Se connecter avec
S'enregistrer | Connectez-vous

fenetre insupprimable !!! help me !!!

Dernière réponse : dans Sécurité

Bonjour a tous !!

j' espère que vous allez pouvoir m'aider car je commence sérieusement a péter un cable !!!!!

depuis environ 1 semaine , je suis infecté par différents types de fenètres qui apparaissent ( 2 fenètres différentes ) , je les fermes et au bout d'environ 20 minutes , elles réapparaissent ! ce qui est assez pénible lorsque je regarde un film .

j'ai lu pas mal de posts comme le miens mais je ne sais pas trop quoi cocher dans mon rapport hijackthis . le voici , j'espère que vous allez me sauver de cette situation , merci d'avance !

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:28:19, on 01/05/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
I:\Windows\System32\smss.exe
I:\Windows\system32\csrss.exe
I:\Windows\system32\wininit.exe
I:\Windows\system32\csrss.exe
I:\Windows\system32\services.exe
I:\Windows\system32\lsass.exe
I:\Windows\system32\lsm.exe
I:\Windows\system32\winlogon.exe
I:\Windows\system32\svchost.exe
I:\Windows\system32\svchost.exe
I:\Windows\System32\svchost.exe
I:\Windows\System32\svchost.exe
I:\Windows\System32\svchost.exe
I:\Windows\system32\svchost.exe
I:\Windows\system32\SLsvc.exe
I:\Windows\system32\svchost.exe
I:\Windows\system32\svchost.exe
I:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
I:\Program Files\Alwil Software\Avast4\ashServ.exe
I:\Windows\System32\spoolsv.exe
I:\Windows\system32\svchost.exe
I:\Program Files\a-squared Free\a2service.exe
I:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
I:\Program Files\Bonjour\mDNSResponder.exe
I:\Windows\system32\svchost.exe
I:\Program Files\Spyware Doctor\svcntaux.exe
I:\Program Files\Spyware Doctor\swdsvc.exe
I:\Windows\system32\svchost.exe
I:\Windows\System32\svchost.exe
I:\Windows\system32\SearchIndexer.exe
I:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
I:\Windows\system32\WUDFHost.exe
I:\Windows\system32\taskeng.exe
I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
I:\Program Files\Alwil Software\Avast4\ashWebSv.exe
I:\Windows\system32\taskeng.exe
I:\Windows\system32\Dwm.exe
I:\Windows\Explorer.EXE
I:\ProgramData\datetajo\fafqnazo.exe
I:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
I:\Windows\System32\rundll32.exe
I:\Program Files\Alwil Software\Avast4\ashDisp.exe
I:\Program Files\iTunes\iTunesHelper.exe
I:\Program Files\Spyware Doctor\SDTrayApp.exe
I:\Windows\ehome\ehtray.exe
I:\Program Files\Windows Live\Messenger\msnmsgr.exe
I:\Windows\System32\fghslabc.exe
I:\Windows\System32\rundll32.exe
I:\Windows\system32\wbem\unsecapp.exe
I:\Windows\ehome\ehmsas.exe
I:\Windows\system32\wbem\wmiprvse.exe
I:\Program Files\iPod\bin\iPodService.exe
I:\Program Files\Windows Live\Messenger\usnsvc.exe
I:\Program Files\Windows Media Player\WMPNSCFG.exe
I:\Program Files\Windows Media Player\wmpnetwk.exe
I:\Windows\System32\mobsync.exe
I:\Program Files\Mozilla Firefox\firefox.exe
I:\Users\Lucas\Desktop\HiJackThis.exe
I:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {97EBE3CC-10A7-4619-B127-9B5D4FA476A8} - (no file)
O2 - BHO: (no name) - {D2A43944-58E0-4083-9BB4-E184B335AF35} - I:\Windows\system32\pmnkKeET.dll (file missing)
O3 - Toolbar: (no name) - {57ABA3CE-E927-4C81-BE2E-E20CAEC6645F} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE I:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE I:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "I:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SDTray] "I:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [ehTray.exe] I:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [vnwecqhu] I:\Windows\system32\lgbwhovc.exe
O4 - HKCU\..\Run: [eftaevkf] I:\Windows\system32\snafkfwb.exe
O4 - HKCU\..\Run: [msnmsgr] "I:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [jhswwxrj] I:\Windows\system32\fghslabc.exe
O4 - HKCU\..\Run: [qcjyhzby] I:\Windows\system32\wxmlyxqb.exe
O4 - HKCU\..\Run: [zfvyfppu] I:\Windows\system32\adsjcfqf.exe
O4 - HKCU\..\Run: [gprwetdv] I:\Windows\system32\ifyruxwv.exe
O4 - HKLM\..\Policies\Explorer\Run: [D9WPKtmGqm] I:\ProgramData\datetajo\fafqnazo.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - I:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - I:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O21 - SSODL: ogxtsepr - {A4384D3B-E811-45B8-B92B-B9D04A6E8267} - I:\Windows\ogxtsepr.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - I:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - I:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - I:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - I:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Unknown owner - I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - I:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - I:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - I:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: ServiceLayer - Nokia. - I:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 8963 bytes






Merci d'avance pour votre aide qui me sera tres precieuse !!!!

