Rapport hijackthis

Pharrel Williams -  
Bonjour,
je pense que mon ordinateur est infecté ( ralentissement... )
en consequense, j'ai effectué se rapport dans l'espoir que l'on puisse m'aider

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:54:08, on 26/04/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://club-internet.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\EoRezo\EoAdv\EOREZO~1.DLL (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O13 - Gopher Prefix:
O16 - DPF: CabBuilder - http://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Packard Bell BV - C:\Program Files\Packard bell\SAXO27\HIDSERVICE.EXE
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SrvCDEject - Unknown owner - C:\Program Files\Packard Bell\SrvCDEject.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9092 bytes

Cordialement merci =)
Configuration: Windows Vista
Internet Explorer 7.0

8 réponses

  • Votes
  • Date
  • Date décroissante
  2. Pharrel Williams Auteur
    Merci Loicdem :

    Voici le rapport que vous m'avez demandé :

    ------- LOGFILE OF AD-REMOVER 1.1.3.3 | ONLY XP/VISTA -------

    Updated by C_XX on 24/04/2009 at 12:00
    Contact: AdRemover.contact@gmail.com
    Website: http://pagesperso-orange.fr/FindyKill.Ad.Remover/

    Start at: 9:28:44, 26/04/2009 | Boot mode: Normal Boot
    Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
    Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
    Computer Name: PC-DE-OTHMAN
    Current User: othman - Administrator
    Drive(s):
    - C:\ (File System: NTFS)
    - I:\ (File System: CDFS)

    ============ Known Adwares Found ============

    .
    .
    C:\Users\othman\AppData\Roaming\Microsoft\Windows\Cookies\othman@bs.serving-sys[2].txt
    C:\Users\othman\AppData\Roaming\Microsoft\Windows\Cookies\othman@partypoker[2].txt
    C:\Users\othman\AppData\Roaming\Microsoft\Windows\Cookies\othman@popularscreensavers[1].txt
    C:\Users\othman\AppData\Roaming\Microsoft\Windows\Cookies\othman@www.popularscreensavers[1].txt

    +-----------------| Eorezo Elements Found:

    HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
    HKCR\EoRezoBHO.EoBho
    HKCR\EoRezoBHO.EoBho.1
    HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
    HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
    HKCU\Software\EoRezo
    HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
    HKLM\Software\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
    HKLM\Software\Classes\EoRezoBHO.EoBho
    HKLM\Software\Classes\EoRezoBHO.EoBho.1
    HKLM\Software\Classes\TypeLib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
    HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
    .
    C:\Program Files\EoRezo
    C:\Users\othman\AppData\Roaming\EoRezo

    +-----------------| It's TV Elements Found:

    .

    +-----------------| Sweetim Elements Found:

    .

    +-----------------| Added Scan:

    ---- Mozilla FireFox Version 2.0.0.20 ----

    ProfilePath: 50frc5rb.default (othman)
    .
    Prefs.js: Browser.Search.DefaultEngineName: "Google"
    Prefs.js: Browser.Search.SelectedEngine: "Google"
    Prefs.js: Browser.Search.DefaultUrl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
    .
    .
    .
    .
    .

    ---- Internet Explorer Version 7.0.6001.18000 ----

    [HKEY_CURRENT_USER\..\Internet Explorer\Main]

    Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
    Start page: hxxp://club-internet.fr/

    [HKEY_USERS\S-1-5-21-2334621455-172533336-2802114803-1002\..\Internet Explorer\Main]

    Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
    Start page: hxxp://club-internet.fr/

    [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

    Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
    Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
    Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
    Start page: hxxp://go.microsoft.com/fwlink/?LinkId=69157

    [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

    Tabs: hxxp://ieframe.dll/tabswelcome.htm

    +---------------------------------------------------------------------------+

    3212 Byte(s) - C:\Ad-Report-Scan-26.04.2009.log

    0 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
    0 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

    End at: 9:34:17 | 26/04/2009
    .
    +-----------------| E.O.F
    .

