[résolu]Trojan-spy.html.smitfraud

[ipl_001]

Rebonjour cliffburton, Stonangel, rebonjour à tous,

Non, pas de problème de fond d'écran a priori.

 

En revanche C:\WINDOWS\system32\ijsecsvc.dll résiste toujours, même avec la manip que tu m'as conseillée.

 

Sinon, comment sait-on si on a un firewall ?

532891[/snapback]

Stonangel n'oubliera pas de répondre à tes questions mais termine le nettoyage d'abord (sinon, on mélange tout !)

 

>C:\WINDOWS\system32\ijsecsvc.dll résiste toujours

Vois-tu le fichier ?

Reçois-tu un message spécial ?

Est-il supprimé avant de revenir ou est-il "impossible" à supprimer ?

[cliffburton]

Quand je le fais "manuellement", je vois le fichier (ça n'est pas un fichier caché), mais au moment de la suppression, j'ai un message avec une croix rouge me signalant que le fichier est utilisé par un autre programme ou une autre personne. Pourtant je l'ai fait en mode sans échec, avec aucun programme ouvert.

 

Quand j'ai tenté de le supprimer comme me l'a expliqué Stonangel (avec Hijackthis), il me dit que c'est bon mais qu'il faut redémarrer l'ordi pour prendre en compte les changements. Mais le fichier demeure même après redémarrage.

[Invité Stonangel]

Re, télécharge L2Mfix

http://www.atribune.org/downloads/l2mfix.exe

 

- télécharger sur le bureau et double-cliquer sur le fichier L2Mfix.exe

- cliquer sur le bouton "Install" pour dézipper

---

- ouvrir le dossier L2Mfix créé sur le bureau

- double-cliquer sur L2Mfix.bat et choisir l'option 1 Run Find Log (entrer 1)

- après 1 ou 2 minutes de recherche, il y a ouverture du Bloc-note ; poster le contenu sur le forum.

(ne pas utiliser l'option 2 ni aucun autre fichier du dossier L2Mfix)

 

- fermer tous les programmes parce qu'il va y avoir reboot automatique

- ouvrir le dossier L2Mfix créé sur le bureau

- double-cliquer sur L2Mfix.bat, choisir l'option 2 Run Fix (entrer 2) et appuyer sur n'importe quelle touche pour redémarrer l'ordinateur

Après redémarrage, le bureau et les icônes vont apparaître puis disparaître, c'est normal !

- L2Mfix va rescanner le disque ; après 1 ou 2 minutes de recherche, ouverture du Bloc-note ; poster le contenu sur le forum en même temps qu'un nouveau rapport HijackThis.

(n'utiliser aucun autre fichier du dossier L2Mfix)

[cliffburton]

L2MFIX find log 1.03

These are the registry keys present

**********************************************************************************

Winlogon/notify:

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\

6c,00,00,00

"Logoff"="ChainWlxLogoffEvent"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Logoff"="CryptnetWlxLogoffEvent"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]

"DLLName"="cscdll.dll"

"Logon"="WinlogonLogonEvent"

"Logoff"="WinlogonLogoffEvent"

"ScreenSaver"="WinlogonScreenSaverEvent"

"Startup"="WinlogonStartupEvent"

"Shutdown"="WinlogonShutdownEvent"

"StartShell"="WinlogonStartShellEvent"

"Impersonate"=dword:00000000

"Asynchronous"=dword:00000001

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MS-DOS Emulation]

"Asynchronous"=dword:00000000

"DllName"="C:\\WINDOWS\\system32\\ijsecsvc.dll"

"Impersonate"=dword:00000000

"Logon"="WinLogon"

"Logoff"="WinLogoff"

"Shutdown"="WinShutdown"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]

"DLLName"="wlnotify.dll"

"Logon"="SCardStartCertProp"

"Logoff"="SCardStopCertProp"

"Lock"="SCardSuspendCertProp"

"Unlock"="SCardResumeCertProp"

"Enabled"=dword:00000001

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]

