ANALYSE LOG Bernie

Bon alors reprenons tout depuis le début... avec Bernie
- hercplgs.cpl
- O4 - HKLM\..\Run: [SoundFusion]
Je pense que tout ca appartient à ma carte son, Hercules Fortissimo, mais je vais vérifier au cas ou.

pour la suite
- O9 - Extra button: Créer un Favori de l'appareil mobile (HKLM)
- O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... (HKLM)

Ca devrait correspondre à mon Smartphone...genre pocket pc.
Qu' en penses-tu?


fais màj de JAVA de SUN ta version est ancienne non ? , dis...euh comment on fait?C'est quoi SUN?

Alors comme tu peux le voir le travail n'est pas terminé...besoin d'aide encore.
Pour la suite j'ai un log de adaware, et le dernier de Hijack, après quelques modifs en mode sans échec...

Merci d'avance


Lavasoft Ad-aware Personal Build 6.181
Logfile created on :dimanche 5 décembre 2004 19:53:46
Created with Ad-aware Personal, free for private use.
Using reference-file :01R217 08.09.2003
______________________________________________________

Ad-aware Settings
=========================
Set : Activate in-depth scan (Recommended)
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file


05-12-2004 19:53:46 - Scan started. (Custom mode)

Listing running processes
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ThreadCreationTime : 05-12-2004 18:52:43
BasePriority : Normal


#:2 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ThreadCreationTime : 05-12-2004 18:52:48
BasePriority : High


#:3 [services.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 05-12-2004 18:52:48
BasePriority : Normal
FileSize : 99 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Applications Services et Contr
InternalName : services.exe
OriginalFilename : services.exe
ProductName : Syst
Created on : 30/08/2002 12:00:00
Last accessed : 05/12/2004 18:37:40
Last modified : 30/08/2002 12:00:00

#:4 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 05-12-2004 18:52:48
BasePriority : Normal
FileSize : 11 KB
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
OriginalFilename : lsass.exe
ProductName : Microsoft
Created on : 30/08/2002 12:00:00
Last accessed : 05/12/2004 18:37:40
Last modified : 30/08/2002 12:00:00

#:5 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 05-12-2004 18:52:48
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 30/08/2002 12:00:00
Last accessed : 05/12/2004 18:37:42
Last modified : 30/08/2002 12:00:00

#:6 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 05-12-2004 18:52:49
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 30/08/2002 12:00:00
Last accessed : 05/12/2004 18:37:42
Last modified : 30/08/2002 12:00:00

#:7 [explorer.exe]
FilePath : C:\WINDOWS\
ThreadCreationTime : 05-12-2004 18:52:50
BasePriority : Normal
FileSize : 984 KB
FileVersion : 6.00.2800.1106 (xpsp1.020828-1920)
ProductVersion : 6.00.2800.1106
CompanyName : Microsoft Corporation
FileDescription : Explorateur Windows
InternalName : explorer
OriginalFilename : EXPLORER.EXE
ProductName : Syst
Created on : 30/08/2002 12:00:00
Last accessed : 05/12/2004 18:52:59
Last modified : 30/08/2002 12:00:00

#:8 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 05-12-2004 18:52:51
BasePriority : Normal
FileSize : 50 KB
FileVersion : 5.1.2600.0 (XPClient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
OriginalFilename : spoolsv.exe
ProductName : Microsoft
Created on : 30/08/2002 12:00:00
Last accessed : 05/12/2004 18:48:11
Last modified : 30/08/2002 12:00:00

#:9 [ati2evxx.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 05-12-2004 18:52:51
BasePriority : Normal
FileSize : 144 KB
Created on : 21/11/2002 00:04:30
Last accessed : 05/12/2004 18:47:46
Last modified : 21/11/2002 00:04:30

#:10 [cdac11ba.exe]
FilePath : C:\WINDOWS\System32\drivers\
ThreadCreationTime : 05-12-2004 18:52:51
BasePriority : Normal
FileSize : 53 KB
FileVersion : 4.20.020
ProductVersion : 4.20.020 Windows NT 2002/12/10
Copyright : Copyright (c) 1998-2002 Macrovision Corp.
CompanyName : Macrovision
FileDescription : Macrovision RTS Service
InternalName : CDANTSRV
OriginalFilename : CDANTSRV.EXE
ProductName : SafeCast Windows NT
Created on : 27/03/2004 11:20:22
Last accessed : 05/12/2004 18:43:54
Last modified : 27/03/2004 11:20:22

#:11 [inorpc.exe]
FilePath : C:\Program Files\CA\eTrust Antivirus\
ThreadCreationTime : 05-12-2004 18:52:51
BasePriority : Normal
FileSize : 136 KB
FileVersion : 7.0.139.0
ProductVersion : 7.0.139.0
Copyright : Copyright 2003 Computer Associates International, Inc.
CompanyName : Computer Associates International, Inc.
InternalName : InoRpc.exe
OriginalFilename : InoRpc.exe
ProductName : eTrust Antivirus
Created on : 24/03/2004 18:15:00
Last accessed : 05/12/2004 18:52:36
Last modified : 21/03/2003 21:32:46

#:12 [inort.exe]
FilePath : C:\Program Files\CA\eTrust Antivirus\
ThreadCreationTime : 05-12-2004 18:52:53
BasePriority : Normal
FileSize : 220 KB
FileVersion : 7.0.139.0
ProductVersion : 7.0.139.0
Copyright : Copyright 2003 Computer Associates International, Inc.
CompanyName : Computer Associates International, Inc.
InternalName : InoRT.dll
OriginalFilename : InoRT.dll
ProductName : eTrust Antivirus
Created on : 24/03/2004 18:14:59
Last accessed : 05/12/2004 18:52:36
Last modified : 21/03/2003 21:32:46

