Rapport hijackthis
Bonjour, qui pourrais me dire si mon pc est infecté?
Ci-joint rapport hijackthis que je viens de réaliser.Merci d'avance
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:57:29, on 22/07/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Glary Utilities\memdefrag.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\IncrediMail\Bin\ImApp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q304&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q304&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.hugedomains.com/domain_profile.cfm?d=cooxer&e=com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoBho - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Glary Memory Optimizer] "C:\Program Files\Glary Utilities\memdefrag.exe" /autostart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O12 - Plugin for .m1v: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-1f0e8508fc1f62f4.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} - http://kit.carpediem.fr/14005/CD/AnalEclate.exe
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} - http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service de sécurité matérielle (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Ci-joint rapport hijackthis que je viens de réaliser.Merci d'avance
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:57:29, on 22/07/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Glary Utilities\memdefrag.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\IncrediMail\Bin\ImApp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q304&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q304&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.hugedomains.com/domain_profile.cfm?d=cooxer&e=com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoBho - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Glary Memory Optimizer] "C:\Program Files\Glary Utilities\memdefrag.exe" /autostart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O12 - Plugin for .m1v: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-1f0e8508fc1f62f4.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} - http://kit.carpediem.fr/14005/CD/AnalEclate.exe
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} - http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service de sécurité matérielle (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
44 réponses
Résumé de la discussion
Un rapport HijackThis réalisé sur un PC Windows XP SP3 avec Internet Explorer 7 signale de nombreuses entrées potentiellement indésirables et interroge sur une infection. Plusieurs conseils recommandent d'exécuter un outil de nettoyage tiers, tel Lop S&D, afin d'analyser le système et de générer un nouveau rapport après le redémarrage. Des éléments signalés incluent des barres d'outils et des modules tiers attachés aux pages de démarrage, des BHO et des URLSearchHook, ainsi que des services Avast et Google Update présents dans les listes. En complément, certains éléments de sauvegarde montrent des rapports de quarantine et des fichiers .vir, indiquant une activité suspecte mais nécessitant une vérification plus approfondie.
-
re,
pour répondre aux messages, merci de cliquer sur le carré vert en dessous de mon message.
ceci évitera de créer des postes en doublon !!!
tu as une inection par askbardis et une autre ...
EDIT :
désinstalle spybot et Adaware, ils sont obsolètes !!!
* Télécharge de AD-Remover sur ton Bureau. (Merci à C_XX)
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe
Miroir:
https://www.androidworld.fr/
/!\ Ferme toutes applications en cours /!\
- Double-clique sur l'icône Ad-remover située sur ton Bureau.
- Sur la page, clique sur le bouton « Nettoyer »
- Confirme lancement du scan
- Laisse travailler l'outil.
- Poste le rapport qui apparaît à la fin.
(Le rapport est sauvegardé aussi sous C:\Ad-report(Scan/clean).Txt)
(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)
O.o°*??? Membre, Contributeur Sécurité CCM o°.Oø¤º°'°º¤ø -
* Salut
Continues Electricien 69
Pas de probs !!
Membre Contributeur sécurité CCM
Windows Vista // Windows XP-
-
======= RAPPORT D'AD-REMOVER 2.0.0.1,D | UNIQUEMENT XP/VISTA/7 =======
Mis à jour par C_XX le 21/07/10 à 14:00
Contact: AdRemover.contact[AT]gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 20:24:07 le 22/07/2010, Mode normal
Microsoft Windows XP Édition familiale Service Pack 3 (X86)
Propriétaire@NOM-D4VT2HUY1MA ( )
============== ACTION(S) ==============
0,Fichier supprimé: C:\Program Files\Mozilla FireFox\Components\AskSearch.js
0,Dossier supprimé: C:\Program Files\AskSearch
0,Dossier supprimé: C:\Documents and Settings\Propriétaire\Application Data\EoRezo
0,Dossier supprimé: C:\Program Files\iMesh Applications
(!) -- Fichiers temporaires supprimés.
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
0,Clé supprimée: HKLM\Software\Classes\EoRezoBHO.EoBHO
0,Clé supprimée: HKLM\Software\Classes\EoRezoBHO.EoBHO.1
0,Clé supprimée: HKLM\Software\Classes\AppID\EoRezoBHO.DLL
1,Clé supprimée: HKLM\Software\Classes\AppID\{362A53B2-2913-4F8A-82F5-7E0A23FDC6F9}
0,Clé supprimée: HKLM\Software\AskBarDis
0,Clé supprimée: HKLM\Software\EoRezo
0,Clé supprimée: HKCU\Software\EoRezo
0,Clé supprimée: HKCU\Software\iMesh
0,Clé supprimée: HKCU\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FEF22E989A11FC64DA8EBAA19A0851D12A40D3D2
0,Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{C94E154B-1459-4A47-966B-4B843BEFC7DB}
============== SCAN ADDITIONNEL ==============
** Mozilla Firefox Version [3.5.9 (fr)] **
-- C:\Documents and Settings\Propriétaire\Application Data\Mozilla\FireFox\Profiles\nfg3p5ec.default\Prefs.js --
browser.search.selectedEngine, MyStart Rechercher
browser.startup.homepage, hxxp://mystart.incredimail.com/
browser.startup.homepage_override.mstone, rv:1.9.1.9
browser.search.defaultenginename, MyStart Rechercher
keyword.URL, hxxp://mystart.incredimail.com/?loc=ff_address_bar_im2_test_v2&search
-
-
désinstalle spybot et Adaware, ils sont obsolètes !!!