"Asynchronous"=dword:00000000

"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Impersonate"=dword:00000000

"StartShell"="SchedStartShell"

"Logoff"="SchedEventLogOff"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]

"Logoff"="WLEventLogoff"

"Impersonate"=dword:00000000

"Asynchronous"=dword:00000001

"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]

"DLLName"="WlNotify.dll"

"Lock"="SensLockEvent"

"Logon"="SensLogonEvent"

"Logoff"="SensLogoffEvent"

"Safe"=dword:00000001

"MaxWait"=dword:00000258

"StartScreenSaver"="SensStartScreenSaverEvent"

"StopScreenSaver"="SensStopScreenSaverEvent"

"Startup"="SensStartupEvent"

"Shutdown"="SensShutdownEvent"

"StartShell"="SensStartShellEvent"

"PostShell"="SensPostShellEvent"

"Disconnect"="SensDisconnectEvent"

"Reconnect"="SensReconnectEvent"

"Unlock"="SensUnlockEvent"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]

"Asynchronous"=dword:00000000

"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Impersonate"=dword:00000000

"Logoff"="TSEventLogoff"

"Logon"="TSEventLogon"

"PostShell"="TSEventPostShell"

"Shutdown"="TSEventShutdown"

"StartShell"="TSEventStartShell"

"Startup"="TSEventStartup"

"MaxWait"=dword:00000258

"Reconnect"="TSEventReconnect"

"Disconnect"="TSEventDisconnect"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]

"DLLName"="wlnotify.dll"

"Logon"="RegisterTicketExpiredNotificationEvent"

"Logoff"="UnregisterTicketExpiredNotificationEvent"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

 

**********************************************************************************

useragent:

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

"{9DE13200-D467-BBAF-32FA-D81252489545}"=""

 

**********************************************************************************

Shell Extension key:

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"

"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"

"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"

"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"

"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"

"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"

"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"

"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage ?cran du Panneau de configuration"

"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"

"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"

"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"

"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"

"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"

"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"

"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"

"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"

"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"

"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"

"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"

"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"

"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"

"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"

"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"

"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"

"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"

"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"

"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"

"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"

"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"

"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"

"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"

"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"

"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"

"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"

"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"

"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"

"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"

"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Extension de la page de propri‚t‚s de mise … jour automatique"

"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"

"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"

"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"

"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"

"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"

"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"

"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"

"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"

"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"

"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."

"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"

"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"

"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"

"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"

"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"

"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"

"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"

"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"

"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"

"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"

"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"

"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="?tat du t‚l‚chargement"

"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"

"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"

"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"

"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"

"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"

"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"

"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"

"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"

"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"

"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"

"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"

"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"

"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"

"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"

"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"

"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"

"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"

"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"

"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"

"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"

"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"

"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"

"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"

"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"

"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"

"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"

"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"

"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"

"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"

"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"

"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"

"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"

"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"

"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"

"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"

"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"

"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"

"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"

"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"

"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"

"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"

"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"

"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"

"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"

"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"

"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"

"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"

"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"

"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"

"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"

"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"

"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"

"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"

"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"

"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"

"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"

"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"

"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"

"{0B124F8F-91F0-11D1-B8B5-006008059382}"="?num‚rateur d'applications install‚es"

"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"

"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"

"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"

"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"

"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"

"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"

"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"

"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"

"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"

"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"

"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"

"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"

"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"

"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"

"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"

"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"

"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"

"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"

"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"

"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"

"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"

"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"

"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"

"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"

"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"

"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"

"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"

"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"

"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"

"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"

"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"

"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"

"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"

"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"

"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"

"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"

"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"

"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"

"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"

"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"

"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"

"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"

"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"

"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."

