE6. Même si on ne l'utilise pas, son moteur peut être utilisé par d'autres logiciels et IE6 n'est plus suffisant côté sécurité. On trouve encore des failles, qui ne seront pas corrigées. IE7 s'installe librement, même sur les windows non authentiques, tout le monde devrait avoir au minimum IE7 donc. Il arrivera par les mises à jour de windows update, sinon on peut le télécharger ici :

http://www.microsoft.com/windows/products/...ie/default.mspx

(bouton "get it now")

A télécharger et installer avant de mettre le SP3. Ca facilitera la suite.

J'ai eu en prime un superbe "NTLDR manque" résolu par la console de récupération. Ouf !!

Pas cool. Bien pour la console.

La ram est ok ?

bleuet · le 10 août 2008

Salut Falkra,

Les 018, c'est son ensemble clavier/souris logitech.(avec diverses touches médias...) Je verrai sur place. Depuis l'installation,il y a des parasites sur les HP ( ce n'est peut être pas dû au pack).

Pour Pidgin, je lui en parlerai... (les goûts et les couleurs..) et je vais faire la màj vers IE7.

Pour le SP3, je laisse en SP2 ( Style XP installé sur l'OS et incompatible avec SP3). Sauf si enlever style XP est accepté.

Pour la ram, j'ai fait aucun test. J'avais réussi par chance à aller sur le bureau du premier coup. En fait, à part des logiciels en travers, des soucis de sons déconfigurés, le PC, sans internet ( IE ou Firefox, WLM..) se comportait pas trop mal.

Mais dès la connexion, l'enfer.......PC bloqué, et à l'ouverture IE ou FF,clic sur un lien, redirection sur des pages pubs après 1 bonne minute.

Ce dernier rapport HijackThis est après le dernier redémarrage de hier. Stable et pas de pubs.

Je suis tes conseils, et fait tourner la bête quelques heures ( je ne suis pas sur le PC) pour voir sa stabilité.

Par contre, le "pépin" NTLDR, pas compris.

J'ai eu 1 première fois "NTLDR manque" : j'ai tenté de réparer par 1 fixboot, fixmbr. Rien > j'ai eu "NTLDR is missing".

Finalement, j'ai réussi (toujours par la console) en faisant une commande map et une récupération copy NTLDR et copy NTDETECT.COM (j'avais imprimé ce tuto..)>>

http://speedweb1.free.fr/frames2.php?page=outils4#boot

Bonne journée et @ ++

Falkra · le 10 août 2008

Style XP installé sur l'OS et incompatible avec SP3

Ca c'est pire que les cochonneries de HP et Logitech.

Le fichier a pu sauter pour faire ton NTLDR manquant.

Tu me diras, si ça revient quand on le connecte.

bleuet · le 12 août 2008

Salut Falkra,

Plus de problème. Le PC tient. Mais lorsque j'ai voulu tester WLMessenger surprise....(Et uniquement avec WLM)

Je te mets le lien ouvert sur > Software

(voulu supprimer WLM totalement pour repartir d'un WLM "vierge". Je le supprime bien mais à la réinstallation, j'ai les mêmes configurations qui reviennent).

http://forum.zebulon.fr/supprimer-totaleme...00#entry1265900

Un autre problème d'infection ? C'est désespérant.

@+

Falkra · le 12 août 2008

C'est une vraie daube ce truc.

Tu n'as quand même pas installé le sponsor de WLMessengerPlus (m'étonnerait, mais je dois demander) ?

Pidgin, ou un clone (emesene, amsn, etc) ferait l'affaire ?

bleuet · le 12 août 2008

re...

Ben non. Il faut surtout faire attention à ne pas cocher. Pas de risque de mon côté.

C'est le seul souci que j'ai maintenant. Et je suis obligé de remettre WLM plus ! ( j'ai affaire à 1 vraie tête de mule).

Je suis sûr qu'il y a un mouchard coincé à quelque part. La page d'accueil de Plus § est détournée sur des pages de pubs pour jouer en direct, acheter de l'immobilier, s'inscrire à des voyage,....

Je te reposte 1 Hijackthis. Peut être quelque chose qui m'échappe.

Je vois plus comment on supprime WLM de W$ pour repartir sur 1 installation vierge.

@+

bleuet · le 12 août 2008

Bon voilà la dernière mouture de Hijackthis >>

---------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:51:52, on 12/08/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\vphc700.exe

C:\WINDOWS\system32\RunDll32.exe

C:\PROGRA~1\RETURN~1\Returnil\Returnil.exe

C:\Program Files\WinRoll\winroll.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\CursorXP\CursorXP.exe

C:\Program Files\Creative\MediaSource\GO\CTCMSGo.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe

C:\WINDOWS\system32\CTSvcCDA.EXE

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\MRU-Blaster\scheduler.exe

C:\Program Files\MioNet\MioNetManager.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\MioNet\jvm\bin\MioNet.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe

C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe

C:\Program Files\Windows Live\Messenger\usnsvc.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Outlook Express\msimn.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Annie\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [phc710] C:\WINDOWS\vphc700.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [Rvsystem] C:\PROGRA~1\RETURN~1\Returnil\Returnil.exe

O4 - HKCU\..\Run: [WinRoll] C:\Program Files\WinRoll\winroll.exe

O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe

O4 - HKCU\..\Run: [Creative MediaSource Go] C:\Program Files\Creative\MediaSource\GO\CTCMSGo.exe /SCB

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [sTYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background