relance ADR, clique sur désinstaller,
* Télécharge ZHPDiag sur ton bureau :
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html
* Laisse toi guider lors de l'installation, il se lancera automatiquement à la fin.
* Clique sur l'icône représentant une loupe (« Lancer le diagnostic »)
* Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette
* Héberge le rapport ZHPDiag.txt sur Cijoint, puis copie/colle le lien fourni dans ta prochaine réponse sur le forum :
http://www.cijoint.fr/
-
ok,j'ai éssayé de faire le plus rapidement,mais suis pas un pro....Merci a toi!
-
http://www.cijoint.fr/cjlink.php?file=cj201007/cijUhTSEvv.txt
-
Télécharge Lop S&D (créé par eric 71) sur ton Bureau :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2
* Double-clique dessus pour lancer l'installation
* Double-clique sur le raccourci Lop S&D présent sur ton Bureau
* Sélectionne la langue souhaitée, puis choisis l'option 1 (Recherche)
* Patiente jusqu'à la fin du scan
* Poste le rapport généré
* Réactive ton antivirus
Tutorial pour t'aider : http://www.malekal.com//tutorial_Lop_SD.php
-
Désolé,mais seul le tableau avec les langues est affiché,et rien ne se passe aprés avoir cliqué sur "francais".Pas de proposition d'option,rien aprés plusieurs tentatives..Je sais pas trop quoi faire...
-
ca y est,j'ai trouvé comment ca marche,le scan est en route....
-
--------------------\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : BIOS Date: 07/26/04 10:57:57 Ver: 08.00.09
USER : Propriétaire ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1368 [VPS 100722-0] 4.8.1368 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:108 Go (Free:86 Go)
D:\ (Local Disk) - FAT32 - Total:3 Go (Free:0 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 22/07/2010|22:33 )
--------------------\\ Listing des dossiers dans APPLIC~1
[07/05/2010|08:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\3A186
[29/05/2008|22:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[22/07/2010|18:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
[24/04/2010|08:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ArcSoft
[31/01/2006|17:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
[22/07/2010|18:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[30/11/2005|12:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
[21/08/2008|07:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IM
[20/08/2008|23:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IncrediMail
[01/01/2004|18:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InterVideo
[22/07/2010|20:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[12/07/2010|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[11/11/2008|18:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
[01/01/2004|18:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
[29/11/2004|20:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[08/02/2009|10:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NortonInstaller
[23/01/2005|20:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[14/03/2010|19:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
[01/01/2004|16:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[22/07/2010|20:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[07/04/2010|14:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sun
[01/07/2006|08:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[06/03/2008|22:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[18/11/2007|20:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\yahoo!
[22/07/2010|18:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[01/01/2004|16:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[01/01/2004|18:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intervideo
[01/01/2004|17:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[01/01/2004|19:26] C:\DOCUME~1\DEFAUL~1\APPLIC~1\SampleView
[01/01/2004|17:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
[01/01/2004|23:21] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[12/07/2006|21:59] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
[01/01/2004|16:49] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[01/01/2004|16:49] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[28/01/2008|18:27] C:\DOCUME~1\PROPRI~1\APPLIC~1\Adobe
[12/07/2006|21:42] C:\DOCUME~1\PROPRI~1\APPLIC~1\AdobeAUM
[29/05/2008|22:01] C:\DOCUME~1\PROPRI~1\APPLIC~1\AdobeUM
[19/02/2005|22:19] C:\DOCUME~1\PROPRI~1\APPLIC~1\Ahead
[17/11/2004|22:02] C:\DOCUME~1\PROPRI~1\APPLIC~1\Apple Computer
[24/04/2010|08:21] C:\DOCUME~1\PROPRI~1\APPLIC~1\ArcSoft
[11/11/2008|11:18] C:\DOCUME~1\PROPRI~1\APPLIC~1\Babylon
[23/02/2009|21:11] C:\DOCUME~1\PROPRI~1\APPLIC~1\GlarySoft
[02/06/2006|21:06] C:\DOCUME~1\PROPRI~1\APPLIC~1\Google
[18/11/2005|09:25] C:\DOCUME~1\PROPRI~1\APPLIC~1\Help
