Antivirus Plus

mido2 -  
 laure -
Bonjour,
Je ne sais comment un programme d'antivirus est installé dans mon PC. Chaque 2minutes il me sort un message 'Warning 32 threats found' et il me demande de scanner mon disque et s'enregistrer dans un site pour acheter un antivirus quand j'ignore il part puis il revient c vraiment fatiguant. un moment donne l'image s'est fixé et il ne me permet pas de voir ma fenetre active.
quelqu'un peut m'aider? je vous remercie d'avance.
Merci
Configuration: Windows XP Internet Explorer 7.0

30 réponses

  • 1
  • 2
  1. mido2
     
    quand je clique sur le lien pour telecharger Hijackthis , la page web ne s'affiche pas, il me dis qu'elle n'Existe pas
    1
  2. kevin05 Messages postés 3814 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
     
    Salut :)

    Télécharge HijackThis Version 2.02 de Merijn :

    - Enregistre HJTInstall.exe sur ton bureau.
    - Fais un double-clic (gauche) sur HJTInstall.exe afin de lancer l’installation
    - Clique sur Install ensuite sur « I Accept »
    - Clique sur « Do a scan system and save log file »
    - Le bloc-notes s’ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.

    Tuto

    et si problème pour VISTA

    Des expliquations en images pour l'utiliser

    Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement
    0
    1. laure
       
      cc kevin
      suite a ton blog voici mon copier coller si tu pe maider c trop gentil
      merci par avance
      Logfile of random's system information tool 1.06 (written by random/random)
      Run by Laure at 2010-01-14 19:42:01
      Microsoft Windows XP Professionnel Service Pack 3
      System drive C: has 16 GB (46%) free of 35 GB
      Total RAM: 1014 MB (34% free)


      ======Registry dump======

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
      Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
      Windows Live Family Safety Browser Helper Class - C:\Program Files\Windows Live\Family Safety\fssbho.dll [2009-08-05 113512]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
      Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{823a78f8-0538-9343-9d72-33bc08cc5889}]
      gwprimawega - C:\WINDOWS\system32\DKk6V1D3WpJ.dll [2009-12-26 1183744]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
      Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2B5AAB8-2183-4be7-81A6-F11493C45872}]
      Antivirus Plus BHO - C:\Documents and Settings\Laure\Application Data\AntiVirus Plus\AntiVirus Plus.70700.dll [2010-01-14 2541568]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
      Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-12-15 41760]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
      Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
      JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-12-15 73728]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\WINDOWS\system32\eDStoolbar.dll [2007-05-28 106496]
      {21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
      "ePower_DMC"=C:\Acer\Empowering Technology\ePower\ePower_DMC.exe [2007-07-04 475136]
      "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]
      "fssui"=C:\Program Files\Windows Live\Family Safety\fsui.exe [2009-08-05 647520]
      "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
      "avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-09-15 81000]
      "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-12-15 149280]
      "AntiVirus Plus"=C:\Documents and Settings\Laure\Application Data\AntiVirus Plus\AntiVirus Plus.70700.dll [2010-01-14 2541568]

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
      "RocketDock"=C:\Program Files\RocketDock\RocketDock.exe [2007-09-02 495616]
      "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
      "AntiVirus Plus"=C:\Documents and Settings\Laure\Application Data\AntiVirus Plus\AntiVirus Plus.70700.dll [2010-01-14 2541568]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePresentation HPD]
      C:\Acer\Empowering Technology\ePresentation\ePresentation.exe [2007-03-02 208896]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
      C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
      C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]
      C:\Program Files\Realtek\InstallShield\AzMixerSel.exe [2005-06-11 53248]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boot]
      C:\Acer\Empowering Technology\ePower\Boot.exe [2006-03-15 579584]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
      C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
      C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2007-05-28 342528]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eLockMonitor]
      C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe []

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
      C:\Acer\Empowering Technology\ePower\ePower_DMC.exe [2007-07-04 475136]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
      C:\Acer\Empowering Technology\eRecovery\eRAgent.exe [2007-07-11 421888]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
      C:\WINDOWS\system32\hkcmd.exe [2007-06-13 162584]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
      C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-03-21 174872]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
      C:\WINDOWS\system32\igfxtray.exe [2007-06-13 142104]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
      C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-05 208952]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
      C:\Program Files\iTunes\iTunesHelper.exe [2008-09-10 289576]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
      C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2007-01-08 52256]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
      C:\PROGRA~1\LAUNCH~1\LManager.exe [2007-10-17 858632]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
      C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2004-08-05 59392]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
      C:\WINDOWS\system32\igfxpers.exe [2007-06-13 138008]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
      C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-05 455168]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
      C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-05 455168]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\preload]
      C:\Windows\RUNXMLPL.exe [2007-04-21 20480]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
      C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
      C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2007-01-08 68640]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
      C:\WINDOWS\RTHDCPL.EXE [2007-05-28 16132608]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2005-12-16 761945]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WarReg_PopUp]
      C:\Acer\WR_PopUp\WarReg_PopUp.exe [2007-02-20 61440]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Acer Empowering Technology.lnk]
      C:\Acer\EMPOWE~1\ACEREM~1.EXE [2007-07-12 45056]