"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"

"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"

"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"

"{FED7043D-346A-414D-ACD7-550D052499A7}"="dBpowerAMP Music Converter 1"

"{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}"="dBpowerAMP Music Converter"

"{2AA59FC0-31E8-42DA-9D3C-E9A52953853B}"="CopyToCD shell extension"

"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"

"{B0A6B703-0533-4EB2-8BFD-E8486474446E}"=""

"{52B87208-9CCF-42C9-B88E-069281105805}"="Trojan Remover Shell Extension"

 

**********************************************************************************

HKEY ROOT CLASSIDS:

Windows Registry Editor Version 5.00

 

[HKEY_CLASSES_ROOT\CLSID\{B0A6B703-0533-4EB2-8BFD-E8486474446E}]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{B0A6B703-0533-4EB2-8BFD-E8486474446E}\Implemented Categories]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{B0A6B703-0533-4EB2-8BFD-E8486474446E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{B0A6B703-0533-4EB2-8BFD-E8486474446E}\InprocServer32]

@="C:\\WINDOWS\\system32\\mlorcl32.dll"

"ThreadingModel"="Apartment"

 

**********************************************************************************

Files Found are not all bad files:

 

C:\WINDOWS\SYSTEM32\

drdim700.dll Sun 10 Jul 2005 14:04:38 ..S.R 417 792 408,00 K

ihxrtmgr.dll Tue 5 Jul 2005 13:00:52 ..S.R 417 792 408,00 K

ijsecsvc.dll Sun 3 Jul 2005 22:54:04 ..... 417 792 408,00 K

kldcan.dll Sun 10 Jul 2005 15:58:20 ..S.R 417 792 408,00 K

kodtuq.dll Sat 9 Jul 2005 17:40:24 ..S.R 417 792 408,00 K

mlimg32.dll Sat 9 Jul 2005 17:59:34 ..S.R 417 792 408,00 K

mlorcl32.dll Sun 10 Jul 2005 17:33:20 ..S.R 417 792 408,00 K

rhched20.dll Sat 9 Jul 2005 18:13:14 ..S.R 417 792 408,00 K

wthrm.dll Tue 5 Jul 2005 14:12:00 ..S.R 417 792 408,00 K

 

9 items found: 9 files (8 H/S), 0 directories.

Total of file sizes: 3 760 128 bytes 3,59 M

Locate .tmp files:

 

C:\WINDOWS\SYSTEM32\

guard.tmp Tue 5 Jul 2005 2:00:22 ..S.R 417 792 408,00 K

 

1 item found: 1 file (1 H/S), 0 directories.

Total of file sizes: 417 792 bytes 408,00 K

**********************************************************************************

Directory Listing of system files:

Le volume dans le lecteur C n'a pas de nom.

Le num‚ro de s‚rie du volume est 0461-557E

 

R‚pertoire de C:\WINDOWS\System32

 

10/07/2005 17:33 417ÿ792 mlorcl32.dll

10/07/2005 15:58 417ÿ792 kldcan.dll

10/07/2005 14:04 417ÿ792 dRdim700.dll

09/07/2005 18:13 417ÿ792 rhched20.dll

09/07/2005 17:59 417ÿ792 mlimg32.dll

09/07/2005 17:40 417ÿ792 kodtuq.dll

05/07/2005 14:53 <REP> dllcache

05/07/2005 14:11 417ÿ792 WthRm.dll

05/07/2005 13:00 417ÿ792 ihxrtmgr.dll

05/07/2005 02:00 417ÿ792 guard.tmp

15/01/2005 13:31 <REP> Microsoft

9 fichier(s) 3ÿ760ÿ128 octets

2 R‚p(s) 8ÿ335ÿ802ÿ368 octets libres

[Invité Stonangel]

J'ai l'impression qu'il en manque une partie. Peux-tu poster un nouveau rapport Hijackthis s'il te plaît?

[cliffburton]

ça c'est le notepad après le redémarrage de l'ordi :

 

 

L2Mfix 1.03

 

Running From:

C:\Documents and Settings\Lionheart\Bureau\l2mfix

 

 

 

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above

Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de'>http://www.heysoft.de'>http://www.heysoft.de'>http://www.heysoft.de'>http://www.heysoft.de)

This program is Freeware, use it on your own risk!