[01/01/2004|16:47] C:\DOCUME~1\PROPRI~1\APPLIC~1\Identities
[10/04/2005|00:36] C:\DOCUME~1\PROPRI~1\APPLIC~1\Intervideo
[18/01/2010|11:52] C:\DOCUME~1\PROPRI~1\APPLIC~1\Lavasoft
[11/01/2005|00:11] C:\DOCUME~1\PROPRI~1\APPLIC~1\Leadertech
[22/07/2010|20:52] C:\DOCUME~1\PROPRI~1\APPLIC~1\LimeWire
[20/06/2010|11:39] C:\DOCUME~1\PROPRI~1\APPLIC~1\Macromedia
[21/09/2009|17:29] C:\DOCUME~1\PROPRI~1\APPLIC~1\Microsoft
[14/11/2004|20:44] C:\DOCUME~1\PROPRI~1\APPLIC~1\Motive
[10/05/2010|23:23] C:\DOCUME~1\PROPRI~1\APPLIC~1\Mozilla
[21/08/2007|22:27] C:\DOCUME~1\PROPRI~1\APPLIC~1\MSN6
[27/05/2006|23:59] C:\DOCUME~1\PROPRI~1\APPLIC~1\Nikon
[29/09/2007|10:44] C:\DOCUME~1\PROPRI~1\APPLIC~1\Radios Media Player
[14/03/2010|18:47] C:\DOCUME~1\PROPRI~1\APPLIC~1\Real
[01/01/2004|19:26] C:\DOCUME~1\PROPRI~1\APPLIC~1\SampleView
[05/05/2010|16:06] C:\DOCUME~1\PROPRI~1\APPLIC~1\Skype
[11/01/2005|00:12] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sonic
[01/01/2004|17:28] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sun
[28/11/2004|19:19] C:\DOCUME~1\PROPRI~1\APPLIC~1\Template
[20/02/2010|10:54] C:\DOCUME~1\PROPRI~1\APPLIC~1\vlc
[18/11/2007|20:30] C:\DOCUME~1\PROPRI~1\APPLIC~1\Yahoo!
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[22/07/2010 20:51][--a------] C:\WINDOWS\tasks\Registry Reviver-Propri'taire-Startup.job
[22/07/2010 22:00][--a------] C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1928470191-689273047-2217071835-1003.job
[22/07/2010 22:00][--a------] C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1928470191-689273047-2217071835-1003.job
[22/07/2010 22:06][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[22/07/2010 20:51][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[22/07/2010 20:26][--a------] C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[22/07/2010 20:51][--a------] C:\WINDOWS\tasks\GlaryInitialize.job
[12/02/2004 13:27][-rah-----] C:\WINDOWS\tasks\desktop.ini
[22/07/2010 20:51][--ah-----] C:\WINDOWS\tasks\SA.DAT
--------------------\\ Listing des dossiers dans C:\Program Files
[22/07/2010|18:18] C:\Program Files\Adobe
[22/07/2010|20:29] C:\Program Files\Ad-Remover
[28/11/2004|16:13] C:\Program Files\ADSL Autoconnect
[10/03/2009|15:55] C:\Program Files\Ahead
[11/11/2008|19:42] C:\Program Files\Alwil Software
[24/04/2010|08:25] C:\Program Files\ArcSoft
[09/09/2004|06:06] C:\Program Files\ATI Technologies
[12/07/2008|11:02] C:\Program Files\BufferZone
[27/11/2004|22:28] C:\Program Files\Common Files
[28/11/2004|18:54] C:\Program Files\DivX
[31/01/2006|17:23] C:\Program Files\DVD Shrink
[28/11/2004|16:33] C:\Program Files\Easy Internet signup
[22/07/2010|18:18] C:\Program Files\eMule
[22/07/2010|18:18] C:\Program Files\Fichiers communs
[28/05/2010|20:04] C:\Program Files\FreeTime
[07/04/2009|14:35] C:\Program Files\Glary Utilities
[22/07/2010|19:06] C:\Program Files\Google
[30/11/2005|12:24] C:\Program Files\Hewlett-Packard
[11/11/2008|10:16] C:\Program Files\HP
[20/06/2010|20:29] C:\Program Files\IncrediMail
[22/07/2010|18:18] C:\Program Files\InstallShield Installation Information
[22/07/2010|18:18] C:\Program Files\Internet Explorer
[22/07/2010|18:18] C:\Program Files\InterVideo
[01/01/2004|18:35] C:\Program Files\iPod
[01/01/2004|18:35] C:\Program Files\iTunes
[26/05/2010|08:24] C:\Program Files\Java
[22/07/2010|20:49] C:\Program Files\Lavasoft
[05/05/2010|12:18] C:\Program Files\LimeWire
[08/02/2009|11:47] C:\Program Files\Messenger
[21/09/2009|17:22] C:\Program Files\Microsoft
[08/03/2008|13:57] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[01/01/2004|16:47] C:\Program Files\microsoft frontpage
[11/11/2008|18:10] C:\Program Files\Microsoft Office
[12/07/2010|20:42] C:\Program Files\Microsoft Silverlight
[21/09/2009|17:22] C:\Program Files\Microsoft Sync Framework
[02/03/2009|23:16] C:\Program Files\Microsoft Works
[10/03/2010|22:30] C:\Program Files\Movie Maker
[06/06/2010|12:35] C:\Program Files\Mozilla Firefox
[13/03/2008|21:52] C:\Program Files\MP3 Player Utilities 4.18
[03/02/2008|21:38] C:\Program Files\MSECache
[30/12/2006|20:02] C:\Program Files\MSN
[01/01/2004|16:43] C:\Program Files\MSN Gaming Zone
[28/11/2004|17:28] C:\Program Files\MSN Messenger(2)
[30/12/2004|23:09] C:\Program Files\MSN Messenger(3)
[12/07/2008|09:51] C:\Program Files\Multi_Media_France
[23/12/2008|10:27] C:\Program Files\MUSICMATCH
[22/08/2008|11:52] C:\Program Files\NetMeeting
[29/05/2006|09:29] C:\Program Files\Nikon
[30/01/2005|18:39] C:\Program Files\Oberon Media
[19/01/2005|19:25] C:\Program Files\Ontrack
[12/05/2010|09:37] C:\Program Files\Outlook Express
[02/12/2005|09:52] C:\Program Files\Overland
[11/02/2008|19:32] C:\Program Files\PC Camera
[22/07/2010|18:18] C:\Program Files\Presario PC Help
[01/01/2004|18:35] C:\Program Files\QuickTime
[14/03/2010|18:45] C:\Program Files\Real