      C:\Documents and Settings\Laure\Menu Démarrer\Programmes\Accessoires\Démarrage
      OpenOffice.org 3.1.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe
      Outil de notification Live Search.lnk - C:\Documents and Settings\Laure\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
      C:\WINDOWS\system32\igfxdev.dll [2007-06-05 204800]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
      C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265088]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
      WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
      "authentication packages"=msv1_0
      nwprovau

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
      "dontdisplaylastusername"=0
      "legalnoticecaption"=
      "legalnoticetext"=
      "shutdownwithoutlogon"=1
      "undockwithoutlogon"=1

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      "NoDriveTypeAutoRun"=145

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      "HonorAutoRunSetting"=

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
      "C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe"="C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe:*:Enabled:CyberLink PowerDVD"
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
      "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
      "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03e6d35c-85d6-11dd-b93a-001e4c54c82d}]
      shell\AutoRun\command - F:\EmDesk.exe
      shell\EmDesk\command - F:\EmDesk.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11f7a2b4-5411-11de-baeb-001e4c54c82d}]
      shell\AutoRun\command - WDSetup.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4817781-cd46-11de-bbca-001e4c54c82d}]
      shell\AutoRun\command - F:\setupSNK.exe


      ======List of files/folders created in the last 1 months======

      2010-01-14 19:15:14 ----D---- C:\rsit
      2010-01-14 19:15:14 ----D---- C:\Program Files\trend micro
      2010-01-14 18:22:38 ----D---- C:\Documents and Settings\Laure\Application Data\AntiVirus Plus
      2010-01-14 18:22:14 ----A---- C:\WINDOWS\system32\FJ-_GokQQM.exe
      2009-12-29 17:22:50 ----D---- C:\89ddddfed8b927bcd5d9
      2009-12-29 17:22:40 ----D---- C:\0a8cfbc8ed0fece282f148
      2009-12-26 06:37:38 ----A---- C:\WINDOWS\system32\DKk6V1D3WpJ.dll
      2009-12-15 19:19:36 ----D---- C:\Documents and Settings\Laure\Application Data\OpenOffice.org
      2009-12-15 19:17:04 ----D---- C:\Program Files\JRE
      2009-12-15 19:16:37 ----D---- C:\Program Files\OpenOffice.org 3
      2009-12-15 19:16:18 ----A---- C:\WINDOWS\system32\javaws.exe
      2009-12-15 19:16:18 ----A---- C:\WINDOWS\system32\javaw.exe
      2009-12-15 19:16:18 ----A---- C:\WINDOWS\system32\java.exe
      2009-12-15 09:38:09 ----D---- C:\Documents and Settings\Laure\Application Data\Thunderbird

      ======List of files/folders modified in the last 1 months======

      2010-01-14 19:28:43 ----D---- C:\WINDOWS
      2010-01-14 19:15:14 ----D---- C:\Program Files
      2010-01-14 19:09:46 ----D---- C:\Program Files\Mozilla Firefox
      2010-01-14 19:01:19 ----D---- C:\WINDOWS\Prefetch
      2010-01-14 18:58:21 ----D---- C:\WINDOWS\Temp
      2010-01-14 18:56:45 ----A---- C:\WINDOWS\ModemLog_Agere Systems HDA Modem.txt
      2010-01-14 18:55:00 ----A---- C:\WINDOWS\SchedLgU.Txt
      2010-01-14 18:36:01 ----D---- C:\WINDOWS\Debug
      2010-01-14 18:22:14 ----D---- C:\WINDOWS\system32
      2010-01-13 23:51:24 ----SHD---- C:\WINDOWS\Installer
      2010-01-13 23:51:24 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
      2010-01-13 23:50:27 ----HD---- C:\WINDOWS\inf
      2010-01-13 23:50:21 ----RSHD---- C:\WINDOWS\system32\dllcache
      2010-01-13 23:50:12 ----HD---- C:\WINDOWS\$hf_mig$
      2010-01-13 23:50:10 ----D---- C:\WINDOWS\system32\CatRoot2
      2010-01-13 17:17:55 ----D---- C:\WINDOWS\AppPatch
      2010-01-11 22:42:48 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
      2010-01-11 22:42:17 ----RSD---- C:\WINDOWS\assembly
      2010-01-11 22:41:46 ----D---- C:\Program Files\Microsoft SQL Server
      2010-01-11 22:41:05 ----D---- C:\WINDOWS\Registration
      2010-01-05 01:17:46 ----A---- C:\WINDOWS\system32\MRT.exe
      2009-12-22 18:08:50 ----SD---- C:\WINDOWS\Tasks
      2009-12-15 19:17:19 ----RSD---- C:\WINDOWS\Fonts
      2009-12-15 19:16:03 ----A---- C:\WINDOWS\system32\deploytk.dll
      2009-12-15 19:15:59 ----D---- C:\Program Files\Java

      ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-09-15 27408]
      R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-09-15 114768]
      R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-09-15 52368]
      R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
      R1 WmiAcpi;Interface de gestion Microsoft Windows pour ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
      R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
      R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-09-15 94160]
      R2 fssfltr;FssFltr; C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2009-08-05 54752]
      R2 int15;int15; \??\C:\WINDOWS\system32\drivers\int15.sys []
      R2 irda;Protocole IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
      R2 NwlnkIpx;Protocole de transport compatible NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-13 88320]
      R2 NwlnkNb;NetBIOS NWLink; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2004-08-05 63232]
      R2 NwlnkSpx;Protocole NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2004-08-05 55936]
      R2 tvicport;tvicport; \??\C:\WINDOWS\system32\drivers\tvicport.sys []
      R2 zntport;zntport; \??\C:\WINDOWS\system32\drivers\zntport.sys []
      R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2007-03-09 1163616]
      R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
      R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-09-15 23152]
      R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2007-02-16 160256]
      R3 BCM43XX;Pilote pour carte réseau Broadcom 802.11; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
      R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
      R3 DKbFltr;Dritek Keyboard Filter Driver; C:\WINDOWS\system32\DRIVERS\DKbFltr.sys [2006-01-20 17408]
      R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
      R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
      R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-06-05 5761728]
      R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-05-30 4424192]
      R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
      R3 NSCIRDA;Pilote de périphérique infrarouge NSC; C:\WINDOWS\system32\DRIVERS\nscirda.sys [2008-04-13 28672]
      R3 NTIDrvr;Upper Class Filter Driver; C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys [2007-08-09 6144]
      R3 NWRDR;NetWare Rdr; C:\WINDOWS\system32\DRIVERS\nwrdr.sys [2008-04-13 163584]
      R3 Rasirda;Miniport réseau étendu (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
      R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
      R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2005-12-16 191936]
      R3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2007-05-02 290816]
      R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
      R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
      R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
      S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
      S3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
      S3 int15.sys;int15.sys; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys []
      S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
      S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
      S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
      S3 psdfilter;psdfilter; \??\C:\WINDOWS\system32\Drivers\psdfilter.sys []
      S3 psdvdisk;psdvdisk; \??\C:\WINDOWS\system32\Drivers\psdvdisk.sys []
      S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
      S3 SONYPVU1;Pilote de filtrage Sony USB (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
      S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
      S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-09-10 32000]
      S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
      S3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
      S3 usbvideo;Périphérique vidéo USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
      S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
      S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
      S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

      ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-19 611664]
      R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\WINDOWS\system32\agrsmsvc.exe [2006-10-05 9216]
      R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-09-10 116040]
      R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-09-15 18752]
      R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-09-15 138680]
      R2 BcmSqlStartupSvc;Service de démarrage SQL Server pour le Gestionnaire de contacts professionnels; C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-16 30312]
      R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
      R2 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2007-03-01 24576]
      R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-03-21 355096]
      R2 Irmon;Moniteur infrarouge; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
      R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-12-15 153376]
      R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe [2007-01-17 61440]
      R2 NWCWorkstation;Service client pour NetWare; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
      R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-01-08 171040]
      R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512]
      R2 SQLWriter;Enregistreur VSS SQL Server; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-24 87904]
      R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
      R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-09-15 254040]
      R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-09-15 352920]
      S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe /h ccCommon []
      S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 268800]
      S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
      S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
      S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
      S3 fsssvc;Service Windows Live Contrôle parental; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
      S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
      S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
      S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2008-09-10 536872]
      S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ); C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2006-04-14 28933976]
      S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
      S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
      S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
      S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]
      S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
      S4 SQLBrowser;SQL Server Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2006-04-14 240416]

      -----------------EOF-----------------
      0
  3. mido2
     
    Merci pour la réponse.
    mais j'arrive pas a entrer dans le lien que tu m'as donné. HijackThis Version 2.02 de Merijn
    Merci
    0
  4. kevin05 Messages postés 3814 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
     
    tu as quel prb ?

    Explique ? page non trouvé ?
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. mido2
     
    Bonsoir,
    J'ai reussi a passer par un autre lien et voici le contenu de mon scan:

    ---------------------
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:04:46, on 2009-07-06
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16850)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\arservice.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\Trend Micro\BM\TMBMSRV.exe
    C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\ARPWRMSG.EXE
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Athan\Athan.exe
    C:\Program Files\DISC\DISCover.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
    C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    C:\WINDOWS\system\rundll32.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\program files\freecall.com\freecall\freecall.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
    C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\DISC\DiscStreamHub.exe
    C:\Program Files\HP\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\HP\Digital Imaging\Bin\hpoSTS08.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
    c:\windows\system\hpsysdrv.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\Internet Security\UfNavi.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://compaq-consumer.my.aol.ca/?icid=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://archive.islamonline.net/arabic/index.shtml/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.search.yahoo.com/search?fr=mcafee&p=%s
    R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
    R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
    O1 - Hosts: 78.159.125.55 www.google.com
    O1 - Hosts: 78.159.125.55 www.google.de
    O1 - Hosts: 78.159.125.55 www.google.fr
    O1 - Hosts: 78.159.125.55 www.google.co.uk
    O1 - Hosts: 78.159.125.55 www.google.com.br
    O1 - Hosts: 78.159.125.55 www.google.it
    O1 - Hosts: 78.159.125.55 www.google.es
    O1 - Hosts: 78.159.125.55 www.google.co.jp
    O1 - Hosts: 78.159.125.55 www.google.com.mx
    O1 - Hosts: 78.159.125.55 www.google.ca
    O1 - Hosts: 78.159.125.55 www.google.com.au
    O1 - Hosts: 78.159.125.55 www.google.nl
    O1 - Hosts: 78.159.125.55 www.google.co.za
    O1 - Hosts: 78.159.125.55 www.google.be
    O1 - Hosts: 78.159.125.55 www.google.gr
    O1 - Hosts: 78.159.125.55 www.google.at
    O1 - Hosts: 78.159.125.55 www.google.se
    O1 - Hosts: 78.159.125.55 www.google.ch
    O1 - Hosts: 78.159.125.55 www.google.pt
    O1 - Hosts: 78.159.125.55 www.google.dk
    O1 - Hosts: 78.159.125.55 www.google.fi
    O1 - Hosts: 78.159.125.55 www.google.ie
    O1 - Hosts: 78.159.125.55 www.google.no
    O1 - Hosts: 78.159.125.55 search.yahoo.com
    O1 - Hosts: 78.159.125.55 us.search.yahoo.com
    O1 - Hosts: 78.159.125.55 uk.search.yahoo.com
    O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
    O2 - BHO: (no name) - {B035573A-5F43-4862-A194-87D027C63012} - C:\WINDOWS\system32\InternetExplorer.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr-ca\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr-ca\msntb.dll
    O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
    O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
    O4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe nogui
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
    O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [shell] C:\WINDOWS\system\rundll32.exe Administra
    O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [FreeCall] "C:\program files\freecall.com\freecall\freecall.exe" -nosplash -minimized
    O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM')
    O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
    O4 - Global Startup: Connexions Compaq.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZKxdm011YYCA
    O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
    O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
    O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
    O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.securesoftwarefeed.com/redirect.php (file missing)
    O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.securesoftwarefeed.com/redirect.php (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://*.trymedia.com (HKLM)
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-3/WebfettiInitialSetup1.0.1.0.cab
    O22 - SharedTaskScheduler: disgorging - {0123eb75-964c-4cb3-b796-431cc9099570} - C:\WINDOWS\system32\cjuvwa.dll (file missing)
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (file missing)
    O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Composant de commande centrale Trend Micro (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
    O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
    0
  7. kevin05 Messages postés 3814 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
     
    C'est partit

    Bien infecté..

    Dans l'ordre :

    Télécharge RHost de SiRi sur ton bureau :

    Double-clique dessus pour le lancer .

    -> clique sur " Restore original Hosts " et attendre un court instant ...

    ( ps : c'est normal que rien ne se passe ... )

    *Télécharges Ad-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :

    * tutoriel installation


    * /!\ Déconnectes toi et fermes toutes applications en cours, désactive ton antivirus le temps de la manipulation/!\

    * Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( le bureau )

    * Ouvre le dossier Ad-remover présent sur ton bureau, et double clique sur Ad-remover.bat.

    * Sous Vista : clic droit sur AD-Remover et sélectionner "Exécuter en tant qu'administrateur"

    * Au menu principal choisi l'option "L" et tape sur [entrée] .

    * Laisse travailler l'outil et ne touche à rien ...

    * Poste le rapport qui apparait à la fin.

    ( le rapport est sauvegardé aussi sous C:\Ad-report.log )

    (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

    Note :

    Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
    Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
    Mis
    entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels
    de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces
    antivirus.

    Les sites ci dessous sont verrolés,il ne faut pas surfer dessus

    Bingo Day
    Boonty
    BoontyGames
    Casino DelRio
    Casino Lux
    Casino Nederland
    Casino Tropez
    Casino-On-Net
    Casino.com
    EmpirePoker
    EoCalendar
    EoClock
    EoComputer
    EoDesk3d
    EoMail
    EoMap
    EoNet
    EoPhoto
    EoProgrammeTele
    EoRss
    EoSudoku
    EoTraduction
    EoWeather
    EoWiki
    Europa Casino
    Everest Casino
    Everest Poker
    Flamingo Club Casino
    Fun Web Products
    Golden Palace Casino
    Golden Casino
    GV Luxe
    It's TV
    MySpeedyAlert
    MyTotalSearch
    MyGlobalSearch
    MyQuickSearch
    MySearch
    MyWay
    My Way Speedbar
    MyWebSearch
    Pacific Poker
    PartyPoker
    Poker Mile
    Poker 770
    RoxyPalace
    SweetIM
    Titan Poker
    Vegas Red Casino
    888poker

    télécharge smitfraudfix et enregistre le sur le bureau

    ? Ensuite double clique sur smitfraudfix puis exécuter

    ? Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

    (attention : N utilises pas l option 2 si je ne te l'ai pas demandé !!)

    ? copier/coller le rapport dans la réponse.

