Comment supprimer le thayet myo hacking day?

Rapport de ZHPDiag v1.25.1344 par Nicolas Coolman
Run by cerad at 01/04/2010 02:41:50 ã
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html

---\\ Web Browser
MSIE: Internet Explorer v6.0.2900.2180
MFIE: Mozilla Firefox (3.0.6)

---\\ System Information
Platform : Microsoft Windows XP (5.1.2600) Service Pack 2
Processor: x86 Family 15 Model 4 Stepping 9, GenuineIntel
Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 447.5 MB (43% free)
System drive C: has 0 GB (3%) free of 15 GB

---\\ DOS/Devices
A:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
C:\ Hard drive, Flash drive, Thumb drive (Free 0 Go of 15 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 24 Go of 26 Go)
E:\ Hard drive, Flash drive, Thumb drive (Free 18 Go of 20 Go)
F:\ Hard drive, Flash drive, Thumb drive (Free 14 Go of 15 Go)
G:\ CD-ROM drive (Not Inserted)


---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: Modified
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: Modified
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] DisableTaskMgr: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] DisableRegistryTools: Modified


---\\ Processus lancés
[MD5.B1674A2DB6B107E2732033456EB07026] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [275984]
[MD5.6914206041D065114DB12D13DD851645] - (.Pinball Corporation. - Hotbar Search Assistant.) -- C:\Program Files\Hotbar\bin\11.0.78.0\HotbarSA.exe [850736]
[MD5.A22F3AF22E25667C0EED49B980AFDC11] - (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [110000]
[MD5.5B24427B4ECD68ADCD5A8559A6544197] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe [1022400]
[MD5.1B8A2F7D7283BD75C1F7443F8E85F559] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS1\BackUp\explorer.exe [319488]
[MD5.ECFF67C3B3B22BE1D608F267C0CC9BF8] - (.Pas de propriétaire - DivX Update.) -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1217832]
[MD5.5D61BE7DB55B026A5D61A3EED09D0EAD] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408]
[MD5.5584247B568C2E53934873F4B655FE6A] - (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS1\system32\ctfmon.exe [15360]
[MD5.083F77A6AE1C803F906FA7887BFC0ED1] - (.Yahoo! Inc. - Yahoo! Messenger.) -- C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe [5326136]
[MD5.1BD6C2F707A275CB7C16FD99FE0F31CA] - (.Microsoft Corporation - Generic Host Process for Win32 Services.) -- C:\WINDOWS1\system32\svchost.exe [14336]
[MD5.732E0B1ABAACE15D80EC19056B0A2AF9] - (.Microsoft Corporation - Applications Services et Contrôleur.) -- C:\WINDOWS1\system32\services.exe [108544]
[MD5.985B46D43A75D5C0778013B8B488F5D3] - (.Google Inc. - Programme d'installation de Google.) -- C:\Program Files\Google\Update\GoogleUpdate.exe [210928]
[MD5.065A2FAF58EF0DEF9EA69C500E64F9B3] - (.Microsoft Corporation - Machine Debug Manager.) -- C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.exe [395848]
[MD5.9F3744A5C6F49291A7A685040A013399] - (.Microsoft Corporation - LSA Shell (Export Version).) -- C:\WINDOWS1\system32\lsass.exe [13312]
[MD5.B4EF928E4FAD79364A80ACBA6D999934] - (.Microsoft Corporation - Spooler SubSystem App.) -- C:\WINDOWS1\system32\spoolsv.exe [57856]


---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\WINDOWS1\system32\userinit.exe,


---\\ Pages de recherche d'Internet Explorer (R1)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html


---\\ Internet Explorer URLSearchHook (R3)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Bibliothèque d'objets et de contrôles de do.) (No version) -- %SystemRoot%\system32\shdocvw.dll
R3 - URLSearchHook: Microsoft Url Search Hook - {2cdcbcf7-7969-43f5-ac59-91ded800eddf} . (.Pas de propriétaire - Pas de description.) (No version) -- (.not file.)
R3 - URLSearchHook: Microsoft Url Search Hook - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} . (.Conduit Ltd. - Conduit Toolbar.) (5, 3, 4, 2) -- C:\Program Files\Eazel-FR\tbEaze.dll


