Troyen Sheur2 et ses amis... qu'est-ce donc ? Fermé

Question

Bonjour,

J'ai durant cette semaine reçu deux fois le message de mon avg à l'ouverture de mon ordi : blablabla virus détecté : Sheur2.xxx (xxx signifiant trois lettres, mais je ne me souviens plus lesquelles, 2 fois différentes). Ces 2 troyens ont été détectés dans Sim City et Les Sims... je les ai "move to vault" et lors de la première fois, le virus était resté dans le système de restauration, je me suis dit je vide le coffre donc je viens de le faire... maintenant, je viens à vous dans le but de recevoir juste une réponse à ma question... mais d'où il vient ce foutu virus !!!??? parce que ces jeux sont quand même sûrs... donc il a bien fallu qu'il vienne de quelque part pour s'y cacher... enfin bref... que puis-je faire pour les virer définitivement et qu'il me revienne pas la semaine prochaine pour me dire que Sheur2 a infecté les Sims2 ou je ne sais quoi !

Enfin bref, voilà, je remercie qui voudra bien me répondre !! ;) (et peut-être devrais-je faire un rapport hijackthis ? )
J'attends de vos nouvelles, merci d'avance :)

loloetseb · Answer

Ce sont des jeux que tu as acheté dans le commerce ou des jeux crackés?,car s'ils sont crackés ,tu as du prendre un virus bagle

loloetseb · Answer

Si tu souhaites qu'un helpeur puisse analyser ton ordinateu,fais un rapport hijack this 2.2 (cliques do a scan and save a log),et, poste le log sur la page (ctrl+c et ctrl+v).

Ensuite tu peux charger le logiciel malwarebytes (fais la mise a jour) et tu lances un scan rapide (jusqu'a la fin de la procedure).Si le logiciel te detecte quelque chose,fais supprimer,il fera une copie des fichiers contaminés en quarantaine et poste le log sur la page

Lily · Answer

non non, justement, ils sont bien achetés ! C'est pour ça que je me demandais d'où ça pouvait provenir... je te poste mon log hijack ! :)  J'y connais pas grand chose, mais en regardant, il me semble qu'il y a des trucs bizarres... genre un machin shopping j'sais pas quoi
Merci ;)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:30:00, on 18.01.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Zango\bin\10.3.75.0\OEAddOn.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\DOCUME~1\stephane\LOCALS~1\Temp\clclean.0001
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Profiler\lwemon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Documents and Settings\stephane\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ikzgffl.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O2 - BHO: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule	bSecu.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Zango - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.75.0\HostIE.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule	bSecu.dll
O3 - Toolbar: Zango - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.75.0\HostIE.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ZangoOE] C:\Program Files\Zango\bin\10.3.75.0\OEAddOn.exe
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [Gnetmous] C:\Program Files\Samsung\Samsung Optical Middle Mouse\gnetmous.exe
O4 - HKLM\..\Run: [Flash Media] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [BVRPLiveUpdate] C:\Program Files\Avanquest update\Engine\Setup.exe -s /PATCH,/SRCUPDATEC:\DOCUME~1\ALLUSE~1\APPLIC~1\SONYER~1\SONYER~1\LIVEUP~1\LISTOF~1.DAT
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOneegister.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CH/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.bellapix.com/UploadLaboParAurigma/ImageUploader3.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe

Lily · Answer

comme dirait Homer Simpson... ouh pinaise de pinaise...
malware examen rapide me détecte trojan.lop ... et autres joyeusetés (196 au total) dont rootkit, super ! ^^ (oui c'est ironique bien sûr)

voilà le LOG et encore merci d'avance ! :)


Malwarebytes' Anti-Malware 1.32
Version de la base de données: 1649
Windows 5.1.2600 Service Pack 3

18.01.2009 13:53:13
mbam-log-2009-01-18 (13-53-10).txt

Type de recherche: Examen rapide
Eléments examinés: 54432
Temps écoulé: 6 minute(s), 54 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 130
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 20
Fichier(s) infecté(s): 39

Processus mémoire infecté(s):
C:\Program Files\Zango\bin\10.3.75.0\OEAddOn.exe (Adware.180Solutions) -> No action taken.