Autres pages sur : fenetre insupprimable help

Lassé par la pub ? Créez un compte

Bonjour,

Télécharge MalwareByte's Anti-Malware sur ton Bureau.
Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.

Une fois l'installation et la mise à jour effectuées, redémarre en mode sans échec.
AIDE : Redémarrer en mode sans échec

  • Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".
  • Afin de lancer la recherche, clic sur"Rechercher".
  • Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :
    -- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
    -- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.
    [#ff0000]REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.[/#f]

    AIDE : Tuto en images sur MBAM

    bonsoir !

    tout d'abord merci de ton aide !!!

    voila le rapport que ma donné Malwarebyte's apres 2heures11 d'attente :sleep:  :

    Malwarebytes' Anti-Malware 1.11
    Version de la base de données: 707

    Type de recherche: Examen complet (C:\|D:\|I:\|)
    Eléments examinés: 134975
    Temps écoulé: 2 hour(s), 23 minute(s), 20 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 19
    Valeur(s) du Registre infectée(s): 2
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 6

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_CLASSES_ROOT\CLSID\{eec73ea5-1367-49d1-93f4-ca1d8c22e9f9} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{0882b175-f982-41b1-91a6-3593ab992df7} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{4708135c-9d19-4b8a-a47c-7f85ec67b5ee} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{17d4667e-4c4b-4f45-a22b-4087f9e1ff00} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a4384d3b-e811-45b8-b92b-b9d04a6e8267} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\uninstall (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\services (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorertoolbar (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\mwc (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\sgoblxtm.bpsb (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\sgoblxtm.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ogxtsepr (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    I:\Windows\ogxtsepr.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    I:\Windows\System32bdn.com (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    I:\Windows\System32hxiwlgpm.dat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    I:\Windows\System32ssvchost.com (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    I:\Windows\System32taack.dat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    I:\Windows\System32VBIEWER.OCX (Fake.Dropped.Malware) -> Quarantined and deleted successfully.


    maintenant , qu'est ce que je doit faire ??? j'atends votre aide , merci !
    au revoir !