    TUTO si problème



    (Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool".
    Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains,
    cet utilitaire pourrait arrêter des logiciels de sécurité.)
    Je vais me coucher

    Bonne nuit.
    0
  8. mido2
     
    Bonjour,
    Tout d'abord, Merci pour ton aide Kevin.
    J'ai fais ce que tu m'a demandé et j'ai lancé le programme Ad-remover, sauf que qd j'ai tapé 'L' (pour nettoyage) la recherche a commencé mais aprés elle s'est arrêtée, j'ai donc repris la manip puis j'ai fais S (scaner) et voici le rapport généré:
    -----
    .
    ======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
    .
    Mit à jour par C_XX le 24/06/2009 à 7:10 PM
    Contact: AdRemover.contact@gmail.com
    Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
    .
    Lancé à: 19:37:53, 2009-07-08 | Mode Normal | Option: SCAN
    Exécuté de: C:\Program Files\Ad-remover\
    Système d'exploitation: Microsoft® Windows XP™ Service Pack 2 v5.1.2600
    Nom du PC: IMSA | Utilisateur actuel: Compaq_Administrator
    .
    Administrateur: Administrator
    Administrateur: Compaq_Administrator
    N'est pas administrateur: Guest *Desactive*
    N'est pas administrateur: HelpAssistant *Desactive*
    N'est pas administrateur: SUPPORT_388945a0 *Desactive*
    N'est pas administrateur: SUPPORT_fddfa904 *Desactive*
    .
    ============== ةLةMENT(S) TROUVة(S) ==============
    .
    .
    .
    C:\Program Files\MyWebSearch
    C:\WINDOWS\Downloaded Program Files\F3initialsetup1.0.1.0.inf
    C:\Program Files\Mozilla Firefox\Plugins\NPMyWebS.dll
    C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar
    C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.manifest
    C:\WINDOWS\System32\f3PSSavr.scr
    C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\nso2FF.tmp
    C:\Program Files\MSN Messenger\Riched20.dll
    C:\Program Files\MSN Messenger\Msimg32.dll
    C:\Program Files\Internet Explorer\msimg32.dll
    C:\WINDOWS\Prefetch\BU_.EXE-22BE01E6.pf
    C:\WINDOWS\Prefetch\MWSOEMON.EXE-22AAA5A1.pf
    C:\WINDOWS\Prefetch\MWSSVC.EXE-03988041.pf
    C:\DOCUME~1\COMPAQ~1\Cookies\compaq_administrator@mywebsearch[2].txt
    .
    ============== Scan additionnel ==============
    .

    * Mozilla FireFox Version 2.0 *

    Nom du profil: ao1jxfvy.default (Compaq_Administrator)
    .
    (Prefs.js) user_pref("browser.search.defaultenginename", "Google");
    (Prefs.js) //er_pref("browser.search.selectedEngine", "Google");
    (Prefs.js) user_pref("browser.search.selectedEngine", "Search");
    (Prefs.js) user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=");
    .
    .

    * Internet Explorer Version 7.0.5730.13 *

    [HKEY_CURRENT_USER\..\Internet Explorer\Main]

    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
    Search Page: hxxp://www.google.com
    Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

    [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search bar: hxxp://search.msn.com/spbasic.htm
    Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Start Page: hxxp://fr.msn.com/

    [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

    Tabs: res://ieframe.dll/tabswelcome.htm
    .
    ===================================
    .
    13671 Octet(s) - C:\Ad-Report-CLEAN.log
    2980 Octet(s) - C:\Ad-Report-SCAN.log
    .
    302 Fichier(s) - C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
    3009 Fichier(s) - C:\WINDOWS\Temp
    .
    17 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
    0 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
    .
    Fin à: 19:57:17 | 2009-07-08
    .
    ============== E.O.F ==============
    .
    ----

    Merci
    0
  9. kevin05 Messages postés 3814 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
     
    Bah press L maintenant ;)
    0
  10. mido2
     
    Voici c qu'a donné le nettoyage:

    ------------------------------------

    .
    ======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
    .
    Mit à jour par C_XX le 24/06/2009 à 7:10 PM
    Contact: AdRemover.contact@gmail.com
    Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
    .
    Lancé à: 20:17:33, 2009-07-08 | Mode Normal | Option: CLEAN
    Exécuté de: C:\Program Files\Ad-remover\
    Système d'exploitation: Microsoft® Windows XP™ Service Pack 2 v5.1.2600
    Nom du PC: IMSA | Utilisateur actuel: Compaq_Administrator
    .
    Administrateur: Administrator
    Administrateur: Compaq_Administrator
    N'est pas administrateur: Guest *Desactive*
    N'est pas administrateur: HelpAssistant *Desactive*
    N'est pas administrateur: SUPPORT_388945a0 *Desactive*
    N'est pas administrateur: SUPPORT_fddfa904 *Desactive*
    .
    ============== ةLةMENT(S) NEUTRALISة(S) ==============
    .
    .
    .
    C:\Program Files\MyWebSearch
    C:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.1.0.inf
    C:\Program Files\Mozilla Firefox\Plugins\NPMyWebS.dll
    C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar
    C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.manifest
    C:\WINDOWS\System32\f3PSSavr.scr
    C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\nso2FF.tmp\System.dll
    C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\nso2FF.tmp
    C:\Program Files\MSN Messenger\riched20.dll
    C:\Program Files\MSN Messenger\msimg32.dll
    C:\Program Files\Internet Explorer\msimg32.dll
    C:\WINDOWS\Prefetch\BU_.EXE-22BE01E6.pf
    C:\WINDOWS\Prefetch\MWSOEMON.EXE-22AAA5A1.pf
    C:\WINDOWS\Prefetch\MWSSVC.EXE-03988041.pf
    C:\DOCUME~1\COMPAQ~1\Cookies\compaq_administrator@mywebsearch[2].txt

    (!) -- Fichiers temporaires supprimés.