 

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:

(NI) ALLOW Full access AUTORITE NT\SYSTEM

(IO) ALLOW Full access AUTORITE NT\SYSTEM

(NI) ALLOW Full access AUTORITE NT\SYSTEM

(IO) ALLOW Full access AUTORITE NT\SYSTEM

(ID-NI) ALLOW Read BUILTIN\Utilisateurs

(ID-IO) ALLOW Read BUILTIN\Utilisateurs

(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir

(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir

(ID-NI) ALLOW Full access BUILTIN\Administrateurs

(ID-IO) ALLOW Full access BUILTIN\Administrateurs

(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM

(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM

(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE

 

 

 

Setting registry permissions:

 

 

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above

Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)

This program is Freeware, use it on your own risk!

 

 

Denying C(CI) access for predefined group "Administrators"

- adding new ACCESS DENY entry

 

 

Registry Permissions set too:

 

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above

Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)

This program is Freeware, use it on your own risk!

 

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:

(CI) DENY --C------- BUILTIN\Administrateurs

(NI) ALLOW Full access AUTORITE NT\SYSTEM

(IO) ALLOW Full access AUTORITE NT\SYSTEM

(NI) ALLOW Full access AUTORITE NT\SYSTEM

(IO) ALLOW Full access AUTORITE NT\SYSTEM

(ID-NI) ALLOW Read BUILTIN\Utilisateurs

(ID-IO) ALLOW Read BUILTIN\Utilisateurs

(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir

(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir

(ID-NI) ALLOW Full access BUILTIN\Administrateurs

(ID-IO) ALLOW Full access BUILTIN\Administrateurs

(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM

(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM

(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE

 

 

 

Setting up for Reboot

 

 

Starting Reboot!

 

C:\Documents and Settings\Lionheart\Bureau\l2mfix

System Rebooted!

 

Running From:

C:\Documents and Settings\Lionheart\Bureau\l2mfix

 

killing explorer and rundll32.exe

 

Scanning First Pass. Please Wait!

 

First Pass Completed

 

Second Pass Scanning

 

Second pass Completed!

Backing Up: C:\WINDOWS\system32\dRdim700.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\dRdim700.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\ihxrtmgr.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\ihxrtmgr.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\ijsecsvc.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\ijsecsvc.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\kldcan.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\kldcan.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\kodtuq.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\kodtuq.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\mlimg32.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\mlimg32.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\MLSCP.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\MLSCP.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\rhched20.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\rhched20.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\WthRm.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\WthRm.dll

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\guard.tmp

1 fichier(s) copi‚(s).

Backing Up: C:\WINDOWS\system32\guard.tmp

1 fichier(s) copi‚(s).