[14/11/2004|10:32] C:\Program Files\RecordNow!
[27/11/2005|19:58] C:\Program Files\ReflexiveArcade
[26/11/2004|18:58] C:\Program Files\SAGEM
[12/07/2008|11:02] C:\Program Files\securedie
[01/01/2004|19:03] C:\Program Files\Services en ligne
[28/11/2004|17:59] C:\Program Files\Skype
[14/11/2004|10:32] C:\Program Files\Sonic
[22/07/2010|20:51] C:\Program Files\Spybot - Search & Destroy
[28/07/2008|19:00] C:\Program Files\Sun
[13/12/2004|22:48] C:\Program Files\THQ
[22/07/2010|21:30] C:\Program Files\Trend Micro
[01/01/2004|18:18] C:\Program Files\Uninstall Information
[22/07/2010|18:18] C:\Program Files\Wanadoo
[08/02/2009|11:47] C:\Program Files\Wanadoo Messager
[11/11/2008|18:05] C:\Program Files\Web Hottest Videos Personal Player
[21/09/2009|17:23] C:\Program Files\Windows Live
[21/09/2009|17:21] C:\Program Files\Windows Live SkyDrive
[21/09/2009|17:23] C:\Program Files\Windows Live Toolbar
[08/02/2009|11:47] C:\Program Files\Windows Media Connect 2
[22/07/2010|18:18] C:\Program Files\Windows Media Player
[22/08/2008|11:52] C:\Program Files\Windows NT
[22/11/2004|03:25] C:\Program Files\WindowsUpdate
[07/12/2009|15:56] C:\Program Files\WinRAR
[01/01/2004|16:47] C:\Program Files\xerox
[28/04/2009|11:28] C:\Program Files\XviD
[18/11/2007|20:28] C:\Program Files\Yahoo!
[24/03/2008|18:50] C:\Program Files\YesMessenger
[22/07/2010|21:00] C:\Program Files\ZHPDiag
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[29/05/2008|22:03] C:\Program Files\Fichiers communs\Adobe
[19/01/2005|16:58] C:\Program Files\Fichiers communs\Ahead
[24/04/2010|08:25] C:\Program Files\Fichiers communs\ArcSoft
[30/11/2005|12:22] C:\Program Files\Fichiers communs\Hewlett-Packard
[30/11/2005|12:27] C:\Program Files\Fichiers communs\HP
[13/12/2004|22:45] C:\Program Files\Fichiers communs\InstallShield
[07/04/2010|14:32] C:\Program Files\Fichiers communs\Java
[05/03/2009|21:50] C:\Program Files\Fichiers communs\Microsoft Shared
[01/01/2004|16:44] C:\Program Files\Fichiers communs\MSSoap
[29/05/2006|09:29] C:\Program Files\Fichiers communs\Nikon
[22/01/2005|22:55] C:\Program Files\Fichiers communs\Oberon Media
[11/02/2008|19:32] C:\Program Files\Fichiers communs\PAC207
[14/03/2010|18:46] C:\Program Files\Fichiers communs\Real
[13/09/2004|16:46] C:\Program Files\Fichiers communs\Services
[14/11/2004|10:32] C:\Program Files\Fichiers communs\Sonic
[01/01/2004|16:40] C:\Program Files\Fichiers communs\SpeechEngines
[14/11/2004|10:32] C:\Program Files\Fichiers communs\SureThing Shared
[22/08/2008|11:52] C:\Program Files\Fichiers communs\System
[21/09/2009|17:13] C:\Program Files\Fichiers communs\Windows Live
[06/03/2008|22:03] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[08/12/2009|16:44] C:\Program Files\Fichiers communs\Wise Installation Wizard
[14/03/2010|18:45] C:\Program Files\Fichiers communs\xing shared
--------------------\\ Process
( 56 Processes )
iexplore.exe ~ [PID:1000]
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
C:\Program Files\Multi_Media_France
C:\Program Files\Multi_Media_France\INSTALL.LOG
C:\Program Files\Multi_Media_France
C:\Program Files\Multi_Media_France\INSTALL.LOG
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@advertstream[1].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@advertstream[2].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@advertstream[3].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@advertstream[4].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@d2.advertserve[1].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@d2.advertserve[2].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@imagevenue.advertserve[2].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@imagevenue.advertserve[3].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@imagevenue.advertserve[4].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@go.galaplayer[2].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@banner.cotedazurpalace[1].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@banner.cotedazurpalace[3].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@cotedazurpalace[1].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@go.galaplayer[2].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@banner.32vegas[1].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@2xmoinscher[1].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@2xmoinscher[2].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@www.2xmoinscher[1].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@www.2xmoinscher[2].txt
C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@888[2].txt
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-22 22:34:25
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 897
--------------------\\ Recherche d'autres infections
--------------------\\ Cracks & Keygens ..