Module(s) mémoire infecté(s):
C:\Program Files\Zango\bin\10.3.75.0\HostOE.dll (Adware.180Solutions) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\coresrv.lfgax (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{0729f461-8054-47dc-8d39-a31b61cc0119} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{40ca90f3-4098-4877-ae87-23eb612b18c7} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{4c3b62af-ca25-4fba-8405-32e44f83bb6f} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{5a635a91-c303-45c9-8db9-f759d98a3b9d} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{7e335d04-2e6e-4d0e-a921-c3d9192e7121} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{99ccfb8c-6380-4a14-8fdd-ef3e7e95335d} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{b20d7add-989c-4bc0-a797-f6fe7998efd7} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{bfc20a15-b0ac-44cc-a25a-a7039014ba9f} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{f019aec4-4c95-46de-a107-e302473e3b9a} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2d00aa2a-69ef-487a-8a40-b3e27f07c91e} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{86c5840b-80c4-4c30-a655-37344a542009} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{b0cb585f-3271-4e42-88d9-ae5c9330d554} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\coresrv.lfgax.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eddbb5ee-bb64-4bfc-9dbe-e7c85941335b} (Adware.Zango) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{148e1447-c728-48fd-beec-a7d06c5fff58} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{8ee46f55-1ce1-4db9-811a-68938ec7f3dd} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{a87dfd99-cf81-4241-85ce-881e0026b686} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{c96b9fae-a032-4100-bb47-32ef05e28be4} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{14113b47-d59c-4f0f-9d10-ff1730265584} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a9c42a57-421c-4572-8b12-249c59183d1c} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{a57470de-14c7-4fcd-9d4c-e5711f24f0ed} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2557dd3f-23a0-477c-bcd8-90fd0aecc4b8} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2893116c-a176-42b1-8794-da8c9fc45564} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{99fdca0c-7380-4e9c-8d99-5dc4750334ef} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{b1d9f4b1-b9ff-463f-bf15-ab9cb26160f7} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2aa2fbf8-9c76-4e97-a226-25c5f4ab6358} (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{2aa2fbf8-9c76-4e97-a226-25c5f4ab6358} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{2aa2fbf8-9c76-4e97-a226-25c5f4ab6358} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{71f731b3-008b-4052-9ea4-4145acce40c3} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{8292078f-f6e9-412b-8eb1-360c05c5ece5} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2447e305-5e90-42a8-bd1e-0bc333b807e1} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{50d2fdcc-2707-49cb-8223-7fe0424909aa} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{878ce013-7ba9-4650-a78c-b2234c0c1648} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a5b6fa30-d317-41ca-9cb1-c898d3c7f34e} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{cc19a5f2-b4ad-41d5-a5c9-0680904c1483} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{03d7ff6e-9781-40b5-bb7f-94291a361604} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{3ceb04ab-08af-45f4-81b4-70d13c1f7b85} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{a7213d71-47e1-4832-92d7-d61dfe9f231f} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{cf82f350-e1c4-4916-ac12-ba73db60afb7} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{c62a9e79-2b52-439b-af57-2e60bb06e86c} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{15fd8424-d12a-4c51-8c6c-d5d57b80f781} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{67b3becf-7b6f-42b2-99f0-f7656f89cffa} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{715ffd42-4e05-4eab-9513-c8daa5395ae2} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{759d6f7c-8d30-45b6-abea-fa51c190eed5} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{9a4a64a4-a2fb-48fa-9bba-1ac50267695d} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{62906e60-bce2-4e1b-9ed0-8b9042ee15e4} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{f9bfa98d-9935-4ea4-a05a-72c7f0778f02} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{abec1835-3181-4abd-8dde-875aec4df6d2} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{0af9a087-0cbf-46b2-9dc9-52d0d16b5ab6} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{69725738-cd68-4f36-8d02-8c43722ee5da} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{69725738-cd68-4f36-8d02-8c43722ee5da} (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-cd68-4f36-8d02-8c43722ee5da} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{a56fe01c-77c4-4f5e-8198-e4b72207890a} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{af55160d-cde1-4a8b-8001-66da06bee740} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{89085678-632d-4deb-bda0-cd912c63203e} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{30b15818-e110-4527-9c05-46ace5a3460d} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{618aad04-921f-44c2-be38-c0818af69861} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{b5d2ed96-62f9-4c2c-956d-e425b1f67337} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{d3a412e8-1e4b-47d2-9b12-f88291f5afbb} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{3788e535-897b-463d-b6d6-fee5b86ec144} (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3788e535-897b-463d-b6d6-fee5b86ec144} (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{d3f940ea-4e87-423b-9091-934e1e4fceae} (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{d3f940ea-4e87-423b-9091-934e1e4fceae} (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\shoppingreport (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Adware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\zangosa (Adware.Zango) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Zango (Adware.Zango) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZangoSA (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\zangoax.clientdetector (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\zangoax.clientdetector.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\zangoax.userprofiles (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\zangoax.userprofiles.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT	oolbar.toolbarctl (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT	oolbar.toolbarctl.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT	oolbar.htmlmenuui (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT	oolbar.htmlmenuui.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\srv.coreservices (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\srv.coreservices.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\hostol.webmailsend (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\hostol.webmailsend.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\hostol.mailanim (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\hostol.mailanim.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\hostie.bho (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\hostie.bho.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\hbr.hbmain (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\hbr.hbmain.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\hbmain.commband (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\hbmain.commband.1 (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\coresrv.coreservices (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\coresrv.coreservices.1 (Adware.Zango) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\asc3550p (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\zango (Adware.180Solutions) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zangooe (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\Zango@Zango.com (Adware.Zango) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\zango 10.3.75.0 (Adware.Zango) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Zango (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0 (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\firefox (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\firefox\extensions (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\firefox\extensions\components (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\firefox\extensions\plugins (Adware.180Solutions) -> No action taken.
C:\Program Files\ShoppingReport (Adware.Shopping.Report) -> No action taken.
C:\Program Files\ShoppingReport\Bin (Adware.Shopping.Report) -> No action taken.
C:\Program Files\ShoppingReport\Bin\2.5.0 (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA (Adware.Zango) -> No action taken.
C:\Program Files\2M Games (Adware.WebHancer) -> No action taken.
C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> No action taken.
C:\Program Files\BitDownload (Trojan.Lop) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cs\db (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cseport (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cses2 (Adware.Shopping.Report) -> No action taken.

Fichier(s) infecté(s):
C:\Program Files\Zango\bin\10.3.75.0\CoreSrv.dll (Adware.Zango) -> No action taken.
C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (Adware.Shopping.Report) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\arrow.ico (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\CntntCntr.dll (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\copyright.txt (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\HostIE.dll (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\HostOE.dll (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\HostOL.dll (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\link.ico (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\OEAddOn.exe (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\Srv.exe (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\Toolbar.dll (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\Wallpaper.dll (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\Weather.exe (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\WeSkin.dll (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\ZangoSA.exe (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\ZangoSAAX.dll (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\ZangoSADF.exe (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\ZangoSAHook.dll (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\ZangoUninstaller.exe (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\firefox\extensions\chrome.manifest (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\firefox\extensions\install.rdf (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\firefox\extensions\components
pclntax.xpt (Adware.180Solutions) -> No action taken.
C:\Program Files\Zango\bin\10.3.75.0\firefox\extensions\plugins
pclntax_ZangoSA.dll (Adware.180Solutions) -> No action taken.
C:\Program Files\ShoppingReport\Uninst.exe (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSA.dat (Adware.Zango) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAAbout.mht (Adware.Zango) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAau.dat (Adware.Zango) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAEula.mht (Adware.Zango) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSA_kyf.dat (Adware.Zango) -> No action taken.
C:\Program Files\BitDownload\BitDownload.TRC (Trojan.Lop) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cseport\aggr_storage.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cseport\send_storage.xml (Adware.Shopping.Report) -> No action taken.
C:\Documents and Settings\stephane\Application Data\ShoppingReport\cses2\WhiteList.dbs (Adware.Shopping.Report) -> No action taken.
C:\WINDOWS\system32\drivers\asc3550p.sys (Rootkit.Agent) -> No action taken.

loloetseb · Answer

Tu n'as pas fait le scan malwarebytes jusqu'au bout .A la fin du scan,le logiciel  te demandes si tu souhaites supprimer,dis oui ,il te fera une sauvegarde des fichiers concernés en quarantaine.Refais donc un scan malwarebytes car tes fichiers infectés sont toujours actifs sur l'ordinateur

loloetseb · Answer

Tu as un rootkit sur ton ordinateur qui doit camoufler d'autres infections et favorise l'installation de lofgiciel malveillant

tu as un trojan lop sur bit defender qui doit bloquer les maj et le scan de l'antivirus

et quelques adware qui doivent te lancer de la pub, non?

loloetseb · Answer

Les rootkit sont tres mal detecté par les antivrus,on va d'abord essayer d'eradiquer le rootkit car sinon tu auras de nouveaux des infections.As tu fais le scan malwarebytes?

loloetseb · Answer

Peux tu poster le log de malwarebytes,tu vas dans rapport log,tu selectionnes le dernier rapport (date et heure) et tu fais ctrl+c et ctrl +v et tu colles le rapport sur la page

Lily · Answer

Petit problème de pseudo, mais c'est bien moi ci-dessus :)

loloetseb · Answer

Tu as pas mal de lignes infectueuses sur ton rapport hijack this,notamment la toolbar zambo,je doute que l'infection soit terminé

loloetseb · Answer

Afin de supprimer la toolbar sango ,suit la procedure dessous:


# Allez dans ajout/suppression de programmes du panneau de configuration
# Chercher dans la liste Zango et lancez la désinstallation.