#:13 [inotask.exe]
FilePath : C:\Program Files\CA\eTrust Antivirus\
ThreadCreationTime : 05-12-2004 18:52:53
BasePriority : Normal
FileSize : 224 KB
FileVersion : 7.0.139.0
ProductVersion : 7.0.139.0
Copyright : Copyright 2003 Computer Associates International, Inc.
CompanyName : Computer Associates International, Inc.
InternalName : InoTask.exe
OriginalFilename : InoTask.exe
ProductName : eTrust Antivirus
Created on : 24/03/2004 18:14:59
Last accessed : 05/12/2004 18:52:36
Last modified : 21/03/2003 21:32:52

#:14 [atiptaxx.exe]
FilePath : C:\Program Files\ATI Technologies\ATI Control Panel\
ThreadCreationTime : 05-12-2004 18:52:56
BasePriority : Normal
FileSize : 288 KB
FileVersion : 6.14.10.4000
ProductVersion : 6.14.10.4000
Copyright : Copyright (C) 1998-2002 ATI Technologies Inc.
CompanyName : ATI Technologies, Inc.
FileDescription : ATI Desktop Control Panel
InternalName : Atiptaxx.exe
OriginalFilename : Atiptaxx.exe
ProductName : ATI Desktop Component
Created on : 24/03/2004 18:34:12
Last accessed : 05/12/2004 18:52:56
Last modified : 20/11/2002 16:54:00

#:15 [logwatnt.exe]
FilePath : C:\Program Files\CA\SharedComponents\CA_LIC\
ThreadCreationTime : 05-12-2004 18:52:56
BasePriority : Normal
FileSize : 52 KB
FileVersion : 1.52
ProductVersion : 1, 0, 0, 1
Copyright : Copyright
CompanyName : Computer Associates
FileDescription : LogWatNT
InternalName : LogWatNT
OriginalFilename : LogWatNT.exe
ProductName : Computer Associates LogWatNT
Created on : 20/09/2002 14:29:30
Last accessed : 05/12/2004 18:45:18
Last modified : 20/09/2002 14:29:30

#:16 [rundll32.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 05-12-2004 18:52:57
BasePriority : Normal
FileSize : 31 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Ex
InternalName : rundll
OriginalFilename : RUNDLL.EXE
ProductName : Syst
Created on : 30/08/2002 12:00:00
Last accessed : 05/12/2004 18:52:57
Last modified : 30/08/2002 12:00:00

#:17 [msnmsgr.exe]
FilePath : C:\Program Files\MSN Messenger\
ThreadCreationTime : 05-12-2004 18:52:57
BasePriority : Normal
FileSize : 4768 KB
FileVersion : 6.2.0137
ProductVersion : Version 6.2
Copyright : Copyright (c) Microsoft Corporation 1997-2004
CompanyName : Microsoft Corporation
FileDescription : MSN Messenger
InternalName : msnmsgr
OriginalFilename : msnmsgr.exe
ProductName : MSN Messenger
Created on : 28/05/2004 20:22:04
Last accessed : 05/12/2004 18:52:57
Last modified : 28/05/2004 20:22:04

#:18 [wcescomm.exe]
FilePath : C:\Program Files\Microsoft ActiveSync\
ThreadCreationTime : 05-12-2004 18:52:58
BasePriority : Normal
FileSize : 408 KB
FileVersion : 3.7.0.3083
ProductVersion : 3.7.3083
Copyright : Copyright
CompanyName : Microsoft Corporation
FileDescription : Connection Manager
InternalName : wcescomm
OriginalFilename : WCESCOMM.EXE
ProductName : Microsoft ActiveSync
Created on : 19/09/2004 21:57:14
Last accessed : 05/12/2004 18:52:58
Last modified : 23/04/2003 01:09:28

#:19 [dslmon.exe]
FilePath : C:\Program Files\SAGEM\SAGEM F@st 800-908\
ThreadCreationTime : 05-12-2004 18:52:59
BasePriority : Normal
FileSize : 940 KB
FileVersion : 1, 0, 0, 1
ProductVersion : 1, 0, 0, 1
Copyright : Copyright (C) 2000
FileDescription : ADIMON MFC Application
InternalName : DSLMON
OriginalFilename : ADIMON.EXE
ProductName : DSLMON Application
Created on : 24/03/2004 19:55:33
Last accessed : 05/12/2004 18:52:59
Last modified : 08/07/2003 09:22:0



#:22 [wuauclt.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 05-12-2004 18:53:43
BasePriority : Normal
FileSize : 112 KB
FileVersion : 5.4.3790.2182 built by: srv03_rtm(ntvbl04)
ProductVersion : 5.4.3790.2182
CompanyName : Microsoft Corporation
FileDescription : Mises
InternalName : wuauclt.exe
OriginalFilename : wuauclt.exe
ProductName : Syst
Created on : 24/03/2004 17:49:04
Last accessed : 05/12/2004 18:53:43
Last modified : 03/08/2004 12:01:20

____________________________________________________________________________________________________________

Logfile of HijackThis v1.97.7
Scan saved at 19:59:32, on 05/12/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Documents and Settings\Gros Minet\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundFusion] RunDll32 hercplgs.cpl,BootEntryPoint
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Créer un Favori de l'appareil mobile (HKLM)
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095191960660
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Environnement d'exécution Java 1.4.1) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Environnement d'exécution Java 1.4.1) -

____________________________________________________________________________________________________________
un grand merci pour toutes ces questions...quel courrage !