C:\DOCUME~1\ALLUSE~1\Menu D'marrer\Programmes\Lavasoft\Ad-Aware 2007\Crack
C:\DOCUME~1\ALLUSE~1\Menu D'marrer\Programmes\Lavasoft\Ad-Aware 2007\Crack\Ad-Aware2007.exe
C:\DOCUME~1\ALLUSE~1\Menu D'marrer\Programmes\Lavasoft\Ad-Aware 2007\Crack\Ad-Watch2007.exe
[F:261][D:40]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
[F:7505][D:0]-> C:\DOCUME~1\PROPRI~1\Cookies
[F:2513][D:18]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - 22/07/2010|22:36 - Option : [1]
--------------------\\ Fin du rapport a 22:36:54 -
bonjour,
supprime ces cacks :
C:\DOCUME~1\ALLUSE~1\Menu D'marrer\Programmes\Lavasoft\Ad-Aware 2007\Crack
C:\DOCUME~1\ALLUSE~1\Menu D'marrer\Programmes\Lavasoft\Ad-Aware 2007\Crack\Ad-Aware2007.exe
C:\DOCUME~1\ALLUSE~1\Menu D'marrer\Programmes\Lavasoft\Ad-Aware 2007\Crack\Ad-Watch2007.exe
relance Lop s&d, passe à l'option 2, si tu as besoin d'aide, voici le tuto :
Tutorial pour t'aider : http://www.malekal.com//tutorial_Lop_SD.php
-
--------------------\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : BIOS Date: 07/26/04 10:57:57 Ver: 08.00.09
USER : Propriétaire ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1368 [VPS 100722-0] 4.8.1368 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:108 Go (Free:86 Go)
D:\ (Local Disk) - FAT32 - Total:3 Go (Free:0 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 23/07/2010|10:44 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION
Supprime! - C:\Program Files\Multi_Media_France\INSTALL.LOG
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@advertstream[1].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@advertstream[2].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@advertstream[3].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@advertstream[4].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@d2.advertserve[1].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@d2.advertserve[2].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@imagevenue.advertserve[2].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@imagevenue.advertserve[3].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@imagevenue.advertserve[4].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@go.galaplayer[2].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@banner.cotedazurpalace[1].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@banner.cotedazurpalace[3].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@cotedazurpalace[1].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@banner.32vegas[1].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@2xmoinscher[1].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@2xmoinscher[2].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@www.2xmoinscher[1].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@www.2xmoinscher[2].txt
Supprime! - C:\DOCUME~1\PROPRI~1\Cookies\propriétaire@888[2].txt
Supprime! - C:\Program Files\Multi_Media_France
-
[ Fichier Hosts ] .. Restaure!
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing des dossiers dans APPLIC~1
[07/05/2010|08:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\3A186
[29/05/2008|22:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[22/07/2010|18:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
[24/04/2010|08:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ArcSoft
[31/01/2006|17:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
[22/07/2010|18:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[30/11/2005|12:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
[21/08/2008|07:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IM
[20/08/2008|23:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IncrediMail
[01/01/2004|18:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InterVideo
[22/07/2010|20:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[12/07/2010|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[11/11/2008|18:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
[01/01/2004|18:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
[29/11/2004|20:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[08/02/2009|10:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NortonInstaller
[23/01/2005|20:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[14/03/2010|19:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
[01/01/2004|16:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[22/07/2010|20:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[07/04/2010|14:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sun
[01/07/2006|08:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[06/03/2008|22:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[18/11/2007|20:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\yahoo!
