Check up + pubs
Résolu
villardien
Messages postés
44
Date d'inscription
Statut
Membre
Dernière intervention
-
villardien Messages postés 44 Date d'inscription Statut Membre Dernière intervention -
villardien Messages postés 44 Date d'inscription Statut Membre Dernière intervention -
Bonjour,
je recherche de l'aide car je rencontre des petits soucis de pubs + des problemes des liens videos que des copains m'envoyé en e-mail et que je ne peux plus ouvrir maintenant .
je cherche a vous joindre un rapport hi jack this mais je ne sais pas sur quel bouton appuyer "do a system scan and save a logfile" ou "do a system scan only"
je suis sur un pc avec vista , internet exporer , macafee en antivirus .
meci pour votre aide tres precieuse
je recherche de l'aide car je rencontre des petits soucis de pubs + des problemes des liens videos que des copains m'envoyé en e-mail et que je ne peux plus ouvrir maintenant .
je cherche a vous joindre un rapport hi jack this mais je ne sais pas sur quel bouton appuyer "do a system scan and save a logfile" ou "do a system scan only"
je suis sur un pc avec vista , internet exporer , macafee en antivirus .
meci pour votre aide tres precieuse
A voir également:
- Check up + pubs
- Bloquer les pubs youtube - Accueil - Streaming
- Check disk - Guide
- Check flash - Télécharger - Sécurité
- Cd check - Télécharger - Récupération de données
- Supprimer les pubs - Guide
55 réponses
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
est ce que des fois , si je met sur mon disque dur externe ce que je veux conserver et que je lui met le dvd de sauvegarde que j'ai fait a la premiere ouverture de mon pc , cela pourrait arranger mes soucis ?
non pas sur car ton infection se retrouve surement dans les disques amovibles.
fait cela:
/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\
Ouvre le Bloc-Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Copie ce texte ( en gras )d'une traite ( CTRL+C pour copier ) puis colle-le ( CTRL+V dans le bloc-note )
Kill all::
File:
E:\Autorun.exe
G:\Autorun.exe
F:\autorun.exe
Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{256e4c05-1163-11dc-be57-806e6f6e6963}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{327dfd7f-679a-11dd-b00c-001b24205758}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77c7f586-d71c-11dd-a24c-001b24257b3a}]
Sauvegarde ce fichier sur ton bureau sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
fait cela:
/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\
Ouvre le Bloc-Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Copie ce texte ( en gras )d'une traite ( CTRL+C pour copier ) puis colle-le ( CTRL+V dans le bloc-note )
Kill all::
File:
E:\Autorun.exe
G:\Autorun.exe
F:\autorun.exe
Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{256e4c05-1163-11dc-be57-806e6f6e6963}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{327dfd7f-679a-11dd-b00c-001b24205758}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77c7f586-d71c-11dd-a24c-001b24257b3a}]
Sauvegarde ce fichier sur ton bureau sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
bonjour , combofix a l'air d'avoir bien marché , il ne m'a jamais demandé type 1 ou type 2 il ne s'est pas relancé .
par contre voici le rapport . rapport hijackthis a suivre .
ComboFix 09-02-27.02 - sebastien et sonia 2009-02-28 10:06:04.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1982.1320 [GMT 1:00]
Lancé depuis: c:\users\sebastien et sonia\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\sebastien et sonia\Desktop\CFScript.txt
* Un nouveau point de restauration a été créé
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-28 au 2009-02-28 ))))))))))))))))))))))))))))))))))))
.