Si elle ne se desinstalle pas ,on essaiera une autre procedure

loloetseb · Answer

Cette toolbar zango est vecteur d'infection,as tu reussi a la desinstaller.De meme ,tu as beaucoup d'autres toolbar,non infectueuses mais vecteur possibles d'infection(les toolbar facilitent l'entrée de logiciel malveillant,si tu n'as pas utilité d'avoir toolbar google,swett im toolbar,etc,tu peux les desinstaller aussi.

Ensuite poste un rapport hijack this on va fixer certaines lignes

aurelie_vs · Answer

Oui, Zango enlevé sans problème !

log hijack : me semble que le F2 devrait être fix, non ? (bien sûr, je ne fais rien sans ton aval ;) )


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:01:16, on 18.01.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Profiler\lwemon.exe
C:\DOCUME~1\stephane\LOCALS~1\Temp\clclean.0001
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\PROGRA~1\AVG\AVG8\avgscanx.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Documents and Settings\stephane\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ikzgffl.exe,
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule	bSecu.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule	bSecu.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [Gnetmous] C:\Program Files\Samsung\Samsung Optical Middle Mouse\gnetmous.exe
O4 - HKLM\..\Run: [Flash Media] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [BVRPLiveUpdate] C:\Program Files\Avanquest update\Engine\Setup.exe -s /PATCH,/SRCUPDATEC:\DOCUME~1\ALLUSE~1\APPLIC~1\SONYER~1\SONYER~1\LIVEUP~1\LISTOF~1.DAT
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOneegister.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CH/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.bellapix.com/UploadLaboParAurigma/ImageUploader3.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe

Lily · Answer

décidément ces pseudos :) j'avais la flemme de me connecter premièrement, mais j'ai été connectée, aurelie_vs c'est moi... je suis désolée hein ! :-s

loloetseb · Answer

Tu relances hijack this en do a scan only et tu fixes


O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Ainsi que les lignes en 016 (qui ne sont pas indispensables)

Ensuite vides la quarantaine de malwarebytes

Fais un scan en ligne sur l'un des sites ci dessous (acceptes l'active x lors du lancement du logiciel)

Secuser

bitdefender

et postes le rapport (je ne pense pas que l'infection soit encore eradiquer,c est pour ca qu'on va faire un controle)

loloetseb · Answer

Il est conseillé de desactiver ton antivirus pendant le scan en ligne car sinon,tu risques d'avoir des perturbations


Ensuite,si tout va bien il faudra proteger ton ordinateur

- ANTIVIRUS AVG est ben

-FIREWALL pc tool frewall plus est tres fonctionnel

-SPYWARE BLASTER afin de bloquer l'installation des active x souvent malveillant

1 ou deux antispyware : MALWAREBYTES ET SUPER ANTISPYWARE sont tous les deux tres bons

CCLEANER afin de nettoyer tes fichiers temporaires et ton registre

SECUNIA :afin de controler la mise a jour des logiciels presents sur ton ordinateur

Surfer avec firefox plutot qu'avec ie7 (dans ce cas la installe firefox 3 avec les extension adblock plus,no script, mc affe site adiser et dr web)

Ensuite l'ideal est que tu te crée une cession avec les droits administateurs restreints (ceci evite la propagation des virus que tu peux attrapper sur internet).Tu mets a jour les logiciels de ton ordinateur sur la cession principale et tu surf sur ta cession avec droits restrints

Lily · Answer

ok, c'était avg qui bloquait apparemment car j'ai fermé et ça marche

Lily · Answer

euh, c'est normal si le temps estimé est de 4-5 heures ??

loloetseb · Answer

Quand le scan est fini,si tout est ok,je te conseille ,de telecharger le logiciel avg anti rootkit gratuit,tu peux le telecharger sur CCC 

4 OU 5 heures ,ca me parait assez long,je pense qu'une fois le scan lancé le temps devrait rapidement diminuer,mais ca peut arriver que cela soit assez long!!!!!

loloetseb · Answer

Ca peut arriver que le scan soit assez long,mais je pense que le temps devrait diminuer rapidement avec l'avancé du processus.

Tu peux telecharger ,une fois que le scan est terminé,le nouveau logiciel d'avg gratuit AVG anti rootkit (tu peux le teelcharger sur CCC),cela nous permettra de controler qu'un rootkit n'est pas encore present sur ton ordianteur (elles sont tenaces et discretes ces petites bebetes)

Lily · Answer

ouais c'est passé à 20 heures et redescendu à 5heures, problème, je dois partir à 18h, mais bon, je vais espérer... ^^

loloetseb · Answer

Ben sinon ,t'inquietes pas,tu laisses tourner,et, tu me postes le log quand tu reviens,je reste connecté toute la journée.

Lily · Answer

en fait je reviens pas avant vendredi, c'est pour ça. bref, le bitdefender a déjà trouvé des virus, question, va-t-il les supprimer, ou comment ça se passe ? il en a supprimé déjà mais certains non, donc je ne sais pas comment faire. 
Sinon je continuerai vendredi, merci :)

loloetseb · Answer

On peut esperer que le scan sera terminé avant 18h,quand celui ci est terminé,postes le rapport sur la page,on reprendra vendredi quand tu seras revenu,si je m'en sors pas,on demandera de l'aide a un helpeur,t 'inquietes pas,on en viendra a bout!!!!

loloetseb · Answer

Suivant la nature de ton infection,celle ci pourra depasser ma competence,donc on demandera de l'aide,car certain logiciels seront utilisés qui necessite une connaissance particulieres de ceux ci.

Postes juste le rapport et quand tu reviens vendredi,on continuera

loloetseb · Answer

Bon a priori,tu as vraiment la totale,surtout ne fait plus rien de confidentiel sur ton ordinateur (compte bancaire,paiement paypal ou autres),je te conseillerais a la fin de la desinfection de changer tous tes mots de passe

loloetseb · Answer

Oui tu as des logiciels espions sur ton ordinateur qui peuvent permettre d'acceder aux informations personnelles contenues dans celui ci.Mais bon,on est tous passé par la,pas trop d'inquietude a avoir quand meme!!!!!

loloetseb · Answer

Bon on reprendra,quand tu reviens vendredi,je vais aller me coucher la.Refais moi signe quand tu reviens,on recherchera le rapport car il doit etre quelque part.

loloetseb · Answer

Il faudra finir la desinfection car ce n'est pas fini!!!

aurelie_vs · Answer

Hello ! Finalement je n'étais pas revenue plus tôt... est-ce que tu es toujours disposé à m'aider ? J'ai le "scan report" de bitdefender online :) Par contre, je trouve bizarre que ça ne mette plus comme la dernière fois genre "infecté par machinchose"

Je le poste ici si jamais tu es toujours ok ;)

