rapport HijackThis

[lévèque]

Logfile of HijackThis v1.99.1

Scan saved at 19:19:58, on 11/05/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Norton Internet Security\NISUM.EXE

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Norton Internet Security\ccPxySvc.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\ncple\ncprwsnt.exe

C:\WINDOWS\ncple\ncpsec.exe

C:\WINDOWS\ncple\rwsrsu.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

C:\WINDOWS\wanmpsvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\addcf32.exe

C:\Program Files\MessengerPlus! 3\MsgPlus.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\SurfAccuracy\SAcc.exe

C:\WINDOWS\cosmxewc.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

C:\PROGRA~1\INCRED~1\bin\IMApp.exe

C:\Program Files\Logitech\SetPoint\KEM.exe

C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\wuauclt.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\System32\taskmgr.exe

C:\WINDOWS\system32\atlue32.exe

C:\Program Files\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\sysoj.dll/sp.html#37049%http://bulktom.com/r/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\sysoj.dll/sp.html#37049%http://bulktom.com/r/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\aanzg.dll/sp.html#37049%resultposition.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\aanzg.dll/sp.html#37049%resultposition.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\aanzg.dll/sp.html#37049%resultposition.net

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\aanzg.dll/sp.html#37049%resultposition.net

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://adultfriendfinder.com/p/red.cgi?id=zm&pid=p181422

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {0430C22B-732B-F1C7-C898-3B7BB4C0B1AF} - C:\WINDOWS\system32\mfczc32.dll (file missing)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Class - {109212EC-3F75-38A1-64AA-DD6F914869B6} - C:\WINDOWS\system32\apiqg.dll (file missing)

O2 - BHO: Class - {153707B5-D0ED-A171-CBB3-87B9E1296513} - C:\WINDOWS\atlwb32.dll (file missing)

O2 - BHO: Class - {32DAA6BE-6853-C120-02B0-7E948F785121} - C:\WINDOWS\system32\mshf.dll (file missing)

O2 - BHO: Class - {39967C20-72C9-E21F-3C21-30C394038D59} - C:\WINDOWS\system32\winym.dll (file missing)

O2 - BHO: Class - {461CBD76-D477-D4CB-42AA-8EFF519DCBCA} - C:\WINDOWS\d3ub32.dll (file missing)

O2 - BHO: Class - {4D567ABA-C061-F0F9-6007-B9B4A96FB412} - C:\WINDOWS\appuu32.dll (file missing)

O2 - BHO: Class - {50B9D3EB-DAA2-54F6-5C19-8EE4DF6C6816} - C:\WINDOWS\javaiy.dll (file missing)

O2 - BHO: Class - {544AA546-ADBE-242A-7601-DD9E43DBD201} - C:\WINDOWS\ntjy32.dll (file missing)

O2 - BHO: Class - {63C2F5DC-BFB1-5647-D8C6-FBF8BC23512E} - C:\WINDOWS\msnh32.dll (file missing)

O2 - BHO: Class - {707DCCE4-6D01-94F7-97FE-819597AEDA53} - C:\WINDOWS\d3bt.dll (file missing)

O2 - BHO: Class - {72C21BAA-D325-1A25-D9DF-17425A21F1A1} - C:\WINDOWS\atlax.dll (file missing)

O2 - BHO: Class - {75C7424E-E5B4-289A-16E2-5131C7F1BFA8} - C:\WINDOWS\iefr32.dll (file missing)

O2 - BHO: Class - {9335AF6C-4E0A-3B10-CDF8-6CB83172FED9} - C:\WINDOWS\system32\d3bz.dll (file missing)

O2 - BHO: Class - {9B4A74E2-36CF-AEC0-2E39-D19AD5738A13} - C:\WINDOWS\system32\msrz.dll (file missing)

O2 - BHO: Class - {A0E5AE87-7668-2CE9-89A6-1A0AD33F8301} - C:\WINDOWS\system32\winrl.dll (file missing)

O2 - BHO: Class - {A19B27CF-5741-F8BA-D784-95739AD24FF8} - C:\WINDOWS\system32\ntij32.dll (file missing)

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll

O2 - BHO: Class - {AA53A0D9-57FB-624D-B034-9230FDC8B759} - C:\WINDOWS\netdo.dll (file missing)