    cordialment
    1. Utilisateur anonyme
      C'est moche lol

      Relance ADRemover option B puis, appuie sur la lettre qui coche tout et montre le rapport
      3. Utilisateur anonyme
        Désolé, c'est moi qui t'est mal expliquer, supprimer tout !
        1. Pharrel Williams Auteur
          Nan c'est ce que j'avais compris mais je voulais pa faire de betise ...
          Enfin voici le rapport demandé et encore une fois merci :

          ------- LOGFILE OF AD-REMOVER 1.1.3.3 | ONLY XP/VISTA -------

          Updated by C_XX on 24/04/2009 at 12:00
          Contact: AdRemover.contact@gmail.com
          Website: http://pagesperso-orange.fr/FindyKill.Ad.Remover/

          **** LIMITED TO ****

          Known Adwares
          Eorezo
          It's TV
          Sweetim

          ********************

          Start at: 9:53:01, 26/04/2009 | Boot mode: Normal Boot
          Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
          Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
          Computer Name: PC-DE-OTHMAN
          Current User: othman - Administrator
          Drive(s):
          - C:\ (File System: NTFS)
          - I:\ (File System: CDFS)

          (!) ---- IE start pages/Tabs reset

          ============ Known Adwares Deleted ============

          .
          .
          C:\Users\othman\AppData\Roaming\Microsoft\Windows\Cookies\othman@bs.serving-sys[2].txt
          C:\Users\othman\AppData\Roaming\Microsoft\Windows\Cookies\othman@partypoker[2].txt
          C:\Users\othman\AppData\Roaming\Microsoft\Windows\Cookies\othman@popularscreensavers[1].txt
          C:\Users\othman\AppData\Roaming\Microsoft\Windows\Cookies\othman@www.popularscreensavers[1].txt

          +-----------------| Eorezo Elements Deleted :

          HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
          HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
          HKCR\EoRezoBHO.EoBho
          HKCR\EoRezoBHO.EoBho.1
          HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
          HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
          HKCU\Software\EoRezo
          HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
          HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
          .
          C:\Program Files\EoRezo
          C:\Users\othman\AppData\Roaming\EoRezo

          +-----------------| It's TV Elements Deleted :

          .

          +-----------------| Sweetim Elements Deleted :

          .

          (!) ---- Temp files deleted.
          (!) ---- Recycle bin emptied in all drives.

          +-----------------| Added Scan :

          ---- Mozilla FireFox Version 2.0.0.20 ----

          ProfilePath: 50frc5rb.default (othman)
          .
          Prefs.js: Browser.Search.DefaultEngineName: "Google"
          Prefs.js: Browser.Search.SelectedEngine: "Google"
          Prefs.js: Browser.Search.DefaultUrl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
          .
          .
          .
          .
          .

          ---- Internet Explorer Version 7.0.6001.18000 ----

          [HKEY_CURRENT_USER\..\Internet Explorer\Main]

          Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
          Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
          Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
          Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
          Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

          [HKEY_USERS\S-1-5-21-2334621455-172533336-2802114803-1002\..\Internet Explorer\Main]

          Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
          Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
          Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
          Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
          Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

          [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

          Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
          Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
          Search bar: hxxp://search.msn.com/spbasic.htm
          Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
          Start page: hxxp://fr.msn.com/

          [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

          Tabs: hxxp://ieframe.dll/tabswelcome.htm

          +---------------------------------------------------------------------------+

          3747 Byte(s) - C:\Ad-Report-Clean-26.04.2009.log
          3441 Byte(s) - C:\Ad-Report-Scan-26.04.2009.log

          2 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
          4 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

          End at: 10:00:01 | 26/04/2009
          .
          +-----------------| E.O.F
          .

          Discussions similaires

          Impossible d'afficher le rapport de tableau croisé dynamique sur un rapport
          Utilisateur anonyme

          13 réponses
          rapport de visite commercial
          antcho

          3 réponses
          impossible d'afficher le tableau dynamique sur un rapport existant
          Pierre

          3 réponses
          Rapport audit parc informatique
          It administrateur

          9 réponses
          Theme de rapport de stage option comptabilité
          sana saydou

          2 réponses