Statistics

Time
	

02:31:14

Files
	

736892

Folders
	

14560

Boot Sectors
	

0

Archives
	

13469

Packed Files
	

19637
	

 
	

 

Results

Identified Viruses
	

1

Infected Files
	

2

Suspect Files
	

0

Warnings
	

0

Disinfected
	

0

Deleted Files
	

2
	

 
	

 

Engines Info

Virus Definitions
	

2638960

Engine build
	

AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14)

Scan plugins
	

17

Archive plugins
	

45

Unpack plugins
	

7

E-mail plugins
	

6

System plugins
	

4
	

 
	

 

Scan Settings

First Action
	

Disinfect

Second Action
	

Delete

Heuristics
	

Yes

Enable Warnings
	

Yes

Scanned Extensions
	

*;

Exclude Extensions
	

 

Scan Emails
	

Yes

Scan Archives
	

Yes

Scan Packed
	

Yes

Scan Files
	

Yes

Scan Boot
	

Yes
	

 
	

 
 

Scanned File
	

 Status

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP360\A0063030.exe=>(NSIS o)=>lzma_nsis0131
	

Detected with: Application.Irc.Flood.Tool.E

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP360\A0063030.exe=>(NSIS o)=>lzma_nsis0131
	

Disinfection failed

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP360\A0063030.exe=>(NSIS o)=>lzma_nsis0131
	

Deleted

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP360\A0063030.exe=>(NSIS o)
	

Update failed

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP403\A0067777.dll
	

Detected with: Application.Irc.Flood.Tool.E

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP403\A0067777.dll
	

Disinfection failed

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP403\A0067777.dll
	

Deleted

loloetseb · Answer

Supprimes ce que tu as en quarantaine dans ton antivirus et dans malwarebytes,ensuite Telecharge GENPROC Ouvre ce lien d'aide < < http://www.alt-shift-return.org/Info/GenProc-HowTo.html > , et le téléchargement est dedans < http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip > repond oui à la question à la fin et poste le rapport stp

aurelie_vs · Answer

voilà le lop 
   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) D CPU 3.20GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A03
   USER : Administrateur ( Administrator )
   BOOT : Fail-safe boot
   Antivirus : AVG Anti-Virus Free 8.0 (Activated)
   C:\ (Local Disk) - NTFS - Total:229 Go (Free:149 Go)
   D:\ (CD or DVD) - UDF - Total:3 Go (Free:0 Go)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 07/02/2009|12:43 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\stephane\APPLIC~1\Bitdownload
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [26/04/2006|05:43] C:\DOCUME~1\ADMINI~1\APPLIC~1\Corel
   [20/08/2004|10:41] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [07/08/2008|12:36] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
   [26/04/2006|05:37] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [26/04/2006|05:32] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun

   [25/01/2009|16:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [15/11/2008|17:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\America's Army Deploy Client
   [06/05/2006|10:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [03/02/2009|21:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8
   [07/05/2006|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY
   [17/05/2008|18:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BufferZone
   [17/01/2009|20:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
   [09/02/2008|19:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
   [08/08/2008|20:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonIJPLM
   [26/04/2006|05:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative Labs
   [01/06/2007|14:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FREEDB
   [23/05/2007|20:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [06/02/2009|17:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [04/06/2006|09:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HotSync
   [26/04/2006|05:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [13/09/2008|08:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
   [24/12/2006|19:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MAGIX
   [14/01/2009|11:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [26/04/2006|05:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
   [12/05/2006|20:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
   [11/05/2006|19:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com Personal Firewall
   [24/11/2006|20:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [07/10/2007|18:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [04/11/2007|23:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\pixelStorm
   [25/04/2007|17:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Samsung
   [20/08/2004|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [09/02/2008|19:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ScanSoft
   [18/10/2008|18:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [26/04/2006|05:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
   [30/08/2006|19:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation
   [17/01/2009|20:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
   [18/12/2008|22:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
   [09/04/2007|11:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [12/09/2006|21:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
   [03/05/2006|19:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
   [31/05/2006|11:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [28/02/2008|22:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [12/08/2006|15:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
   [18/01/2009|15:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

   [26/04/2006|05:43] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Corel
   [20/08/2004|10:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [07/08/2008|12:36] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
   [26/04/2006|05:37] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [26/04/2006|05:32] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun

   [04/05/2006|08:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
   [03/05/2006|20:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\McAfee.com Personal Firewall
   [05/03/2007|20:19] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [11/07/2007|08:50] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [24/07/2008|19:04] C:\DOCUME~1\stephane\APPLIC~1\.Kanton VS
   [01/03/2008|13:24] C:\DOCUME~1\stephane\APPLIC~1\Adobe
   [28/04/2007|19:46] C:\DOCUME~1\stephane\APPLIC~1\AdobeUM
   [20/10/2006|13:13] C:\DOCUME~1\stephane\APPLIC~1\Ahead
   [06/05/2006|10:55] C:\DOCUME~1\stephane\APPLIC~1\Apple Computer
   [04/06/2006|13:41] C:\DOCUME~1\stephane\APPLIC~1\Arcsoft
   [07/10/2007|10:06] C:\DOCUME~1\stephane\APPLIC~1\Azureus
   [04/11/2008|19:27] C:\DOCUME~1\stephane\APPLIC~1\Canon
   [19/07/2007|21:04] C:\DOCUME~1\stephane\APPLIC~1\ConvertTemp
   [26/04/2006|05:43] C:\DOCUME~1\stephane\APPLIC~1\Corel
   [12/05/2006|09:55] C:\DOCUME~1\stephane\APPLIC~1\Corel Photo Album
   [18/12/2006|12:04] C:\DOCUME~1\stephane\APPLIC~1\Creative
   [15/07/2008|07:57] C:\DOCUME~1\stephane\APPLIC~1\DivX
   [17/07/2007|18:39] C:\DOCUME~1\stephane\APPLIC~1\Dynamique
   [22/07/2006|11:37] C:\DOCUME~1\stephane\APPLIC~1\EPSON
   [01/02/2008|15:42] C:\DOCUME~1\stephane\APPLIC~1\GetRightToGo
   [03/03/2008|14:45] C:\DOCUME~1\stephane\APPLIC~1\GNU Solfege
   [11/04/2007|13:33] C:\DOCUME~1\stephane\APPLIC~1\Google
   [22/03/2008|18:48] C:\DOCUME~1\stephane\APPLIC~1\gtk-2.0
   [12/05/2006|20:51] C:\DOCUME~1\stephane\APPLIC~1\Help
   [04/06/2006|09:31] C:\DOCUME~1\stephane\APPLIC~1\HotSync
   [14/06/2008|17:25] C:\DOCUME~1\stephane\APPLIC~1\Identities
   [24/09/2007|15:41] C:\DOCUME~1\stephane\APPLIC~1\InstallShield
   [27/08/2007|19:56] C:\DOCUME~1\stephane\APPLIC~1\KVIrc
   [29/03/2008|21:15] C:\DOCUME~1\stephane\APPLIC~1\Lavasoft
   [04/06/2006|09:36] C:\DOCUME~1\stephane\APPLIC~1\Leadertech
   [16/11/2007|20:24] C:\DOCUME~1\stephane\APPLIC~1\LimeWire
   [20/10/2006|15:14] C:\DOCUME~1\stephane\APPLIC~1\Macromedia
   [26/12/2006|00:00] C:\DOCUME~1\stephane\APPLIC~1\MAGIX
   [14/01/2009|11:08] C:\DOCUME~1\stephane\APPLIC~1\Malwarebytes
   [03/05/2006|19:13] C:\DOCUME~1\stephane\APPLIC~1\McAfee.com Personal Firewall
   [21/01/2008|21:25] C:\DOCUME~1\stephane\APPLIC~1\Micro Application
   [07/06/2008|20:02] C:\DOCUME~1\stephane\APPLIC~1\Microsoft
   [17/11/2007|17:43] C:\DOCUME~1\stephane\APPLIC~1\Mobipocket
   [20/12/2006|20:05] C:\DOCUME~1\stephane\APPLIC~1\Mobipocket Reader
   [17/06/2008|19:15] C:\DOCUME~1\stephane\APPLIC~1\Mozilla
   [08/05/2006|18:45] C:\DOCUME~1\stephane\APPLIC~1\MSNInstaller
   [30/07/2007|19:04] C:\DOCUME~1\stephane\APPLIC~1\Netscape
   [04/06/2006|15:32] C:\DOCUME~1\stephane\APPLIC~1\OLYMPUS
   [13/10/2008|19:27] C:\DOCUME~1\stephane\APPLIC~1\OpenOffice.org
   [06/10/2008|17:01] C:\DOCUME~1\stephane\APPLIC~1\OpenOffice.org2
   [30/07/2007|18:32] C:\DOCUME~1\stephane\APPLIC~1\Opera
   [05/05/2006|20:09] C:\DOCUME~1\stephane\APPLIC~1\Real
   [05/09/2006|18:56] C:\DOCUME~1\stephane\APPLIC~1\Samsung
   [09/02/2008|19:57] C:\DOCUME~1\stephane\APPLIC~1\ScanSoft
   [18/04/2007|08:38] C:\DOCUME~1\stephane\APPLIC~1\Screenshot Sender
   [12/01/2009|20:32] C:\DOCUME~1\stephane\APPLIC~1\Scribus
   [16/10/2007|19:10] C:\DOCUME~1\stephane\APPLIC~1\SecuROM
   [17/07/2007|18:39] C:\DOCUME~1\stephane\APPLIC~1\Sites pr‚d‚finis
   [18/12/2008|17:39] C:\DOCUME~1\stephane\APPLIC~1\Skype
   [18/12/2008|12:40] C:\DOCUME~1\stephane\APPLIC~1\skypePM
   [20/08/2006|13:05] C:\DOCUME~1\stephane\APPLIC~1\Sonic
   [03/09/2006|21:38] C:\DOCUME~1\stephane\APPLIC~1\Sony Corporation
   [28/04/2007|19:03] C:\DOCUME~1\stephane\APPLIC~1\Sony Ericsson
   [23/10/2008|20:36] C:\DOCUME~1\stephane\APPLIC~1\SopCast
   [26/04/2006|05:32] C:\DOCUME~1\stephane\APPLIC~1\Sun
   [03/05/2006|18:57] C:\DOCUME~1\stephane\APPLIC~1\Talkback
   [30/10/2008|21:12] C:\DOCUME~1\stephane\APPLIC~1	eamspeak2
   [28/04/2007|19:05] C:\DOCUME~1\stephane\APPLIC~1\Teleca
   [01/06/2008|20:35] C:\DOCUME~1\stephane\APPLIC~1	emp
   [11/06/2006|16:09] C:\DOCUME~1\stephane\APPLIC~1\Template
   [19/07/2007|18:42] C:\DOCUME~1\stephane\APPLIC~1\Temporary
   [03/05/2006|18:57] C:\DOCUME~1\stephane\APPLIC~1\Thunderbird
   [19/07/2007|21:23] C:\DOCUME~1\stephane\APPLIC~1\TransRender
   [02/02/2009|19:41] C:\DOCUME~1\stephane\APPLIC~1\U3
   [15/08/2008|13:51] C:\DOCUME~1\stephane\APPLIC~1\ubi.com
   [05/09/2008|19:10] C:\DOCUME~1\stephane\APPLIC~1\uTorrent
   [31/08/2007|20:32] C:\DOCUME~1\stephane\APPLIC~1\vlc
   [26/06/2006|19:28] C:\DOCUME~1\stephane\APPLIC~1\Xfire
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [07/02/2009 12:20][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachine.job
   [07/02/2009 12:20][--a------] C:\WINDOWS	asks\Google Software Updater.job
   [18/01/2009 12:00][--a------] C:\WINDOWS	asks\Schedule Task Weekly.job
   [07/02/2009 12:36][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 12:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [03/03/2007|20:05] C:\Program Files\3000AD
   [25/01/2009|16:45] C:\Program Files\Adobe
   [07/10/2007|10:01] C:\Program Files\Alex Feinman
   [13/01/2009|13:07] C:\Program Files\AmazingMIDI
   [15/11/2008|18:01] C:\Program Files\America's Army
   [20/12/2008|20:23] C:\Program Files\America's Army Deploy Client
   [15/11/2008|18:02] C:\Program Files\America's Army Server Manager
   [26/04/2006|05:36] C:\Program Files\ATI Technologies
   [17/01/2009|20:32] C:\Program Files\Avanquest update
   [07/06/2008|20:04] C:\Program Files\AVG
   [07/10/2007|10:11] C:\Program Files\AVSMedia
   [28/09/2007|19:33] C:\Program Files\Azureus
   [11/10/2007|08:18] C:\Program Files\BitComet
   [19/05/2007|09:43] C:\Program Files\Blender Foundation
   [01/02/2008|18:21] C:\Program Files\Boonty
   [01/02/2008|18:21] C:\Program Files\BoontyGames
   [09/02/2008|19:59] C:\Program Files\Canon
   [09/02/2008|19:51] C:\Program Files\CanonBJ
   [07/02/2009|12:32] C:\Program Files\CCleaner
   [20/10/2006|12:36] C:\Program Files\CDex_150
   [18/01/2009|14:11] C:\Program Files\Celestia
   [18/06/2006|09:43] C:\Program Files\Company Ericsson
   [20/08/2004|10:35] C:\Program Files\ComPlus Applications
   [26/04/2006|05:42] C:\Program Files\Corel
   [26/04/2006|05:42] C:\Program Files\Corel Corporation
   [18/01/2009|16:26] C:\Program Files\Couscous Script version1.0
   [26/04/2006|05:39] C:\Program Files\Creative
   [26/04/2006|05:36] C:\Program Files\Dell
   [16/10/2007|18:37] C:\Program Files\directx
   [28/04/2007|19:27] C:\Program Files\Disc2Phone
   [26/10/2008|16:29] C:\Program Files\DivX
   [21/07/2008|10:22] C:\Program Files\D-Tools
   [21/07/2008|09:57] C:\Program Files\EA GAMES