    .
    ============== Scan additionnel ==============
    .

    * Mozilla FireFox Version 2.0 *

    Nom du profil: ao1jxfvy.default (Compaq_Administrator)
    .
    (Prefs.js) user_pref("browser.search.defaultenginename", "Google");
    (Prefs.js) //er_pref("browser.search.selectedEngine", "Google");
    (Prefs.js) user_pref("browser.search.selectedEngine", "Search");
    (Prefs.js) user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=");
    .
    .

    * Internet Explorer Version 7.0.5730.13 *

    [HKEY_CURRENT_USER\..\Internet Explorer\Main]

    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
    Search Page: hxxp://www.google.com
    Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

    [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search bar: hxxp://search.msn.com/spbasic.htm
    Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Start Page: hxxp://fr.msn.com/

    [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

    Tabs: res://ieframe.dll/tabswelcome.htm
    .
    ===================================
    .
    3046 Octet(s) - C:\Ad-Report-CLEAN.log
    3299 Octet(s) - C:\Ad-Report-SCAN.log
    .
    164 Fichier(s) - C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
    207 Fichier(s) - C:\WINDOWS\Temp
    .
    19 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
    13 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
    .
    Fin à: 20:36:28 | 2009-07-08
    .
    ============== E.O.F ==============
    .

    Est ce que je continue la procedure jusq'a la fin? je vois que j'ai plus les icons de Antivirus plus je crois que ca marche
    0
  11. kevin05 Messages postés 3814 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
     
    Ouais

    Continue...

    Jusqu'à ce que je dit que ton pc est clean ;)
    0
  12. mido2
     
    Voici le rapport du scan:

    SmitFraudFix v2.423

    Scan done at 20:39:22,44, 2009-07-08
    Run from C:\Documents and Settings\Compaq_Administrator\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\arservice.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\ARPWRMSG.EXE
    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Athan\Athan.exe
    C:\Program Files\DISC\DISCover.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\program files\freecall.com\freecall\freecall.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
    C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\DISC\DiscStreamHub.exe
    C:\Program Files\HP\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\HP\Digital Imaging\Bin\hpoSTS08.exe
    C:\WINDOWS\system32\wuauclt.exe
    c:\windows\system\hpsysdrv.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    hosts file corrupted !

    127.0.0.1 forum.arovax.com
    127.0.0.1 www.forum.arovax.com
    127.0.0.1 bleepingcomputer.com
    127.0.0.1 download.bleepingcomputer.com
    127.0.0.1 www.bleepingcomputer.com
    127.0.0.1 www.download.bleepingcomputer.com
    127.0.0.1 bullguard.com
    127.0.0.1 www.bullguard.com
    127.0.0.1 castlecops.com
    127.0.0.1 www.castlecops.com
    127.0.0.1 compu-docs.com
    127.0.0.1 www.compu-docs.com
    127.0.0.1 computing.net
    127.0.0.1 www.computing.net
    127.0.0.1 forums.us.dell.com
    127.0.0.1 www.forums.us.dell.com
    127.0.0.1 depannetonpc.net
    127.0.0.1 www.depannetonpc.net
    127.0.0.1 forums.digitaltrends.com
    127.0.0.1 www.forums.digitaltrends.com
    127.0.0.1 ewido.net
    127.0.0.1 www.ewido.net
    127.0.0.1 geekstogo.com
    127.0.0.1 www.geekstogo.com
    127.0.0.1 forum.idg.pl
    127.0.0.1 www.forum.idg.pl
    127.0.0.1 lavasoftsupport.com
    127.0.0.1 www.lavasoftsupport.com
    127.0.0.1 help.lockergnome.com
    127.0.0.1 www.help.lockergnome.com
    127.0.0.1 forums.majorgeeks.com
    127.0.0.1 majorgeeks.com
    127.0.0.1 www.forums.majorgeeks.com
    127.0.0.1 www.majorgeeks.com
    127.0.0.1 download.microsoft.com
    127.0.0.1 downloads.microsoft.com
    127.0.0.1 go.microsoft.com
    127.0.0.1 microsoft.com
    127.0.0.1 msdn.microsoft.com
    127.0.0.1 office.microsoft.com
    127.0.0.1 support.microsoft.com
    127.0.0.1 windowsupdate.microsoft.com
    127.0.0.1 www.download.microsoft.com
    127.0.0.1 www.downloads.microsoft.com
    127.0.0.1 www.go.microsoft.com
    127.0.0.1 www.microsoft.com
    127.0.0.1 www.msdn.microsoft.com
    127.0.0.1 www.office.microsoft.com
    127.0.0.1 www.support.microsoft.com
    127.0.0.1 www.windowsupdate.microsoft.com
    127.0.0.1 update.microsoft.com
    127.0.0.1 www.update.microsoft.com
    127.0.0.1 mytechsupport.ca
    127.0.0.1 www.mytechsupport.ca
    127.0.0.1 pandasoftware.com
    127.0.0.1 www.pandasoftware.com
    127.0.0.1 fileinfo.prevx.com
    127.0.0.1 prevx.com
    127.0.0.1 virusinfo.prevx.com
    127.0.0.1 www.fileinfo.prevx.com
    127.0.0.1 www.prevx.com
    127.0.0.1 www.virusinfo.prevx.com
    127.0.0.1 cleanup.stevengould.org
    127.0.0.1 stevengould.org
    127.0.0.1 www.cleanup.stevengould.org
    127.0.0.1 www.stevengould.org
    127.0.0.1 research.sunbelt-software.com
    127.0.0.1 sunbelt-software.com
    127.0.0.1 www.research.sunbelt-software.com
    127.0.0.1 www.sunbelt-software.com
    127.0.0.1 superantispyware.com
    127.0.0.1 www.superantispyware.com
    127.0.0.1 forums.techguy.org
    127.0.0.1 techguy.org
    127.0.0.1 www.forums.techguy.org
    127.0.0.1 www.techguy.org
    127.0.0.1 techsupportforum.com
    127.0.0.1 www.techsupportforum.com
    127.0.0.1 forums.tomcoyote.org
    127.0.0.1 tomcoyote.org
    127.0.0.1 www.forums.tomcoyote.org
    127.0.0.1 www.tomcoyote.org
    127.0.0.1 wilderssecurity.com
    127.0.0.1 www.wilderssecurity.com