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:25:24, on 02/05/2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    I:\Windows\System32\smss.exe
    I:\Windows\system32\csrss.exe
    I:\Windows\system32\wininit.exe
    I:\Windows\system32\csrss.exe
    I:\Windows\system32\services.exe
    I:\Windows\system32\lsass.exe
    I:\Windows\system32\lsm.exe
    I:\Windows\system32\winlogon.exe
    I:\Windows\system32\svchost.exe
    I:\Windows\system32\svchost.exe
    I:\Windows\System32\svchost.exe
    I:\Windows\System32\svchost.exe
    I:\Windows\System32\svchost.exe
    I:\Windows\system32\svchost.exe
    I:\Windows\system32\SLsvc.exe
    I:\Windows\system32\svchost.exe
    I:\Windows\system32\svchost.exe
    I:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    I:\Windows\System32\spoolsv.exe
    I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    I:\Windows\system32\svchost.exe
    I:\Windows\system32\taskeng.exe
    I:\Windows\system32\Dwm.exe
    I:\Windows\Explorer.EXE
    I:\Program Files\a-squared Free\a2service.exe
    I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    I:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    I:\Program Files\Bonjour\mDNSResponder.exe
    I:\Windows\system32\svchost.exe
    I:\Program Files\Spyware Doctor\svcntaux.exe
    I:\Program Files\Spyware Doctor\swdsvc.exe
    I:\Windows\system32\svchost.exe
    I:\Windows\System32\svchost.exe
    I:\Windows\system32\SearchIndexer.exe
    I:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    I:\Program Files\Spyware Doctor\SDTrayApp.exe
    I:\Windows\system32\WUDFHost.exe
    I:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    I:\Windows\System32\rundll32.exe
    I:\Program Files\iTunes\iTunesHelper.exe
    I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    I:\Windows\ehome\ehtray.exe
    I:\Windows\System32\rundll32.exe
    I:\Windows\system32\wbem\wmiprvse.exe
    I:\Windows\system32\taskeng.exe
    I:\Windows\ehome\ehmsas.exe
    I:\Windows\system32\wbem\unsecapp.exe
    I:\Program Files\iPod\bin\iPodService.exe
    I:\Program Files\Windows Live\Messenger\usnsvc.exe
    I:\Program Files\Windows Media Player\WMPNSCFG.exe
    I:\Program Files\Windows Media Player\wmpnetwk.exe
    I:\Program Files\Windows Live\Messenger\msnmsgr.exe
    I:\Program Files\Mozilla Firefox\firefox.exe
    I:\Users\Lucas\Desktop\traitement spyware\HiJackThis.exe
    I:\Windows\system32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {97EBE3CC-10A7-4619-B127-9B5D4FA476A8} - (no file)
    O2 - BHO: (no name) - {D2A43944-58E0-4083-9BB4-E184B335AF35} - I:\Windows\system32\pmnkKeET.dll (file missing)
    O3 - Toolbar: (no name) - {57ABA3CE-E927-4C81-BE2E-E20CAEC6645F} - (no file)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE I:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE I:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "I:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SDTray] "I:\Program Files\Spyware Doctor\SDTrayApp.exe"
    O4 - HKLM\..\Run: [avgnt] "I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKCU\..\Run: [ehTray.exe] I:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [vnwecqhu] I:\Windows\system32\lgbwhovc.exe
    O4 - HKCU\..\Run: [eftaevkf] I:\Windows\system32\snafkfwb.exe
    O4 - HKCU\..\Run: [msnmsgr] "I:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [jhswwxrj] I:\Windows\system32\fghslabc.exe
    O4 - HKCU\..\Run: [qcjyhzby] I:\Windows\system32\wxmlyxqb.exe
    O4 - HKCU\..\Run: [zfvyfppu] I:\Windows\system32\adsjcfqf.exe
    O4 - HKCU\..\Run: [gprwetdv] I:\Windows\system32\ifyruxwv.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - I:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - I:\Program Files\Bonjour\ExplorerPlugin.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O13 - Gopher Prefix:
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - I:\Program Files\a-squared Free\a2service.exe
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - I:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - I:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - I:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Unknown owner - I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - I:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - I:\Program Files\Spyware Doctor\svcntaux.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - I:\Program Files\Spyware Doctor\swdsvc.exe
    O23 - Service: ServiceLayer - Nokia. - I:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 8551 bytes

    voila , et ensuite ?

    Re,

    [#ff0000]Désactive tes protections résidentes (antivirus, Spybot-S&D, etc.) ![/#f]

  • Télécharge ComboFix ([#ff0000]sUBs[/#f]) sur ton Bureau.
  • Double clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
  • Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\combofix.txt*) dans ta prochaine réponse.

    AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
    * le nom de la partition peut changer

    On fait autrement alors.

    Fix les lignes dans le cadre ci-dessous avec Hijackthis : AIDE EN IMAGES

    O2 - BHO: (no name) - {97EBE3CC-10A7-4619-B127-9B5D4FA476A8} - (no file)
    O2 - BHO: (no name) - {D2A43944-58E0-4083-9BB4-E184B335AF35} - I:\Windows\system32\pmnkKeET.dll (file missing)
    O3 - Toolbar: (no name) - {57ABA3CE-E927-4C81-BE2E-E20CAEC6645F} - (no file)
    O4 - HKCU\..\Run: [vnwecqhu] I:\Windows\system32\lgbwhovc.exe
    O4 - HKCU\..\Run: [eftaevkf] I:\Windows\system32\snafkfwb.exe
    O4 - HKCU\..\Run: [jhswwxrj] I:\Windows\system32\fghslabc.exe
    O4 - HKCU\..\Run: [qcjyhzby] I:\Windows\system32\wxmlyxqb.exe
    O4 - HKCU\..\Run: [zfvyfppu] I:\Windows\system32\adsjcfqf.exe
    O4 - HKCU\..\Run: [gprwetdv] I:\Windows\system32\ifyruxwv.exe


    Télécharge OTMoveIt (d'OldTimer). Sauvegarde-le sur ton Bureau.
    Sélectionne tous les emplacements dans le cadre ci-dessous :

    I:\Windows\system32\lgbwhovc.exe
    I:\Windows\system32\snafkfwb.exe
    I:\Windows\system32\fghslabc.exe
    I:\Windows\system32\wxmlyxqb.exe
    I:\Windows\system32\adsjcfqf.exe
    I:\Windows\system32\ifyruxwv.exe