2009-02-22 11:35 . 2009-02-22 11:35 <REP> d-------- c:\users\All Users\Rumbic Studio
2009-02-22 11:35 . 2009-02-22 11:35 <REP> d-------- c:\programdata\Rumbic Studio
2009-02-20 22:07 . 2009-02-20 22:07 <REP> d-------- c:\program files\Power IE
2009-02-15 01:19 . 2008-12-05 05:32 428,544 --a------ c:\windows\System32\EncDec.dll
2009-02-15 01:19 . 2008-12-05 05:32 293,376 --a------ c:\windows\System32\psisdecd.dll
2009-02-15 01:19 . 2008-12-05 05:31 217,088 --a------ c:\windows\System32\psisrndr.ax
2009-02-15 01:19 . 2008-12-05 05:31 177,664 --a------ c:\windows\System32\mpg2splt.ax
2009-02-15 01:19 . 2008-12-05 05:31 80,896 --a------ c:\windows\System32\MSNP.ax
2009-02-12 05:48 . 2009-01-15 04:36 1,383,424 --a------ c:\windows\System32\mshtml.tlb
2009-02-12 05:48 . 2009-01-15 07:11 827,392 --a------ c:\windows\System32\wininet.dll
2009-02-10 19:42 . 2009-02-15 19:12 <REP> d-------- c:\program files\Ad-remover
2009-02-09 17:25 . 2009-02-09 17:26 <REP> d-------- C:\rsit
2009-02-08 20:41 . 2009-02-08 20:41 <REP> d-------- c:\users\All Users\NortonInstaller
2009-02-08 20:41 . 2009-02-08 20:41 <REP> d-------- c:\programdata\NortonInstaller
2009-02-06 23:49 . 2009-02-15 19:13 <REP> d-------- c:\program files\Navilog1
2009-02-06 22:33 . 2009-02-06 22:33 <REP> d-------- c:\program files\Trend Micro
2009-01-31 20:38 . 2009-01-31 20:38 <REP> dr-h----- c:\users\sebastien et sonia\AppData\Roaming\SecuROM
2009-01-31 20:30 . 2009-01-31 20:30 <REP> dr-h----- c:\users\Administrateur\AppData\Roaming\SecuROM
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-28 08:56 136,020 ----a-w c:\users\All Users\nvModes.dat
2009-02-28 08:56 136,020 ----a-w c:\programdata\nvModes.dat
2009-02-26 20:28 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\ZoomBrowser EX
2009-02-26 04:47 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\Azureus
2009-02-24 13:32 --------- d---a-w c:\programdata\TEMP
2009-02-24 12:49 --------- d-----w c:\program files\Oberon Media
2009-02-14 09:39 --------- d-----w c:\program files\CCleaner
2009-02-13 02:00 --------- d-----w c:\program files\Windows Mail
2009-02-07 21:22 --------- d-----w c:\program files\TicketToRide
2009-02-07 20:19 --------- d-----w c:\program files\Common Files\LightScribe
2009-02-05 21:16 --------- d-----w c:\programdata\NVIDIA
2009-01-29 12:01 --------- d-----w c:\program files\Azureus
2009-01-25 20:51 --------- d-----w c:\program files\Google
2009-01-22 16:35 --------- d-----w c:\program files\DivX
2009-01-15 17:40 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\Flood Light Games
2009-01-15 17:40 --------- d-----w c:\programdata\Flood Light Games
2009-01-14 09:30 --------- d-----w c:\program files\GameSpy Arcade
2009-01-06 13:34 107,888 ----a-w c:\windows\System32\CmdLineExt.dll
2009-01-06 13:26 --------- d-----w c:\programdata\KONAMI
2009-01-06 13:06 --------- d-----w c:\program files\KONAMI
2009-01-03 15:40 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\vlc
2009-01-03 15:39 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\DMV Technologies
2009-01-03 15:33 --------- d-----w c:\program files\DMV
2009-01-01 00:28 --------- d-----w c:\program files\UBISOFT
2008-12-31 12:50 --------- d-----w c:\program files\Smart Projects
2008-12-31 09:26 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\DAEMON Tools Pro
2008-12-31 09:26 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\DAEMON Tools Lite
2008-12-31 09:26 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\DAEMON Tools
2008-12-31 09:25 --------- d-----w c:\programdata\DAEMON Tools Lite
2008-12-31 09:25 --------- d-----w c:\program files\DAEMON Tools Lite
2008-12-31 09:20 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-29 20:42 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\Zylom
2008-12-29 12:04 --------- d-----w c:\program files\CONEXANT
2008-12-29 07:56 --------- d-----w c:\program files\SystemRequirementsLab
2008-12-29 07:51 33,548 ----a-w c:\users\sebastien et sonia\AppData\Roaming\nvModes.dat
2008-12-11 00:33 86,016 ----a-w c:\windows\System32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\System32\dtu100.dll