[22/07/2010|18:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[01/01/2004|16:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[01/01/2004|18:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intervideo
[01/01/2004|17:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[01/01/2004|19:26] C:\DOCUME~1\DEFAUL~1\APPLIC~1\SampleView
[01/01/2004|17:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
[01/01/2004|23:21] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[12/07/2006|21:59] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
[01/01/2004|16:49] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[01/01/2004|16:49] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[28/01/2008|18:27] C:\DOCUME~1\PROPRI~1\APPLIC~1\Adobe
[12/07/2006|21:42] C:\DOCUME~1\PROPRI~1\APPLIC~1\AdobeAUM
[29/05/2008|22:01] C:\DOCUME~1\PROPRI~1\APPLIC~1\AdobeUM
[19/02/2005|22:19] C:\DOCUME~1\PROPRI~1\APPLIC~1\Ahead
[17/11/2004|22:02] C:\DOCUME~1\PROPRI~1\APPLIC~1\Apple Computer
[24/04/2010|08:21] C:\DOCUME~1\PROPRI~1\APPLIC~1\ArcSoft
[11/11/2008|11:18] C:\DOCUME~1\PROPRI~1\APPLIC~1\Babylon
[23/02/2009|21:11] C:\DOCUME~1\PROPRI~1\APPLIC~1\GlarySoft
[02/06/2006|21:06] C:\DOCUME~1\PROPRI~1\APPLIC~1\Google
[18/11/2005|09:25] C:\DOCUME~1\PROPRI~1\APPLIC~1\Help
[01/01/2004|16:47] C:\DOCUME~1\PROPRI~1\APPLIC~1\Identities
[10/04/2005|00:36] C:\DOCUME~1\PROPRI~1\APPLIC~1\Intervideo
[18/01/2010|11:52] C:\DOCUME~1\PROPRI~1\APPLIC~1\Lavasoft
[11/01/2005|00:11] C:\DOCUME~1\PROPRI~1\APPLIC~1\Leadertech
[23/07/2010|10:26] C:\DOCUME~1\PROPRI~1\APPLIC~1\LimeWire
[20/06/2010|11:39] C:\DOCUME~1\PROPRI~1\APPLIC~1\Macromedia
[21/09/2009|17:29] C:\DOCUME~1\PROPRI~1\APPLIC~1\Microsoft
[14/11/2004|20:44] C:\DOCUME~1\PROPRI~1\APPLIC~1\Motive
[10/05/2010|23:23] C:\DOCUME~1\PROPRI~1\APPLIC~1\Mozilla
[21/08/2007|22:27] C:\DOCUME~1\PROPRI~1\APPLIC~1\MSN6
[27/05/2006|23:59] C:\DOCUME~1\PROPRI~1\APPLIC~1\Nikon
[29/09/2007|10:44] C:\DOCUME~1\PROPRI~1\APPLIC~1\Radios Media Player
[14/03/2010|18:47] C:\DOCUME~1\PROPRI~1\APPLIC~1\Real
[01/01/2004|19:26] C:\DOCUME~1\PROPRI~1\APPLIC~1\SampleView
[05/05/2010|16:06] C:\DOCUME~1\PROPRI~1\APPLIC~1\Skype
[11/01/2005|00:12] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sonic
[01/01/2004|17:28] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sun
[28/11/2004|19:19] C:\DOCUME~1\PROPRI~1\APPLIC~1\Template
[20/02/2010|10:54] C:\DOCUME~1\PROPRI~1\APPLIC~1\vlc
[18/11/2007|20:30] C:\DOCUME~1\PROPRI~1\APPLIC~1\Yahoo!