    »»»»»»»»»»»»»»»»»»»»»»»» C:\

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Compaq_Administrator

    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Compaq_Administrator\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\COMPAQ~1\FAVORI~1

    C:\DOCUME~1\COMPAQ~1\FAVORI~1\Online Security Test.url FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    C:\Program Files\Helper\ FOUND !
    C:\Program Files\Video Add-on\ FOUND !
    C:\Program Files\VirusProtect 3.9\ FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="My Current Home Page"

    »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
    !!!Attention, following keys are not inevitably infected!!!

    o4Patch
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
    !!!Attention, following keys are not inevitably infected!!!

    Agent.OMZ.Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
    !!!Attention, following keys are not inevitably infected!!!

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{0123eb75-964c-4cb3-b796-431cc9099570}"="disgorging"

    [HKEY_CLASSES_ROOT\CLSID\{0123eb75-964c-4cb3-b796-431cc9099570}\InProcServer32]
    @="C:\WINDOWS\system32\cjuvwa.dll"

    [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0123eb75-964c-4cb3-b796-431cc9099570}\InProcServer32]
    @="C:\WINDOWS\system32\cjuvwa.dll"

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

    »»»»»»»»»»»»»»»»»»»»»»»» RK

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
    DNS Server Search Order: 16.92.3.242
    DNS Server Search Order: 16.92.3.243
    DNS Server Search Order: 16.81.3.243
    DNS Server Search Order: 16.118.3.243

    Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
    DNS Server Search Order: 192.168.2.1

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{9908A0FE-29E2-4950-BE56-A40DE4AD9744}: DhcpNameServer=192.168.2.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{9908A0FE-29E2-4950-BE56-A40DE4AD9744}: DhcpNameServer=192.168.2.1
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1

    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

    »»»»»»»»»»»»»»»»»»»»»»»» End
    0
  13. kevin05 Messages postés 3814 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
     
    Bien

    Dans l'ordre :

    Télécharge HostXpert sur ton Bureau :

    ---> Décompresse-le (Clic droit >> Extraire ici)

    ---> Double-clique sur HostsXpert pour le lancer

    ---> clique sur le bouton "Restore MS Hosts File" puis ferme le programme

    PS : Avant de cliquer sur le bouton "Restore MS Hosts File", vérifie que le cadenas en haut à gauche est ouvert sinon tu vas avoir un message d'erreur.

    - Redemarres le pc en mode sans echec :

    ---> au demarrage du pc, tapotes sur la touche F5 ou F8 de ton clavier, juste aprés le bip du bios et avant l'apparition du logo windows

    --> un ecran noir avec plusieurs options apparaitra, choisis " mode sans echec " et valides par la touche " Entrée " de ton clavier

    --> Une fois en MSE, relances Smitfraudfix et choisis cette fois l'option2

    --> réponds oui aux questions et laisses l'outil travailler

    --> un rapport sera généré à la fin du scan, postes son contenu.

    0
  14. mido2
     
    Voici le rapport apres la derniere manip:

    mais le probleme est toujours la, l'image toujours sort pour que je puisse scanner et m'inscrire pour acheter l'antivirus plus !!
    --------

    SmitFraudFix v2.423

    Scan done at 21:14:51,28, 2009-07-08
    Run from C:\Documents and Settings\Compaq_Administrator\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{0123eb75-964c-4cb3-b796-431cc9099570}"="disgorging"

    [HKEY_CLASSES_ROOT\CLSID\{0123eb75-964c-4cb3-b796-431cc9099570}\InProcServer32]
    @="C:\WINDOWS\system32\cjuvwa.dll"

    [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0123eb75-964c-4cb3-b796-431cc9099570}\InProcServer32]
    @="C:\WINDOWS\system32\cjuvwa.dll"

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    127.0.0.1 00119922.com
    127.0.0.1 098765.com
    127.0.0.1 1.iitsv65.bij.pl
    127.0.0.1 1.iitsv66.bij.pl
    127.0.0.1 1.iitsv67.orge.pl
    127.0.0.1 1.iitsv68.orge.pl
    127.0.0.1 1.iitsv69.orge.pl
    127.0.0.1 1.iitsv70.orge.pl
    127.0.0.1 1.iitsv71.345.pl
    127.0.0.1 1.iitsv72.345.pl
    127.0.0.1 1.iitsv73.345.pl
    ...