2008-12-09 02:28 593,920 ----a-w c:\windows\System32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\System32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\System32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\System32\dpu11.dll
2008-10-31 20:04 174 --sha-w c:\program files\desktop.ini
2008-04-20 06:35 20,736 ----a-w c:\users\sebastien et sonia\AppData\Roaming\serial2.dat
2007-06-03 19:09 0 ----a-w c:\users\sebastien et sonia\AppData\Roaming\wklnhst.dat
2007-06-02 20:06 22 --sha-w c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-25 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ACQTMOUSE"="c:\program files\TOSHIBA\Tilt Mouse Software\1.0\ACQTMAPP.exe" [2007-04-11 489984]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-12-29 11:40 687560 c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
--a------ 2008-05-06 09:42 202088 c:\program files\TomTom HOME 2\HOMERunner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{4B456670-C2BC-4A0B-9D0D-31F15D146643}"= UDP:c:\program files\HP\QuickPlay\QP.exe:QP
"{DCC04CF4-9DD8-40B3-BF0D-24693127455C}"= TCP:c:\program files\HP\QuickPlay\QP.exe:QP
"{096C0807-EA58-4DDF-812E-81B2D6EB0BC2}"= UDP:c:\program files\Skype\Phone\Skype.exe:Skype
"{C2DAB23E-B134-4039-A4BE-6EA75DBAD14B}"= TCP:c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{55FCA1D9-7E55-4F03-B362-96496F57A399}c:\\program files\\webmediaplayer\\webmediaplayer.exe"= UDP:c:\program files\webmediaplayer\webmediaplayer.exe:WebMediaPlayer
"UDP Query User{423540E1-4FD0-4BFC-A558-45F0403886E0}c:\\program files\\webmediaplayer\\webmediaplayer.exe"= TCP:c:\program files\webmediaplayer\webmediaplayer.exe:WebMediaPlayer
"{EA3B8037-EF7F-4844-A386-4B7B047E16F6}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{3E047F4C-E2BE-444E-AF29-52908DD80E03}"= TCP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{CE120314-DA90-4BB3-B793-3860F5A29DA3}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{CF09D8EE-D703-4290-88DB-B6AFA2C25147}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{7F458B44-5371-4389-9056-62E83E897C80}"= UDP:c:\program files\Shareaza\Shareaza.exe:Shareaza
"{DFC54150-4805-4511-A998-C7A0A2C4EEA7}"= TCP:c:\program files\Shareaza\Shareaza.exe:Shareaza
"{AF588579-9737-4E06-B23F-5A68DD1CCAA5}"= UDP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"{F36B69BB-C4B4-4800-B80E-E22B0D9DD184}"= TCP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-11-01 206096]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b167c27-8f68-11dc-86c2-001b24205758}]
\shell\AutoRun\command - G:\InstallTomTomHOME.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{256e4c05-1163-11dc-be57-806e6f6e6963}]
\shell\AutoRun\command - E:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{327dfd7f-679a-11dd-b00c-001b24205758}]
\shell\AutoRun\command - G:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77c7f586-d71c-11dd-a24c-001b24257b3a}]
\shell\AutoRun\command - F:\autorun.exe
.
Contenu du dossier 'Tâches planifiées'
2009-02-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]
2008-12-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]
2009-02-27 c:\windows\Tasks\User_Feed_Synchronization-{E5EFA8B3-3740-4566-AE5B-AE368AE3D8E9}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://portail.free.fr/
uSearchURL,(Default) = hxxp://fr.search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-28 10:09:06
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'Explorer.exe'(1856)
c:\program files\McAfee\SiteAdvisor\saHook.dll
.
Heure de fin: 2009-02-28 10:11:18
ComboFix-quarantined-files.txt 2009-02-28 09:11:13
Avant-CF: 75 894 702 080 octets libres
Après-CF: 75,661,541,376 octets libres
181 --- E O F --- 2009-02-15 02:01:35
par contre voici le rapport . rapport hijackthis a suivre .
ComboFix 09-02-27.02 - sebastien et sonia 2009-02-28 10:06:04.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1982.1320 [GMT 1:00]
Lancé depuis: c:\users\sebastien et sonia\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\sebastien et sonia\Desktop\CFScript.txt
* Un nouveau point de restauration a été créé
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-28 au 2009-02-28 ))))))))))))))))))))))))))))))))))))
.