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[23/07/2010 10:26][--a------] C:\WINDOWS\tasks\Registry Reviver-Propri'taire-Startup.job
[23/07/2010 10:27][--a------] C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1928470191-689273047-2217071835-1003.job
[23/07/2010 10:27][--a------] C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1928470191-689273047-2217071835-1003.job
[23/07/2010 08:06][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[23/07/2010 10:26][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[22/07/2010 20:26][--a------] C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[23/07/2010 10:26][--a------] C:\WINDOWS\tasks\GlaryInitialize.job
[12/02/2004 13:27][-rah-----] C:\WINDOWS\tasks\desktop.ini
[23/07/2010 10:26][--ah-----] C:\WINDOWS\tasks\SA.DAT
--------------------\\ Listing des dossiers dans C:\Program Files
[22/07/2010|18:18] C:\Program Files\Adobe
[22/07/2010|23:16] C:\Program Files\Ad-Remover
[28/11/2004|16:13] C:\Program Files\ADSL Autoconnect
[10/03/2009|15:55] C:\Program Files\Ahead
[11/11/2008|19:42] C:\Program Files\Alwil Software
[24/04/2010|08:25] C:\Program Files\ArcSoft
[09/09/2004|06:06] C:\Program Files\ATI Technologies
[12/07/2008|11:02] C:\Program Files\BufferZone
[27/11/2004|22:28] C:\Program Files\Common Files
[28/11/2004|18:54] C:\Program Files\DivX
[31/01/2006|17:23] C:\Program Files\DVD Shrink
[28/11/2004|16:33] C:\Program Files\Easy Internet signup
[22/07/2010|18:18] C:\Program Files\eMule
[22/07/2010|18:18] C:\Program Files\Fichiers communs
[28/05/2010|20:04] C:\Program Files\FreeTime
[07/04/2009|14:35] C:\Program Files\Glary Utilities
[22/07/2010|19:06] C:\Program Files\Google
[30/11/2005|12:24] C:\Program Files\Hewlett-Packard
[11/11/2008|10:16] C:\Program Files\HP
[20/06/2010|20:29] C:\Program Files\IncrediMail
[22/07/2010|18:18] C:\Program Files\InstallShield Installation Information
[22/07/2010|18:18] C:\Program Files\Internet Explorer
[22/07/2010|18:18] C:\Program Files\InterVideo
[01/01/2004|18:35] C:\Program Files\iPod
[01/01/2004|18:35] C:\Program Files\iTunes
[26/05/2010|08:24] C:\Program Files\Java
[22/07/2010|20:49] C:\Program Files\Lavasoft
[05/05/2010|12:18] C:\Program Files\LimeWire
[08/02/2009|11:47] C:\Program Files\Messenger
[21/09/2009|17:22] C:\Program Files\Microsoft
[08/03/2008|13:57] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[01/01/2004|16:47] C:\Program Files\microsoft frontpage
[11/11/2008|18:10] C:\Program Files\Microsoft Office
[12/07/2010|20:42] C:\Program Files\Microsoft Silverlight
[21/09/2009|17:22] C:\Program Files\Microsoft Sync Framework
[02/03/2009|23:16] C:\Program Files\Microsoft Works
[10/03/2010|22:30] C:\Program Files\Movie Maker
[06/06/2010|12:35] C:\Program Files\Mozilla Firefox
[13/03/2008|21:52] C:\Program Files\MP3 Player Utilities 4.18
[03/02/2008|21:38] C:\Program Files\MSECache
[30/12/2006|20:02] C:\Program Files\MSN
[01/01/2004|16:43] C:\Program Files\MSN Gaming Zone
[28/11/2004|17:28] C:\Program Files\MSN Messenger(2)
[30/12/2004|23:09] C:\Program Files\MSN Messenger(3)
[23/12/2008|10:27] C:\Program Files\MUSICMATCH
[22/08/2008|11:52] C:\Program Files\NetMeeting
[29/05/2006|09:29] C:\Program Files\Nikon
[30/01/2005|18:39] C:\Program Files\Oberon Media
[19/01/2005|19:25] C:\Program Files\Ontrack
[12/05/2010|09:37] C:\Program Files\Outlook Express
[02/12/2005|09:52] C:\Program Files\Overland
[11/02/2008|19:32] C:\Program Files\PC Camera
[22/07/2010|18:18] C:\Program Files\Presario PC Help
[01/01/2004|18:35] C:\Program Files\QuickTime
[14/03/2010|18:45] C:\Program Files\Real
[14/11/2004|10:32] C:\Program Files\RecordNow!
[27/11/2005|19:58] C:\Program Files\ReflexiveArcade
[26/11/2004|18:58] C:\Program Files\SAGEM
[12/07/2008|11:02] C:\Program Files\securedie
[01/01/2004|19:03] C:\Program Files\Services en ligne
[28/11/2004|17:59] C:\Program Files\Skype
[14/11/2004|10:32] C:\Program Files\Sonic
[22/07/2010|20:51] C:\Program Files\Spybot - Search & Destroy
[28/07/2008|19:00] C:\Program Files\Sun
[13/12/2004|22:48] C:\Program Files\THQ
[22/07/2010|21:30] C:\Program Files\Trend Micro
[01/01/2004|18:18] C:\Program Files\Uninstall Information
[22/07/2010|18:18] C:\Program Files\Wanadoo
[08/02/2009|11:47] C:\Program Files\Wanadoo Messager
[11/11/2008|18:05] C:\Program Files\Web Hottest Videos Personal Player
[21/09/2009|17:23] C:\Program Files\Windows Live
[21/09/2009|17:21] C:\Program Files\Windows Live SkyDrive
[21/09/2009|17:23] C:\Program Files\Windows Live Toolbar
[08/02/2009|11:47] C:\Program Files\Windows Media Connect 2
[22/07/2010|18:18] C:\Program Files\Windows Media Player
[22/08/2008|11:52] C:\Program Files\Windows NT
[22/11/2004|03:25] C:\Program Files\WindowsUpdate
[07/12/2009|15:56] C:\Program Files\WinRAR
[01/01/2004|16:47] C:\Program Files\xerox
[28/04/2009|11:28] C:\Program Files\XviD
[18/11/2007|20:28] C:\Program Files\Yahoo!