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

    S!Ri's WS2Fix: LSP not Found.

    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\DOCUME~1\COMPAQ~1\FAVORI~1\Online Security Test.url Deleted
    C:\Program Files\Helper\ Deleted
    C:\Program Files\Video Add-on\ Deleted
    C:\Program Files\VirusProtect 3.9\ Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

    Agent.OMZ.Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» RK

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{9908A0FE-29E2-4950-BE56-A40DE4AD9744}: DhcpNameServer=192.168.2.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{9908A0FE-29E2-4950-BE56-A40DE4AD9744}: DhcpNameServer=192.168.2.1
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{9908A0FE-29E2-4950-BE56-A40DE4AD9744}: DhcpNameServer=192.168.2.1
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1

    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» RK.2

    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» End
    0
  15. kevin05 Messages postés 3814 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
     
    Poste un nouveau Hijackthis stp
    0
  16. mido2
     
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:28:27, on 2009-07-08
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16850)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Athan\Athan.exe
    C:\Program Files\DISC\DISCover.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system\rundll32.exe
    C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\program files\freecall.com\freecall\freecall.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
    C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\HP\Digital Imaging\bin\hpoevm08.exe
    C:\WINDOWS\arservice.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Trend Micro\BM\TMBMSRV.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\HP\Digital Imaging\Bin\hpoSTS08.exe
    C:\Program Files\DISC\DiscStreamHub.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
    O1 - Hosts: 78.159.125.53 www.google.com
    O1 - Hosts: 78.159.125.53 www.google.de
    O1 - Hosts: 78.159.125.53 www.google.fr
    O1 - Hosts: 78.159.125.53 www.google.co.uk
    O1 - Hosts: 78.159.125.53 www.google.com.br
    O1 - Hosts: 78.159.125.53 www.google.it
    O1 - Hosts: 78.159.125.53 www.google.es
    O1 - Hosts: 78.159.125.53 www.google.co.jp
    O1 - Hosts: 78.159.125.53 www.google.com.mx
    O1 - Hosts: 78.159.125.53 www.google.ca
    O1 - Hosts: 78.159.125.53 www.google.com.au
    O1 - Hosts: 78.159.125.53 www.google.nl
    O1 - Hosts: 78.159.125.53 www.google.co.za
    O1 - Hosts: 78.159.125.53 www.google.be
    O1 - Hosts: 78.159.125.53 www.google.gr
    O1 - Hosts: 78.159.125.53 www.google.at
    O1 - Hosts: 78.159.125.53 www.google.se
    O1 - Hosts: 78.159.125.53 www.google.ch
    O1 - Hosts: 78.159.125.53 www.google.pt
    O1 - Hosts: 78.159.125.53 www.google.dk
    O1 - Hosts: 78.159.125.53 www.google.fi
    O1 - Hosts: 78.159.125.53 www.google.ie
    O1 - Hosts: 78.159.125.53 www.google.no
    O1 - Hosts: 78.159.125.53 search.yahoo.com
    O1 - Hosts: 78.159.125.53 us.search.yahoo.com
    O1 - Hosts: 78.159.125.53 uk.search.yahoo.com
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
    O2 - BHO: (no name) - {B035573A-5F43-4862-A194-87D027C63012} - C:\WINDOWS\system32\InternetExplorer.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr-ca\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr-ca\msntb.dll
    O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
    O4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe nogui
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [shell] C:\WINDOWS\system\rundll32.exe Administra
    O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [FreeCall] "C:\program files\freecall.com\freecall\freecall.exe" -nosplash -minimized
    O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM')
    O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
    O4 - Global Startup: Connexions Compaq.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
    O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
    O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://*.trymedia.com (HKLM)
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Composant de commande centrale Trend Micro (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
    O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
    0
  17. kevin05 Messages postés 3814 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
     
    21:28:27,

    Nouveau qui date pas de matuzalem
    0
  18. mido2
     
    c nouveau je viens de le faire, c l'heure de mon PC actuellement
    0
  19. kevin05 Messages postés 3814 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
     
    Mais t'habite ou ?

    Scan saved at 21:28:27, on 2009-07-08

    Moi c est 4h du matin chez moi ..
    0
  21. kevin05 Messages postés 3814 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
     
    Repasse HostXpert

    Puis :

    * Télécharge Malwarebytes anti malware

    * Tu auras un tutoriel à ta disposition pour l'installer et l'utiliser correctement.

    * Fais la mise à jour du logiciel (elle se fait normalement à l'installation)

    * Lance une analyse complète en cliquant sur "Exécuter un examen complet"

    * Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"

    * L'analyse peut durer un bon moment.....

    * Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"

    * Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"

    * Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum

    0
  • 1
  • 2

Discussions similaires

Google Chrome "  Échec de l'analyse antivirus "
jmpower -
RBmoon -

18 réponses
" Échec de l'analyse antivirus " la solution.
bazfile -
bazfile -

0 réponse