   [13/01/2009|13:08] C:\Program Files\EA SPORTS
   [16/10/2007|18:58] C:\Program Files\Electronic Arts
   [05/02/2009|20:45] C:\Program Files\eMule
   [03/05/2006|19:21] C:\Program Files\epson
   [03/12/2008|07:56] C:\Program Files\Fichiers communs
   [13/01/2009|13:15] C:\Program Files\Free Audio Pack
   [10/07/2008|20:14] C:\Program Files\FreeMind
   [04/11/2007|13:34] C:\Program Files\Galactica
   [01/10/2006|20:09] C:\Program Files\GameShadow
   [30/08/2008|12:19] C:\Program Files\GameSpy Arcade
   [18/10/2007|18:49] C:\Program Files\GEOGRAPHIE
   [01/10/2006|12:45] C:\Program Files\GetRight
   [05/03/2008|20:59] C:\Program Files\GIMP-2.0
   [22/05/2007|21:15] C:\Program Files\GooDelete
   [04/02/2009|21:24] C:\Program Files\Google
   [03/02/2009|20:15] C:\Program Files\Grisoft
   [19/11/2007|10:56] C:\Program Files\HT Ratings
   [18/01/2009|14:17] C:\Program Files\InstallShield Installation Information
   [26/04/2006|05:36] C:\Program Files\Intel
   [26/04/2006|05:37] C:\Program Files\InterActual
   [10/12/2008|16:36] C:\Program Files\Internet Explorer
   [06/05/2006|10:54] C:\Program Files\iPod
   [17/11/2007|11:30] C:\Program Files\IRCSoues
   [06/05/2006|10:55] C:\Program Files\iTunes
   [01/01/2009|16:12] C:\Program Files\Java
   [13/10/2008|19:25] C:\Program Files\JRE
   [17/10/2007|16:38] C:\Program Files\KeyText
   [13/09/2008|08:48] C:\Program Files\Lavasoft
   [17/10/2007|17:02] C:\Program Files\Liberty Script T
   [25/10/2008|17:03] C:\Program Files\Logitech
   [25/03/2008|12:34] C:\Program Files\Lyrics Power
   [14/01/2009|11:08] C:\Program Files\Malwarebytes' Anti-Malware
   [23/03/2008|00:57] C:\Program Files\Maxis
   [15/03/2008|19:22] C:\Program Files\MC2
   [26/04/2006|05:45] C:\Program Files\McAfee
   [21/09/2008|17:00] C:\Program Files\Messenger
   [26/12/2008|20:08] C:\Program Files\Messenger Plus! Live
   [10/02/2008|21:14] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [20/08/2004|10:37] C:\Program Files\microsoft frontpage
   [05/06/2007|07:32] C:\Program Files\Microsoft FrontPage Express
   [26/04/2006|05:41] C:\Program Files\Microsoft Works
   [28/10/2007|17:40] C:\Program Files\mIRC
   [17/11/2007|17:18] C:\Program Files\Mobipocket.com
   [20/09/2008|20:09] C:\Program Files\Movie Maker
   [07/02/2009|12:34] C:\Program Files\Mozilla Firefox
   [05/02/2009|20:50] C:\Program Files\Mozilla Thunderbird
   [03/12/2008|18:40] C:\Program Files\mozilla.org
   [18/04/2007|12:08] C:\Program Files\MP3 Player Utilities 4.05
   [03/01/2009|18:45] C:\Program Files\MSECache
   [04/05/2006|09:22] C:\Program Files\MSN
   [20/08/2004|10:34] C:\Program Files\MSN Gaming Zone
   [15/11/2006|12:00] C:\Program Files\MSXML 4.0
   [21/01/2008|21:20] C:\Program Files\MSXML 6.0
   [20/10/2006|13:10] C:\Program Files\Nero
   [20/09/2008|20:07] C:\Program Files\NetMeeting
   [31/07/2007|09:54] C:\Program Files\Netscape
   [10/11/2007|21:09] C:\Program Files\NFO viewer
   [04/06/2006|15:31] C:\Program Files\OLYMPUS
   [20/08/2004|10:34] C:\Program Files\Online Services
   [09/09/2007|18:59] C:\Program Files\OpenOffice.org 2.0
   [08/03/2008|20:14] C:\Program Files\OpenOffice.org 2.2
   [05/04/2008|19:23] C:\Program Files\OpenOffice.org 2.3
   [13/10/2008|19:24] C:\Program Files\OpenOffice.org 2.4
   [13/10/2008|19:25] C:\Program Files\OpenOffice.org 3
   [06/09/2008|14:53] C:\Program Files\Opera
   [20/09/2008|20:07] C:\Program Files\Outlook Express
   [05/11/2007|19:16] C:\Program Files\palmOne
   [24/09/2007|15:42] C:\Program Files\Philips
   [13/01/2008|15:30] C:\Program Files\Photo Story 3 for Windows
   [28/09/2008|11:58] C:\Program Files\Picasa2
   [31/07/2006|09:24] C:\Program Files\PIXELA
   [12/09/2006|23:06] C:\Program Files\PopCap Games
   [06/05/2006|10:55] C:\Program Files\QuickTime
   [05/05/2006|20:07] C:\Program Files\Real
   [26/04/2006|05:43] C:\Program Files\Roxio
   [25/04/2007|09:15] C:\Program Files\Samsung
   [09/02/2008|19:57] C:\Program Files\ScanSoft
   [12/01/2009|20:03] C:\Program Files\Scribus 1.3.4
   [17/05/2008|18:22] C:\Program Files\Secured eMule
   [17/05/2008|18:21] C:\Program Files\Secured_eMule
   [25/12/2008|11:37] C:\Program Files\SEGA
   [18/04/2007|09:34] C:\Program Files\Services en ligne
   [11/11/2007|10:13] C:\Program Files\Sierra
   [26/04/2006|05:34] C:\Program Files\Sigmatel
   [21/10/2007|16:44] C:\Program Files\SimpleOCR
   [18/10/2008|18:06] C:\Program Files\Skype
   [26/04/2006|05:44] C:\Program Files\Sonic
   [17/01/2009|21:11] C:\Program Files\Sony
   [31/07/2006|09:23] C:\Program Files\Sony Corporation
   [17/01/2009|21:11] C:\Program Files\Sony Ericsson
   [06/02/2008|21:34] C:\Program Files\SopCast
   [28/02/2007|19:49] C:\Program Files\SPM
   [04/11/2007|11:35] C:\Program Files\SSI
   [18/11/2007|15:34] C:\Program Files\StreamerOne
   [18/12/2008|22:09] C:\Program Files\SweetIM
   [30/10/2008|21:12] C:\Program Files\Teamspeak2_RC2
   [01/02/2008|18:22] C:\Program Files\T‚l‚chargeur de Piano facile
   [09/04/2008|20:47] C:\Program Files\TVAnts
   [11/05/2008|11:33] C:\Program Files\TVUPlayer
   [15/08/2008|13:42] C:\Program Files\Ubi Soft
   [15/08/2008|13:52] C:\Program Files\ubi.com
   [15/05/2006|11:37] C:\Program Files\Ubisoft
   [05/09/2006|19:22] C:\Program Files\Uninstall Information
   [17/02/2008|14:49] C:\Program Files\uTorrent
   [18/02/2007|16:29] C:\Program Files\Vegastrike
   [31/08/2007|20:30] C:\Program Files\VideoLAN
   [25/08/2007|18:20] C:\Program Files\ViRC
   [30/03/2007|19:58] C:\Program Files\Virtools
   [16/10/2007|18:46] C:\Program Files\Visicom Media
   [26/07/2006|17:00] C:\Program Files\VSTax 2005
   [29/07/2007|15:40] C:\Program Files\VSTax 2006
   [24/07/2008|19:03] C:\Program Files\VSTax 2007
   [30/08/2008|12:13] C:\Program Files\Wanadoo Edition
   [21/12/2008|17:43] C:\Program Files\Winamp
   [03/03/2007|15:58] C:\Program Files\Windows Journal Viewer
   [28/02/2008|22:01] C:\Program Files\Windows Live
   [08/12/2006|13:18] C:\Program Files\Windows Media Connect 2
   [20/09/2008|20:07] C:\Program Files\Windows Media Player
   [20/09/2008|20:07] C:\Program Files\Windows NT
   [20/08/2004|10:35] C:\Program Files\WindowsUpdate
   [15/08/2006|17:02] C:\Program Files\WinRAR
   [11/09/2006|14:49] C:\Program Files\WinZip
   [12/06/2007|19:56] C:\Program Files\Woonoz
   [20/08/2004|10:37] C:\Program Files\xerox
   [26/06/2006|19:28] C:\Program Files\Xfire
   [07/09/2007|17:30] C:\Program Files\Yahoo!
   [16/10/2007|18:49] C:\Program Files\Yume Online
   [10/10/2008|18:47] C:\Program Files\Zattoo
   [28/04/2007|19:24] C:\Program Files\Zero G Registry
   [23/04/2007|19:24] C:\Program Files\Zuma Deluxe
   [18/01/2009|14:10] C:\Program Files\Zylom Games