[24/03/2008|18:50] C:\Program Files\YesMessenger
[22/07/2010|21:00] C:\Program Files\ZHPDiag
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[29/05/2008|22:03] C:\Program Files\Fichiers communs\Adobe
[19/01/2005|16:58] C:\Program Files\Fichiers communs\Ahead
[24/04/2010|08:25] C:\Program Files\Fichiers communs\ArcSoft
[30/11/2005|12:22] C:\Program Files\Fichiers communs\Hewlett-Packard
[30/11/2005|12:27] C:\Program Files\Fichiers communs\HP
[13/12/2004|22:45] C:\Program Files\Fichiers communs\InstallShield
[07/04/2010|14:32] C:\Program Files\Fichiers communs\Java
[05/03/2009|21:50] C:\Program Files\Fichiers communs\Microsoft Shared
[01/01/2004|16:44] C:\Program Files\Fichiers communs\MSSoap
[29/05/2006|09:29] C:\Program Files\Fichiers communs\Nikon
[22/01/2005|22:55] C:\Program Files\Fichiers communs\Oberon Media
[11/02/2008|19:32] C:\Program Files\Fichiers communs\PAC207
[14/03/2010|18:46] C:\Program Files\Fichiers communs\Real
[13/09/2004|16:46] C:\Program Files\Fichiers communs\Services
[14/11/2004|10:32] C:\Program Files\Fichiers communs\Sonic
[01/01/2004|16:40] C:\Program Files\Fichiers communs\SpeechEngines
[14/11/2004|10:32] C:\Program Files\Fichiers communs\SureThing Shared
[22/08/2008|11:52] C:\Program Files\Fichiers communs\System
[21/09/2009|17:13] C:\Program Files\Fichiers communs\Windows Live
[06/03/2008|22:03] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[08/12/2009|16:44] C:\Program Files\Fichiers communs\Wise Installation Wizard
[14/03/2010|18:45] C:\Program Files\Fichiers communs\xing shared
--------------------\\ Process
( 54 Processes )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-23 10:46:30
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 897
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
[F:269][D:40]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
[F:7487][D:0]-> C:\DOCUME~1\PROPRI~1\Cookies
[F:3270][D:18]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - 22/07/2010|22:36 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 23/07/2010|10:50 - Option : [2]
--------------------\\ Fin du rapport a 10:50:35 -
ok,
ceci ne me plait pas du tout !!!
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-22 22:34:25
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 897
* /!\Avertissement :
Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.
Ne pas utiliser en dehors de ce cas de figure : dangereux!
► Télécharges ComboFix à partir de ce lien et enregistres le sur ton bureau :
https://forum.pcastuces.com/combofix_renomme_au_telechargement-f31s22.htm
ou ici :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
A lire
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Avant d'utiliser ComboFix :
► Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
► Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
► Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
► Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
-
Je viens de me rendre compte que le copier coller du rapport combofix n'a pas marché,mince alors,va falloir que je le retrouve,mais je ne sais pas trop a quel endroit....
-
bonjour,
? Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
si le rapport ne passe pas sur le forum, héberge le sur le site Cijoint, copie et colle le lien fourni pas le site sur ton prochain message.
je suis absent toute la journée
@++ -
Ok,ci-joint le lien pour le papport combofix.
http://www.cijoint.fr/cjlink.php?file=cj201007/cijLkDZiLz.txt -
re,
enlève limewire et msn messgener du demarrage de ton pc !
repasse un autre zdpdiag, aide toi de ce poste, tu n'as pas besoin de le retélecharger
https://forums.commentcamarche.net/forum/affich-18580559-rapport-hijackthis#5
-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:29:08, on 24/07/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Glary Utilities\memdefrag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\IncrediMail\Bin\ImApp.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Glary Memory Optimizer] "C:\Program Files\Glary Utilities\memdefrag.exe" /autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O12 - Plugin for .m1v: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-1f0e8508fc1f62f4.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} - http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service de sécurité matérielle (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
-
je renvoi un 2éme rapport aprés avoir supprimé msn que j'avais oublié d'enlevé.J'ai don bien suprimé limevire et Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:42:02, on 24/07/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Glary Utilities\memdefrag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\IncrediMail\Bin\ImApp.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Glary Memory Optimizer] "C:\Program Files\Glary Utilities\memdefrag.exe" /autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O12 - Plugin for .m1v: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-1f0e8508fc1f62f4.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} - http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service de sécurité matérielle (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
-
bonjour,
sur les rapport de hijackthis, il 'y a rie de visible, passe un zhpdiag, aide toi de ce poste, tu n'as pas besoin de le rételecharger :
https://forums.commentcamarche.net/forum/affich-18580559-rapport-hijackthis#5 -
http://www.cijoint.fr/cjlink.php?file=cj201007/cijBfiYuoB.txt
Ci-joint rapport zhp Diag.
Merci pour ta patience....
- 1
- 2
- 3
Suivant