deleting: C:\WINDOWS\system32\dRdim700.dll

Successfully Deleted: C:\WINDOWS\system32\dRdim700.dll

deleting: C:\WINDOWS\system32\dRdim700.dll

Successfully Deleted: C:\WINDOWS\system32\dRdim700.dll

deleting: C:\WINDOWS\system32\ihxrtmgr.dll

Successfully Deleted: C:\WINDOWS\system32\ihxrtmgr.dll

deleting: C:\WINDOWS\system32\ihxrtmgr.dll

Successfully Deleted: C:\WINDOWS\system32\ihxrtmgr.dll

deleting: C:\WINDOWS\system32\ijsecsvc.dll

Successfully Deleted: C:\WINDOWS\system32\ijsecsvc.dll

deleting: C:\WINDOWS\system32\ijsecsvc.dll

Successfully Deleted: C:\WINDOWS\system32\ijsecsvc.dll

deleting: C:\WINDOWS\system32\kldcan.dll

Successfully Deleted: C:\WINDOWS\system32\kldcan.dll

deleting: C:\WINDOWS\system32\kldcan.dll

Successfully Deleted: C:\WINDOWS\system32\kldcan.dll

deleting: C:\WINDOWS\system32\kodtuq.dll

Successfully Deleted: C:\WINDOWS\system32\kodtuq.dll

deleting: C:\WINDOWS\system32\kodtuq.dll

Successfully Deleted: C:\WINDOWS\system32\kodtuq.dll

deleting: C:\WINDOWS\system32\mlimg32.dll

Successfully Deleted: C:\WINDOWS\system32\mlimg32.dll

deleting: C:\WINDOWS\system32\mlimg32.dll

Successfully Deleted: C:\WINDOWS\system32\mlimg32.dll

deleting: C:\WINDOWS\system32\MLSCP.dll

deleting: C:\WINDOWS\system32\MLSCP.dll

deleting: C:\WINDOWS\system32\rhched20.dll

Successfully Deleted: C:\WINDOWS\system32\rhched20.dll

deleting: C:\WINDOWS\system32\rhched20.dll

Successfully Deleted: C:\WINDOWS\system32\rhched20.dll

deleting: C:\WINDOWS\system32\WthRm.dll

Successfully Deleted: C:\WINDOWS\system32\WthRm.dll

deleting: C:\WINDOWS\system32\WthRm.dll

Successfully Deleted: C:\WINDOWS\system32\WthRm.dll

deleting: C:\WINDOWS\system32\guard.tmp

Successfully Deleted: C:\WINDOWS\system32\guard.tmp

deleting: C:\WINDOWS\system32\guard.tmp

Successfully Deleted: C:\WINDOWS\system32\guard.tmp

 

 

Zipping up files for submission:

adding: dRdim700.dll (164 bytes security) (deflated 48%)

adding: ihxrtmgr.dll (164 bytes security) (deflated 48%)

adding: ijsecsvc.dll (164 bytes security) (deflated 48%)

adding: kldcan.dll (164 bytes security) (deflated 48%)

adding: kodtuq.dll (164 bytes security) (deflated 48%)

adding: mlimg32.dll (164 bytes security) (deflated 48%)

adding: MLSCP.dll (164 bytes security) (deflated 48%)

adding: rhched20.dll (164 bytes security) (deflated 48%)

adding: WthRm.dll (164 bytes security) (deflated 48%)

adding: guard.tmp (164 bytes security) (deflated 48%)

adding: clear.reg (164 bytes security) (deflated 22%)

adding: echo.reg (164 bytes security) (deflated 10%)

adding: direct.txt (164 bytes security) (stored 0%)

adding: lo2.txt (164 bytes security) (deflated 85%)

adding: readme.txt (164 bytes security) (deflated 49%)

adding: report.txt (164 bytes security) (deflated 64%)

adding: test.txt (164 bytes security) (deflated 85%)

adding: test2.txt (164 bytes security) (stored 0%)

adding: test3.txt (164 bytes security) (stored 0%)

adding: test5.txt (164 bytes security) (stored 0%)

adding: xfind.txt (164 bytes security) (deflated 82%)

adding: backregs/B0A6B703-0533-4EB2-8BFD-E8486474446E.reg (164 bytes security) (deflated 70%)

adding: backregs/shell.reg (164 bytes security) (deflated 73%)

 

Restoring Registry Permissions:

 

 

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above

Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)

This program is Freeware, use it on your own risk!

 

 

Revoking access for predefined group "Administrators"

Inherited ACE can not be revoked here!

Inherited ACE can not be revoked here!

 

 

Registry permissions set too:

 

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above

Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)

This program is Freeware, use it on your own risk!