---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} . (.SmartShopper Networks - Pas de description.) -- C:\Program Files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} . (.Skype Technologies S.A. - Skype add-on for IE.) -- C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} . (.RealPlayer - RealPlayer Download and Record Plugin for I.) -- C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} . (.Pinball Corporation. - Hotbar.) -- C:\Program Files\Hotbar\bin\11.0.78.0\HostIE.dll
O2 - BHO: Eazel-FR Toolbar - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\Eazel-FR\tbEaze.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Pas de propriétaire - Pas de description.) -- (.not file.)


---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) - {2cdcbcf7-7969-43f5-ac59-91ded800eddf} . (.Pas de propriétaire - Pas de description.) --
O3 - Toolbar: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} . (.Pinball Corporation. - Hotbar.) -- C:\Program Files\Hotbar\bin\11.0.78.0\HostIE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Eazel-FR Toolbar - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\Eazel-FR\tbEaze.dll


---\\ Applications démarrées automatiquement par le registre (O4)
O4 - HKLM\..\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
O4 - HKLM\..\Run: [HotbarSA] . (.Pinball Corporation. - Hotbar Search Assistant.) -- C:\Program Files\Hotbar\bin\11.0.78.0\HotbarSA.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Run: [explorer] . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS1\BackUp\explorer.exe
O4 - HKLM\..\Run: [DivXUpdate] . (.Pas de propriétaire - DivX Update.) -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS1\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] . (.Yahoo! Inc. - Yahoo! Messenger.) -- C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk . (.Adobe Systems Incorporated - Adobe Collaboration Synchronizer 8.2.) -- C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe


---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: E&xporter vers Microsoft Excel - (.not file.) - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.exe
O8 - Extra context menu item: Google Sidewiki... . (.Google Inc. - Google Toolbar for Internet Explorer.) -- C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll


---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} . (.Pas de propriétaire - Pas de description.) -- C:\PROGRA~1\Skype\Toolbars\INTERN~1\favicon.ico
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} . (.SmartShopper Networks - Pas de description.) -- C:\Program Files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} . (.SmartShopper Networks - Pas de description.) -- C:\Program Files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.not file.) - C:\Program Files\Messenger\msmsgs.exe


---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS1\system32\mswsock.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS1\system32\winrnr.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS1\system32\mswsock.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Service client pour le fournisseur NetWare et DLL d'authentification.) -- C:\WINDOWS1\system32\nwprovau.dll


---\\ Piratage de l'Option 'Rétablir les paramètres Web' (O14)
O14 - IERESET.INF: START_PAGE_URL=START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php


---\\ Protocole additionnel et piratage de protocole (O18)
O18 - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} . (.Skype Technologies - Skype for COM API.) -- C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL


---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSODL) (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS1\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS1\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Contrôleur de site Web.) -- C:\WINDOWS1\system32\webcheck.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Objet du service d'environnement Systray.) -- C:\WINDOWS1\system32\stobject.dll
O21 - SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} . (.Microsoft Corporation - Moniteur et dossier UPNP Tray.) -- C:\WINDOWS1\system32\upnpui.dll


---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS1\system32\browseui.dll


---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe



End of the scan (154 lines in :0mn Õs)

http://www.cijoint.fr/cjlink.php?file=cj201010/cijC28VZNF.txt

j'ai besoin d'aide svp. J'ai suivi les instructions et voici le lien

http://www.cijoint.fr/cjlink.php?file=cj201101/cijlPxV6P4.txt

http://www.cijoint.fr/cjlink.php?file=cj201107/cijzowcnti.txt

c'est toi qui raconte n'importe quoi.

on peut se protéger efficacement gratuitement.

Inversement, j'ai vu des machines infectées avec des AV payant, y compris Kaspersky.

====

Et l'antivirus ne suffit pas, un parefeu "efficace" et un antispyware (utilisé de temps en temps) sont nécessaires.