2009-02-22 11:35 . 2009-02-22 11:35 <REP> d-------- c:\users\All Users\Rumbic Studio
2009-02-22 11:35 . 2009-02-22 11:35 <REP> d-------- c:\programdata\Rumbic Studio
2009-02-20 22:07 . 2009-02-20 22:07 <REP> d-------- c:\program files\Power IE
2009-02-15 01:19 . 2008-12-05 05:32 428,544 --a------ c:\windows\System32\EncDec.dll
2009-02-15 01:19 . 2008-12-05 05:32 293,376 --a------ c:\windows\System32\psisdecd.dll
2009-02-15 01:19 . 2008-12-05 05:31 217,088 --a------ c:\windows\System32\psisrndr.ax
2009-02-15 01:19 . 2008-12-05 05:31 177,664 --a------ c:\windows\System32\mpg2splt.ax
2009-02-15 01:19 . 2008-12-05 05:31 80,896 --a------ c:\windows\System32\MSNP.ax
2009-02-12 05:48 . 2009-01-15 04:36 1,383,424 --a------ c:\windows\System32\mshtml.tlb
2009-02-12 05:48 . 2009-01-15 07:11 827,392 --a------ c:\windows\System32\wininet.dll
2009-02-10 19:42 . 2009-02-15 19:12 <REP> d-------- c:\program files\Ad-remover
2009-02-09 17:25 . 2009-02-09 17:26 <REP> d-------- C:\rsit
2009-02-08 20:41 . 2009-02-08 20:41 <REP> d-------- c:\users\All Users\NortonInstaller
2009-02-08 20:41 . 2009-02-08 20:41 <REP> d-------- c:\programdata\NortonInstaller
2009-02-06 23:49 . 2009-02-15 19:13 <REP> d-------- c:\program files\Navilog1
2009-02-06 22:33 . 2009-02-06 22:33 <REP> d-------- c:\program files\Trend Micro
2009-01-31 20:38 . 2009-01-31 20:38 <REP> dr-h----- c:\users\sebastien et sonia\AppData\Roaming\SecuROM
2009-01-31 20:30 . 2009-01-31 20:30 <REP> dr-h----- c:\users\Administrateur\AppData\Roaming\SecuROM
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-28 08:56 136,020 ----a-w c:\users\All Users\nvModes.dat
2009-02-28 08:56 136,020 ----a-w c:\programdata\nvModes.dat
2009-02-26 20:28 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\ZoomBrowser EX
2009-02-26 04:47 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\Azureus
2009-02-24 13:32 --------- d---a-w c:\programdata\TEMP
2009-02-24 12:49 --------- d-----w c:\program files\Oberon Media
2009-02-14 09:39 --------- d-----w c:\program files\CCleaner
2009-02-13 02:00 --------- d-----w c:\program files\Windows Mail
2009-02-07 21:22 --------- d-----w c:\program files\TicketToRide
2009-02-07 20:19 --------- d-----w c:\program files\Common Files\LightScribe
2009-02-05 21:16 --------- d-----w c:\programdata\NVIDIA
2009-01-29 12:01 --------- d-----w c:\program files\Azureus
2009-01-25 20:51 --------- d-----w c:\program files\Google
2009-01-22 16:35 --------- d-----w c:\program files\DivX
2009-01-15 17:40 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\Flood Light Games
2009-01-15 17:40 --------- d-----w c:\programdata\Flood Light Games
2009-01-14 09:30 --------- d-----w c:\program files\GameSpy Arcade
2009-01-06 13:34 107,888 ----a-w c:\windows\System32\CmdLineExt.dll
2009-01-06 13:26 --------- d-----w c:\programdata\KONAMI
2009-01-06 13:06 --------- d-----w c:\program files\KONAMI
2009-01-03 15:40 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\vlc
2009-01-03 15:39 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\DMV Technologies
2009-01-03 15:33 --------- d-----w c:\program files\DMV
2009-01-01 00:28 --------- d-----w c:\program files\UBISOFT
2008-12-31 12:50 --------- d-----w c:\program files\Smart Projects
2008-12-31 09:26 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\DAEMON Tools Pro
2008-12-31 09:26 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\DAEMON Tools Lite
2008-12-31 09:26 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\DAEMON Tools
2008-12-31 09:25 --------- d-----w c:\programdata\DAEMON Tools Lite
2008-12-31 09:25 --------- d-----w c:\program files\DAEMON Tools Lite
2008-12-31 09:20 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-29 20:42 --------- d-----w c:\users\sebastien et sonia\AppData\Roaming\Zylom
2008-12-29 12:04 --------- d-----w c:\program files\CONEXANT
2008-12-29 07:56 --------- d-----w c:\program files\SystemRequirementsLab
2008-12-29 07:51 33,548 ----a-w c:\users\sebastien et sonia\AppData\Roaming\nvModes.dat
2008-12-11 00:33 86,016 ----a-w c:\windows\System32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\System32\dtu100.dll
2008-12-09 02:28 593,920 ----a-w c:\windows\System32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\System32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\System32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\System32\dpu11.dll
2008-10-31 20:04 174 --sha-w c:\program files\desktop.ini
2008-04-20 06:35 20,736 ----a-w c:\users\sebastien et sonia\AppData\Roaming\serial2.dat