 

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:

(NI) ALLOW Full access AUTORITE NT\SYSTEM

(IO) ALLOW Full access AUTORITE NT\SYSTEM

(NI) ALLOW Full access AUTORITE NT\SYSTEM

(IO) ALLOW Full access AUTORITE NT\SYSTEM

(ID-NI) ALLOW Read BUILTIN\Utilisateurs

(ID-IO) ALLOW Read BUILTIN\Utilisateurs

(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir

(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir

(ID-NI) ALLOW Full access BUILTIN\Administrateurs

(ID-IO) ALLOW Full access BUILTIN\Administrateurs

(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM

(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM

(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE

 

 

Restoring Sedebugprivilege:

 

Granting SeDebugPrivilege to Administrators ... failed (GetAccountSid(Administrators)=1332

 

deleting local copy: dRdim700.dll

deleting local copy: dRdim700.dll

deleting local copy: ihxrtmgr.dll

deleting local copy: ihxrtmgr.dll

deleting local copy: ijsecsvc.dll

deleting local copy: ijsecsvc.dll

deleting local copy: kldcan.dll

deleting local copy: kldcan.dll

deleting local copy: kodtuq.dll

deleting local copy: kodtuq.dll

deleting local copy: mlimg32.dll

deleting local copy: mlimg32.dll

deleting local copy: MLSCP.dll

deleting local copy: MLSCP.dll

deleting local copy: rhched20.dll

deleting local copy: rhched20.dll

deleting local copy: WthRm.dll

deleting local copy: WthRm.dll

deleting local copy: guard.tmp

deleting local copy: guard.tmp

 

The following Is the Current Export of the Winlogon notify key:

****************************************************************************

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\

6c,00,00,00

"Logoff"="ChainWlxLogoffEvent"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Logoff"="CryptnetWlxLogoffEvent"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]

"DLLName"="cscdll.dll"

"Logon"="WinlogonLogonEvent"

"Logoff"="WinlogonLogoffEvent"

"ScreenSaver"="WinlogonScreenSaverEvent"

"Startup"="WinlogonStartupEvent"

"Shutdown"="WinlogonShutdownEvent"

"StartShell"="WinlogonStartShellEvent"

"Impersonate"=dword:00000000

"Asynchronous"=dword:00000001

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]

"DLLName"="wlnotify.dll"

"Logon"="SCardStartCertProp"

"Logoff"="SCardStopCertProp"

"Lock"="SCardSuspendCertProp"

"Unlock"="SCardResumeCertProp"

"Enabled"=dword:00000001

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]

"Asynchronous"=dword:00000000

"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Impersonate"=dword:00000000

"StartShell"="SchedStartShell"

"Logoff"="SchedEventLogOff"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]

"Logoff"="WLEventLogoff"

"Impersonate"=dword:00000000

"Asynchronous"=dword:00000001

"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]

"DLLName"="WlNotify.dll"

"Lock"="SensLockEvent"

"Logon"="SensLogonEvent"

"Logoff"="SensLogoffEvent"

"Safe"=dword:00000001

"MaxWait"=dword:00000258

"StartScreenSaver"="SensStartScreenSaverEvent"

"StopScreenSaver"="SensStopScreenSaverEvent"

"Startup"="SensStartupEvent"

"Shutdown"="SensShutdownEvent"

"StartShell"="SensStartShellEvent"

"PostShell"="SensPostShellEvent"

"Disconnect"="SensDisconnectEvent"

"Reconnect"="SensReconnectEvent"

"Unlock"="SensUnlockEvent"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]

"Asynchronous"=dword:00000000

"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Impersonate"=dword:00000000

"Logoff"="TSEventLogoff"

"Logon"="TSEventLogon"

"PostShell"="TSEventPostShell"

"Shutdown"="TSEventShutdown"

"StartShell"="TSEventStartShell"

"Startup"="TSEventStartup"

"MaxWait"=dword:00000258

"Reconnect"="TSEventReconnect"

"Disconnect"="TSEventDisconnect"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]

"DLLName"="wlnotify.dll"

"Logon"="RegisterTicketExpiredNotificationEvent"

"Logoff"="UnregisterTicketExpiredNotificationEvent"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

 

 

The following are the files found:

****************************************************************************

C:\WINDOWS\system32\dRdim700.dll

C:\WINDOWS\system32\dRdim700.dll

C:\WINDOWS\system32\ihxrtmgr.dll

C:\WINDOWS\system32\ihxrtmgr.dll

C:\WINDOWS\system32\ijsecsvc.dll

C:\WINDOWS\system32\ijsecsvc.dll

C:\WINDOWS\system32\kldcan.dll

C:\WINDOWS\system32\kldcan.dll

C:\WINDOWS\system32\kodtuq.dll

C:\WINDOWS\system32\kodtuq.dll

C:\WINDOWS\system32\mlimg32.dll

C:\WINDOWS\system32\mlimg32.dll

C:\WINDOWS\system32\MLSCP.dll

C:\WINDOWS\system32\MLSCP.dll

C:\WINDOWS\system32\rhched20.dll

C:\WINDOWS\system32\rhched20.dll

C:\WINDOWS\system32\WthRm.dll

C:\WINDOWS\system32\WthRm.dll

C:\WINDOWS\system32\guard.tmp

C:\WINDOWS\system32\guard.tmp

 

Registry Entries that were Deleted:

Please verify that the listing looks ok.

If there was something deleted wrongly there are backups in the backreg folder.

****************************************************************************

REGEDIT4

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

"{B0A6B703-0533-4EB2-8BFD-E8486474446E}"=-

[-HKEY_CLASSES_ROOT\CLSID\{B0A6B703-0533-4EB2-8BFD-E8486474446E}]

REGEDIT4

 

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

****************************************************************************

Desktop.ini Contents:

****************************************************************************

****************************************************************************

 

 

 

Et ça c'est le rapport HijackThis :

 

Logfile of HijackThis v1.99.1

Scan saved at 18:47:07, on 10/07/2005

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\rundll32.exe

C:\WINDOWS\Mixer.exe

C:\PROGRA~1\NORTON~1\navapw32.exe

C:\Program Files\AVPersonal\AVGNT.EXE

C:\Program Files\AVPersonal\AVGUARD.EXE

C:\Program Files\AVPersonal\AVWUPSRV.EXE

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe

O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min

O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE

O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

[Invité Stonangel]

Re, ton rapport est propre. Reste à te donner quelques conseils de sécurité.

 

Tu dois savoir que la protection des PC, c’est:

 

-Windows Update parfaitement à jour (catégorie critique, Services Pack et Services Release )

- pare-feu bien paramétré- antivirus bien paramétré et mis à jour régulièrement(quotidiennement s'il le faut) avec un scan complet régulier( journalier s'il le faut).

- une attitude prudente vis à vis de la navigation (pas de sites douteux:cracks, warez, sexe...) et vis à vis de la messagerie (fichiers joints aux messages doivent être scanné avant d'être ouvert)

- une attitude vigilante (être l'affût de fonctionnements inhabituels de ton système)

- nettoyage hebdomadaire du système (suppression des fichiers inutiles, nettoyage de la base de registre, scandisk, defrag)

- scan hebdomadaire antispyware

.

Pour en savoir plus, consulte la page de ipl_001

http://gerard.melone.free.fr/IT/IT-AM0.html

 

Tu dois également installer les outils suivants:

 

-Un pare-feu

Kerio

Zone Alarm

 

-SpywareBlaster:

http://www.javacoolsoftware.com/downloads.html

Son tuto:

http://www.ordi-netfr.org/tutorialspywareblaster.html

 

-Ad-awareSE

http://www.ordi-netfr.com/adawarese.html

http://www.lavasoft.de/support/download/#free

Son tuto

http://home.tiscali.be/schouppeguy/adawarese/adawase.htm

 

-SpyBot-Search & Destroy

http://spybot.safer-networking.de/fr/download/index.html

Son tutohttp://assiste.free.fr/p/frameset/07_spybo...rch_destroy.php

 

-ZebProtect

http://www.zebulon.fr/articles/zebprotect.php

http://telechargement.zebulon.fr/123.html

 

Bon courage et bon surf!!!

 

Auteur: queruak

[cliffburton]

Je prends note quant aux consignes de sécurité.

 

Je vous remercie tous et particulièrement Stonangel pour ta patience et ta présence (surtout un dimanche !).