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [25/01/2009|16:45] C:\Program Files\Fichiers communs\Adobe
   [22/03/2007|21:32] C:\Program Files\Fichiers communs\Ahead
   [07/10/2007|10:11] C:\Program Files\Fichiers communs\AVSMedia
   [07/05/2006|18:31] C:\Program Files\Fichiers communs\BOONTY Shared
   [09/02/2008|19:55] C:\Program Files\Fichiers communs\CANON
   [07/12/2006|11:49] C:\Program Files\Fichiers communs\click2learn
   [26/04/2006|05:42] C:\Program Files\Fichiers communs\Corel
   [26/04/2006|05:37] C:\Program Files\Fichiers communs\Creative Labs Shared
   [26/04/2006|05:45] C:\Program Files\Fichiers communs\InstallShield
   [26/04/2006|05:32] C:\Program Files\Fichiers communs\Java
   [25/10/2008|17:03] C:\Program Files\Fichiers communs\Logitech
   [24/12/2006|19:06] C:\Program Files\Fichiers communs\MAGIX Shared
   [03/01/2009|18:57] C:\Program Files\Fichiers communs\Microsoft Shared
   [13/12/2006|20:55] C:\Program Files\Fichiers communs\Mobipocket Shared
   [20/08/2004|10:35] C:\Program Files\Fichiers communs\MSSoap
   [20/08/2004|10:30] C:\Program Files\Fichiers communs\ODBC
   [15/08/2008|13:49] C:\Program Files\Fichiers communs\PocketSoft
   [23/10/2008|21:12] C:\Program Files\Fichiers communs\Real
   [26/04/2006|05:37] C:\Program Files\Fichiers communs\Roxio Shared
   [09/02/2008|19:57] C:\Program Files\Fichiers communs\ScanSoft Shared
   [20/08/2004|10:35] C:\Program Files\Fichiers communs\Services
   [18/10/2008|18:06] C:\Program Files\Fichiers communs\Skype
   [11/08/2007|23:04] C:\Program Files\Fichiers communs\Sonic Shared
   [30/08/2006|19:44] C:\Program Files\Fichiers communs\Sony Shared
   [20/08/2004|10:30] C:\Program Files\Fichiers communs\SpeechEngines
   [12/07/2007|14:31] C:\Program Files\Fichiers communs\Symantec Shared
   [20/09/2008|20:07] C:\Program Files\Fichiers communs\System
   [09/03/2008|10:19] C:\Program Files\Fichiers communs\Teleca Shared
   [26/04/2006|05:43] C:\Program Files\Fichiers communs\TiVo Shared
   [28/02/2008|22:01] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [13/09/2008|08:47] C:\Program Files\Fichiers communs\Wise Installation Wizard
   [23/10/2008|21:12] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 16 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-02-07 12:44:49
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:1][D:0]-> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
   [F:2][D:0]-> C:\DOCUME~1\ADMINI~1\Cookies
   [F:3][D:1]-> C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 07/02/2009|12:45 - Option : [2]