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)

O2 - BHO: Class - {AC0905B4-4FA0-D9D6-3B94-47CF30F2911A} - C:\WINDOWS\apijc32.dll (file missing)

O2 - BHO: Class - {AEAC41FA-E8BD-B13D-EE1F-5C3661E7CF47} - C:\WINDOWS\system32\d3vm32.dll (file missing)

O2 - BHO: Class - {B37705C6-291F-4773-8C96-959FCAEC0B3D} - C:\WINDOWS\system32\sdkfi.dll (file missing)

O2 - BHO: Class - {BA66C889-E5A1-C7F2-38A0-D7C16991F3E6} - C:\WINDOWS\system32\sdkav.dll (file missing)

O2 - BHO: Class - {BCDF83DD-AE56-4C7F-FEC3-FE7DFCAF30C3} - C:\WINDOWS\system32\winro.dll (file missing)

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: Class - {BE11BEE1-13AF-C553-014B-E5A1433E7C91} - C:\WINDOWS\netey32.dll (file missing)

O2 - BHO: Class - {C4234490-AB93-3C77-F4B1-5BB4DA980CDA} - C:\WINDOWS\system32\crdv32.dll (file missing)

O2 - BHO: Class - {D483F779-88F1-B64C-AE92-0CF26F6DF69B} - C:\WINDOWS\system32\mscs32.dll (file missing)

O2 - BHO: Class - {DF9B5BCB-61F3-F008-0279-3C3D1C8D4D6A} - C:\WINDOWS\system32\syssp.dll (file missing)

O2 - BHO: Class - {E41C8D87-995B-6F74-347B-DEFF6D100316} - C:\WINDOWS\system32\ipdu.dll (file missing)

O2 - BHO: Class - {E425458D-B6C4-2B56-A6A3-7C2B1EA8CCA2} - C:\WINDOWS\apicz.dll (file missing)

O2 - BHO: Class - {E436CD32-AE4D-738A-E06E-D227AC75B577} - C:\WINDOWS\apikb32.dll (file missing)

O2 - BHO: Class - {E4BC97EF-2FA4-2FD4-0CC2-792FEC14B64C} - C:\WINDOWS\system32\apiqn.dll (file missing)

O2 - BHO: Class - {EB23E290-907E-94BF-CFF7-6B4D01234EE8} - C:\WINDOWS\system32\crdx32.dll (file missing)

O2 - BHO: Class - {EC359119-1A6C-52A9-D03C-E373C5AAC363} - C:\WINDOWS\msjq32.dll (file missing)

O2 - BHO: Class - {EDD0FA6A-D598-B563-ABA9-261EAEB33DE2} - C:\WINDOWS\ntzv32.dll (file missing)

O2 - BHO: Class - {F2257FBF-3A02-F7AF-973C-7C0DC972D230} - C:\WINDOWS\ipwi32.dll (file missing)

O2 - BHO: Class - {F6F49380-F6BB-3D04-920B-C960D86C67BC} - C:\WINDOWS\addwm32.dll (file missing)

O2 - BHO: Class - {F81F6A51-F26D-6529-1C72-23DB2ABFE182} - C:\WINDOWS\crru.dll (file missing)

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll (file missing)

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll (file missing)

O4 - HKLM\..\Run: [sSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe

O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [addcf32.exe] C:\WINDOWS\system32\addcf32.exe

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [ntdo.exe] C:\WINDOWS\ntdo.exe

O4 - HKLM\..\Run: [sdkrn.exe] C:\WINDOWS\system32\sdkrn.exe

O4 - HKLM\..\Run: [ntcq.exe] C:\WINDOWS\system32\ntcq.exe

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [sdkrb.exe] C:\WINDOWS\system32\sdkrb.exe

O4 - HKLM\..\Run: [mfclw32.exe] C:\WINDOWS\system32\mfclw32.exe

O4 - HKLM\..\Run: [blockChecker] C:\Program Files\Block Checker\block-checker.exe

O4 - HKLM\..\Run: [surfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe

O4 - HKLM\..\Run: [ReJf5vH] C:\WINDOWS\cosmxewc.exe

O4 - HKLM\..\Run: [uYivùõš/‚²?ÆßfÏNb­C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\xsumv.exe