    ---> Clique-droit puis Copier (ou Ctrl+C)

    Double-clique sur OTMoveIt.exe afin de le lancer.
    Fais un Clique-droit sur le cadre de gauche puis choisis Coller (ou Ctrl+V).
    Clique maintenant sur [#ff0000]MoveIt![/#f]

    [#ff0000]Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
    Accepte en cliquant sur YES.[/#f]

    Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
    Le nom du rapport correspond au moment de sa création : date_heure.log

    ->Informations sur le logiciel<-

    File/Folder I:\Windows\system32\lgbwhovc.exe not found.
    File/Folder I:\Windows\system32\snafkfwb.exe not found.
    File/Folder I:\Windows\system32\fghslabc.exe not found.
    File/Folder I:\Windows\system32\wxmlyxqb.exe not found.
    File/Folder I:\Windows\system32\adsjcfqf.exe not found.
    File/Folder I:\Windows\system32\ifyruxwv.exe not found.
    File/Folder not found.

    OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 05082008_000623

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:36:45, on 11/05/2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    I:\Windows\System32\smss.exe
    I:\Windows\system32\csrss.exe
    I:\Windows\system32\wininit.exe
    I:\Windows\system32\csrss.exe
    I:\Windows\system32\services.exe
    I:\Windows\system32\lsass.exe
    I:\Windows\system32\lsm.exe
    I:\Windows\system32\winlogon.exe
    I:\Windows\system32\svchost.exe
    I:\Windows\system32\svchost.exe
    I:\Windows\System32\svchost.exe
    I:\Windows\System32\svchost.exe
    I:\Windows\System32\svchost.exe
    I:\Windows\system32\svchost.exe
    I:\Windows\system32\SLsvc.exe
    I:\Windows\system32\svchost.exe
    I:\Windows\system32\svchost.exe
    I:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    I:\Windows\System32\spoolsv.exe
    I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    I:\Windows\system32\svchost.exe
    I:\Program Files\a-squared Free\a2service.exe
    I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    I:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    I:\Program Files\Bonjour\mDNSResponder.exe
    I:\Windows\system32\svchost.exe
    I:\Program Files\Spyware Doctor\svcntaux.exe
    I:\Program Files\Spyware Doctor\swdsvc.exe
    I:\Windows\system32\svchost.exe
    I:\Windows\System32\svchost.exe
    I:\Windows\system32\SearchIndexer.exe
    I:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    I:\Windows\system32\WUDFHost.exe
    I:\Windows\system32\taskeng.exe
    I:\Windows\system32\taskeng.exe
    I:\Windows\system32\Dwm.exe
    I:\Windows\Explorer.EXE
    I:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    I:\Windows\System32\rundll32.exe
    I:\Program Files\iTunes\iTunesHelper.exe
    I:\Program Files\Spyware Doctor\SDTrayApp.exe
    I:\Windows\ehome\ehtray.exe
    I:\Windows\System32\rundll32.exe
    I:\Windows\system32\wbem\wmiprvse.exe
    I:\Windows\ehome\ehmsas.exe
    I:\Windows\system32\wbem\unsecapp.exe
    I:\Program Files\iPod\bin\iPodService.exe
    I:\Windows\system32\conime.exe
    I:\Program Files\Windows Live\Messenger\usnsvc.exe
    I:\Program Files\Windows Media Player\WMPNSCFG.exe
    I:\Program Files\Windows Media Player\wmpnetwk.exe
    I:\Program Files\Windows Live\Messenger\msnmsgr.exe
    I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    I:\Program Files\Mozilla Firefox\firefox.exe
    I:\Users\Lucas\Desktop\traitement spyware\HiJackThis.exe
    I:\Windows\system32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE I:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE I:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "I:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SDTray] "I:\Program Files\Spyware Doctor\SDTrayApp.exe"
    O4 - HKLM\..\Run: [avgnt] "I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKCU\..\Run: [ehTray.exe] I:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [msnmsgr] "I:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - I:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - I:\Program Files\Bonjour\ExplorerPlugin.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O13 - Gopher Prefix:
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - I:\Program Files\a-squared Free\a2service.exe
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - I:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - I:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - I:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - I:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Unknown owner - I:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - I:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - I:\Program Files\Spyware Doctor\svcntaux.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - I:\Program Files\Spyware Doctor\swdsvc.exe
    O23 - Service: ServiceLayer - Nokia. - I:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 7941 bytes
    Lassé par la pub ? Créez un compte

    Créer un nouveau sujet

    Tom's guide dans le monde