   --------------------\  Fin du rapport a 12:45:27


voilà le tb


   -----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) D CPU 3.20GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A03
   USER : Administrateur ( Administrator )
   BOOT : Fail-safe boot
   Antivirus : AVG Anti-Virus Free 8.0 (Activated)
   C:\ (Local Disk) - NTFS - Total:229 Go (Free:149 Go)
   D:\ (CD or DVD) - UDF - Total:3 Go (Free:0 Go)
   E:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 07/02/2009|12:40 )

   -----------\ SUPPRESSION

   Supprime! - C:\DOCUME~1\stephane\APPLIC~1\WeatherDPA\Weather
   Supprime! - C:\DOCUME~1\stephane\APPLIC~1\Zango\IESkins
   Supprime! - C:\DOCUME~1\stephane\APPLIC~1\Zango\v3.0
   Supprime! - C:\DOCUME~1\stephane\APPLIC~1\WeatherDPA
   Supprime! - C:\DOCUME~1\stephane\APPLIC~1\Zango

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (stephane) - {0b38152b-1b20-484d-a11f-5e04a9b0661f} => winamptoolbar
   (stephane) - {0b38152b-1b20-484d-a11f-5e04a9b0661f} => winamptoolbar
   (stephane) - {EEE6C361-6118-11DC-9C72-001320C79847} => sweetim-toolbar
   (stephane) - {0b38152b-1b20-484d-a11f-5e04a9b0661f} => winamptoolbar
   (stephane) - {EEE6C361-6118-11DC-9C72-001320C79847} => sweetim-toolbar
   (stephane) - {125aa783-ef4f-4515-a804-aa67116fdb43} => chatzilla-fr-FR
   (stephane) - {59c81df5-4b7a-477b-912d-4e0fdf64e5f2} => chatzilla
   (stephane) - {0b38152b-1b20-484d-a11f-5e04a9b0661f} => winamptoolbar
   (stephane) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
   (stephane) - {59c81df5-4b7a-477b-912d-4e0fdf64e5f2} => chatzilla


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"
   "Home_Page"="https://www.dell.com/fr-ch?c=ch&l=fr&s=gen&redirect=1"
   "Help_Page"="http://support.euro.dell.com/segment.asp?country=ch&language=fr"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 07/02/2009|12:42 - Option : [2]

   -----------\  Fin du rapport a 12:42:13.60

voilà le hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:00:27, on 07.02.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Profiler\lwemon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\palmOne\LifeDriveMgrTray.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\palmOne\PalmOneLiveConnect.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\stephane\Bureau\HiJackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ikzgffl.exe,
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule	bSecu.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule	bSecu.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [Gnetmous] C:\Program Files\Samsung\Samsung Optical Middle Mouse\gnetmous.exe
O4 - HKLM\..\Run: [Flash Media] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [BVRPLiveUpdate] C:\Program Files\Avanquest update\Engine\Setup.exe -s /PATCH,/SRCUPDATEC:\DOCUME~1\ALLUSE~1\APPLIC~1\SONYER~1\SONYER~1\LIVEUP~1\LISTOF~1.DAT
O4 - HKLM\..\Run: [ZangoSA] "C:\Program Files\Zango\bin\10.3.75.0\ZangoSA.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: HotSync Manager.LNK = C:\Program Files\palmOne\Hotsync.exe
O4 - Startup: LifeDrive™ Manager.lnk = C:\Program Files\palmOne\LifeDriveMgrTray.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOneegister.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: Image Transfer.lnk = ?
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Update Service (gupdate1c986fc1b8d770a) (gupdate1c986fc1b8d770a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe

loloetseb · Answer

Tu es encore infecté par sweetim et boonty,fais ceci et poste moi le rapport

Télécharge de AD-Remover de Cyrildu17 / C_XX) sur ton Bureau. 

http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe 

/!\ Déconnecte-toi et ferme toutes applications en cours /!\ 

- Double-clique sur le programme d'installation, installe-le dans son emplacement par défaut (C:\Program files). 
- Double-clique sur l'icône Ad-remover située sur ton Bureau. 
- Au menu principal, choisis l'option "A". 
- Poste le rapport qui apparaît à la fin. 

(Le rapport est sauvegardé aussi sous C:\Ad-report(date).log) 

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller) 

Note : 

"Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

aurelie_vs · Answer

Je te remercie mais je sais copier/coller quand même ;) 

------- LOGFILE OF AD-REMOVER 1.1.1.2 | ONLY XP/VISTA -------

Updated by C_XX on 14/02/2009 at 13:40

Start at: 14:59:12 | Sam 14.02.2009 | Boot mode: Normal Boot
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™  Service Pack 3 (version 5.1.2600)
Computer Name: UNKNOWN
Current User: stephane - Administrator
Drive(s): 
- C:\  (File System: NTFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 58

+--------------------| Boonty/Boonty Games Elements Found:

Service: Boonty Games
.
HKLM\Software\Boonty
HKLM\System\ControlSet001\Services\Boonty Games
HKLM\System\CurrentControlSet\Services\Boonty Games
HKLM\System\ControlSet003\Services\Boonty Games
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Piano facile_tdm_is1
.
C:\Program Files\Boonty
C:\Program Files\Boonty\Components
C:\Program Files\BoontyGames
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service
C:\Documents and Settings\All Users\Application Data\BOONTY
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses

+--------------------| Eorezo Elements Found:

.

+--------------------| Infected Poker Softwares Elements Found:

.

+--------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Found:

.
.

+--------------------| It's TV Elements Found:

.

+--------------------| Sweetim Elements Found:

HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\SWEETIE.IEToolbar
HKLM\Software\Classes\SWEETIE.IEToolbar.1
HKLM\Software\Classes\SWEETIE.SWEETIE
HKLM\Software\Classes\SWEETIE.SWEETIE.3
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKLM\Software\Classes\Toolbar3.SWEETIE
HKLM\Software\Classes\Toolbar3.SWEETIE.1
HKLM\Software\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\SweetIM
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
.
C:\WINDOWS\Installer\d1c4e5.msi
C:\Program Files\SweetIM
C:\Program Files\SweetIM\Toolbars
C:\Program Files\SweetIM\Toolbars\Internet Explorer
C:\Program Files\SweetIM\Toolbars\Internet Explorer\conf
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars\Internet Explorer
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars\Internet Explorer\cache
C:\Documents and Settings\stephane\Cookies\stephane@search.sweetim[1].txt
C:\Documents and Settings\stephane\Cookies\stephane@search.sweetim[3].txt

+--------------------| Added Scan:

---- Mozilla FireFox Version 3.0.6 ----

ProfilePath: 
.
.
.
.
.
.

---- Internet Explorer Version 7.0.5730.13 ----

+-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Search bar: hxxp://www.google.com/ie
Start page: hxxp://www.msn.com/

+-[HKEY_USERS\S-1-5-21-259890706-4045445440-1970084451-1006\..\Internet Explorer\Main]

Search bar: hxxp://www.google.com/ie
Start page: hxxp://www.msn.com/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start page: hxxp://www.msn.com/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

+---------------------------------------------------------------------------+

[~6768 Bytes] - "C:\Ad-Report-Scan-14.02.2009.log"
-

End at: 15:00:59 | 14.02.2009
.
+--------------------| E.O.F - 127 Lines
.

loloetseb · Answer

1/ Relances Ad remover,puis B,puis 1,puis 6,puis S et postes moi le rapport

2/Télécharge MalwareByte's :
http://www.malwarebytes.org/mbam.php  ou ici :
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

* Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : https://www.malekal.com/tutorial-aboutbuster/ )

* Potasse le tuto pour te familiariser avec le prg :
https://forum.pcastuces.com/sujet.asp?f=31&s=3
( cela dis, il est très simple d'utilisation ).

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

* Lance Malwarebyte's .

Fais un examen dit "Complet" .

--> Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
--> à la fin tu cliques sur "résultat" .
--> Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

Troyen Sheur2 et ses amis... qu'est-ce donc ?

35 réponses

Discussions similaires