2007-06-03 19:09 0 ----a-w c:\users\sebastien et sonia\AppData\Roaming\wklnhst.dat
2007-06-02 20:06 22 --sha-w c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-25 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ACQTMOUSE"="c:\program files\TOSHIBA\Tilt Mouse Software\1.0\ACQTMAPP.exe" [2007-04-11 489984]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-12-29 11:40 687560 c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
--a------ 2008-05-06 09:42 202088 c:\program files\TomTom HOME 2\HOMERunner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{4B456670-C2BC-4A0B-9D0D-31F15D146643}"= UDP:c:\program files\HP\QuickPlay\QP.exe:QP
"{DCC04CF4-9DD8-40B3-BF0D-24693127455C}"= TCP:c:\program files\HP\QuickPlay\QP.exe:QP
"{096C0807-EA58-4DDF-812E-81B2D6EB0BC2}"= UDP:c:\program files\Skype\Phone\Skype.exe:Skype
"{C2DAB23E-B134-4039-A4BE-6EA75DBAD14B}"= TCP:c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{55FCA1D9-7E55-4F03-B362-96496F57A399}c:\\program files\\webmediaplayer\\webmediaplayer.exe"= UDP:c:\program files\webmediaplayer\webmediaplayer.exe:WebMediaPlayer
"UDP Query User{423540E1-4FD0-4BFC-A558-45F0403886E0}c:\\program files\\webmediaplayer\\webmediaplayer.exe"= TCP:c:\program files\webmediaplayer\webmediaplayer.exe:WebMediaPlayer
"{EA3B8037-EF7F-4844-A386-4B7B047E16F6}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{3E047F4C-E2BE-444E-AF29-52908DD80E03}"= TCP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{CE120314-DA90-4BB3-B793-3860F5A29DA3}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{CF09D8EE-D703-4290-88DB-B6AFA2C25147}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{7F458B44-5371-4389-9056-62E83E897C80}"= UDP:c:\program files\Shareaza\Shareaza.exe:Shareaza
"{DFC54150-4805-4511-A998-C7A0A2C4EEA7}"= TCP:c:\program files\Shareaza\Shareaza.exe:Shareaza
"{AF588579-9737-4E06-B23F-5A68DD1CCAA5}"= UDP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"{F36B69BB-C4B4-4800-B80E-E22B0D9DD184}"= TCP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-11-01 206096]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b167c27-8f68-11dc-86c2-001b24205758}]
\shell\AutoRun\command - G:\InstallTomTomHOME.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{256e4c05-1163-11dc-be57-806e6f6e6963}]
\shell\AutoRun\command - E:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{327dfd7f-679a-11dd-b00c-001b24205758}]
\shell\AutoRun\command - G:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77c7f586-d71c-11dd-a24c-001b24257b3a}]
\shell\AutoRun\command - F:\autorun.exe
.
Contenu du dossier 'Tâches planifiées'
2009-02-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]
2008-12-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]
2009-02-27 c:\windows\Tasks\User_Feed_Synchronization-{E5EFA8B3-3740-4566-AE5B-AE368AE3D8E9}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://portail.free.fr/
uSearchURL,(Default) = hxxp://fr.search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-28 10:09:06
Windows 6.0.6001 Service Pack 1 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'Explorer.exe'(1856)
c:\program files\McAfee\SiteAdvisor\saHook.dll
.
Heure de fin: 2009-02-28 10:11:18
ComboFix-quarantined-files.txt 2009-02-28 09:11:13
Avant-CF: 75 894 702 080 octets libres
Après-CF: 75,661,541,376 octets libres
181 --- E O F --- 2009-02-15 02:01:35
et le rapport hijacktis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:18:30, on 28/02/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\TOSHIBA\Tilt Mouse Software\1.0\ACQTMAPP.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehmsas.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\sebastien et sonia\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.search.yahoo.com/search?fr=mcafee&p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ACQTMOUSE] "C:\Program Files\TOSHIBA\Tilt Mouse Software\1.0\ACQTMAPP.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:18:30, on 28/02/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\TOSHIBA\Tilt Mouse Software\1.0\ACQTMAPP.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehmsas.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\sebastien et sonia\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.search.yahoo.com/search?fr=mcafee&p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ACQTMOUSE] "C:\Program Files\TOSHIBA\Tilt Mouse Software\1.0\ACQTMAPP.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
je crois pas que ce soit parti mais bon si tu n as pas payer mc afee desinstalle le et met a la place antivir gratuit lui et bien plus performant.