O4 - HKLM\..\Run: [adminmfcdmp3lies] C:\Documents and Settings\All Users\Application Data\MOVE SAFE ADMIN MFCD\Eggs bold.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [msel.exe] C:\WINDOWS\msel.exe

O4 - HKLM\..\Run: [adddu.exe] C:\WINDOWS\adddu.exe

O4 - HKLM\..\RunOnce: [atlue32.exe] C:\WINDOWS\system32\atlue32.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [incrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c

O4 - HKCU\..\Run: [sIDEBAR] "C:\Program Files\Desktop Sidebar\dsidebar.exe"

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll

O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE

O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE

O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE14} - C:\Program Files\ShopperReports\Bin\1.0.4.0\ShprRprt.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra button: ShopperReports - Compare product prices - {E77EDA01-3C56-4a96-8D08-02B42891C169} - C:\Program Files\ShopperReports\Bin\1.0.4.0\ShprRprt.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm

O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_pa.exe

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.zebulon.fr/outils/antivirus/kav...can_unicode.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...up1.0.0.8-2.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by107fd.bay107.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {69FD62B1-0216-4C31-8D55-840ED86B7C8F} (HbInstObj) - http://installs.hotbar.com/installs/hotbar...rams/hotbar.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {92ABACFE-EF6E-42C7-A824-D50A914B5B70} (MastaCash Loader Class) - http://dx.mastacash.com/loader.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab

O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: WB - C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll

O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ntaj32.exe (file missing)

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe

O23 - Service: Fonction Commande à distance d'iSeries Access for Windows (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: ncprwsnt - Unknown owner - C:\WINDOWS\ncple\ncprwsnt.exe

O23 - Service: NcpSec - Unknown owner - C:\WINDOWS\ncple\ncpsec.exe

O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: RwsRsu (rwsrsu) - Unknown owner - C:\WINDOWS\ncple\rwsrsu.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[bruce lee]

bonsoir leveque,

 

1/ dire bonjour on y a pas le droit?

 

2/ quelles sont tes problemes?

 

3/ as tu suivis la procedure preliminaire?

[lévèque]

Désolé

 

Bonsoir,

 

J'ai un problème avec IEXPLORER qui se lance toute les 10 15 min fesant ramer mon ordinateur. J'avais laissé un message déja dans le serveur et on ma dis de suivre des instructions sur une analyse avec Antivir et de laisser le rapport dans cette catégorie.

Modifié le 11 mai 2006 par lévèque

[bruce lee]

re,

 

 

je regarde ton log et te dis quoi faire retour dans 15 minutes

[lévèque]

Ok merci beaucoup

[bruce lee]

re,

 

on d'abord procedé par etape, ca te fera moins long.

 

telecharge:

 

1/Sp.html-Se.dll http://www.trojaner-board.de/showthread.php?t=22159 de

Lutz Kleimann

 

2/ demarre en mode sans echec http://www.sosordi.net/Faq/Faq.2.html

 

3/ lance Sp.html-Se.dll clique sur Desinfektion starten

 

4/pour supprimer les fichiers nefastes on va tous les afficher en faisant comme ceci:

 

Démarrer, Poste de travail ou autre dossier, Menu Outils, Option des dossiers, onglet Affichage :

Cocher la case : Afficher les fichiers et dossiers cachés

Décocher la case : Masquer les extensions des fichiers dont le type est connu

Décocher la case : Masquer les fichiers protégés du système d'exploitation

cliquer sur "Appliquer"

cliquer sur le bouton "Appliquer à tous les dossiers" / OK

 

5/supprime ce qui est en gras:

 

C:\WINDOWS\system32\ sysoj.dll<== le fichier

 

6/ redemarre en mode normal et repost un nouveau log hijackthis

 

@+

[lévèque]

Merci

[lévèque]

Le logiciel ne marche pas il fait rien lorsque je clique sur "start desinfection"

[bruce lee]

bonjour,

 

es tu bien en mode sans echec? si oui desinstalle le programme et reinstalle le et réessaye.

 

@+

[lévèque]

Bonjour,

 

 

oui j'était en mode sans échec. Le logiciel que j'a télécharger n'a pas d'instalation il se lance direct.

Modifié le 25 mai 2006 par lévèque