Internet lent, puis non, puis lent, puis non.

Question

Bonjour, 

Je viens vous expliquer mon problème ici !

Depuis quelques temps, mon accès aux pages internet est très étrange. Peu importe le navigateur que j'utilise, la première page mets 40s à charger. Ensuite, pendant 1min, je vais charger les autres pages sans problèmes. Puis, pendant 3min, ça va remettre 40s a charger par page. Etc...

J'utilise principalement Firefox, mais c'est la même chose sous IE. J'ai dl Firetune, Malware, effectué un scan Avast!. Mais rien ne m'est apparu, j'ai donc effectué un rapport HijackThis ! Que voici ! Je ne sais pas exactement quoi faire. Bien évidemment, j'ai aussi installe/désinstallé firefox, sans succès.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:02:56, on 03/09/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe
C:\Program Files\CyberLink\PlayMovie\PMVService.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Windows\system32	askeng.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Genelis\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.packardbell.com/rdr.aspx?b=ACPW&l=040c&s=2&o=vb32&d=0609&m=easynote_mh36
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.sfr.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.packardbell.com/rdr.aspx?b=ACPW&l=040c&s=2&o=vb32&d=0609&m=easynote_mh36
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.packardbell.com/rdr.aspx?b=ACPW&l=040c&s=2&o=vb32&d=0609&m=easynote_mh36
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://wifi.univ-fcomte.fr/pac/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetupMyPC\SmpSys.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [PCMAgent] "C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe"
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\CyberLink\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Packard Bell\Packard Bell Recovery Management\Service\ETService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1ca760d995874e0) (gupdate1ca760d995874e0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

jacques.gache · Answer

bonjour, vu ton hijackthis je te proposerais de passer ad-remover , et de poster un zhpdiag pour voir plus loint dans ton pc !!

1) passes ad-remover directement en mode nettoyage

Déactives ton anti-virus et anti-spyware le temps du scan 

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 


Télécharge Ad-Remover sur ton bureau:
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe
ou:
https://www.androidworld.fr/

/!\ Ferme toutes tes applications ouvertes. /!\

Double clique sur le fichier que tu viens de télécharger, à l'écran qui apparait, clique sur "Nettoyer".
Laisse travailler l'outil.
Poste le rapport qui s'affiche à l'écran quand l'analyse est terminée.



( Le rapport est sauvegardé sous C:\Ad-report-clean.log ) 



2) postes un zhpdiag pour y voir plus sur ton pc


Ouvre ce lien et télécharge ZHPDiag : 

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

cliques sur télécharger "celui de droite" 

ou directement ici: https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

et si problème : http://www.premiumorange.com/zeb-help-process/zhpdiag.html 

tu vas en bas de la page et tu télécharges le premier tu  et tu dézippes 
 

Enregistres le sur ton Bureau. 

Une fois le téléchargement achevé

pour XP, double-clique sur ZHPDiag 

pour Vista,et seven tu  fais un clic droit sur l'icône et exécute en tant qu'administrateur. 

N'oublies pas de cocher la case qui permet de mettre un raccourci sur le Bureau. 

/|\ l'outil a créé 2 icônes ZHPDiag et ZHPFix. 

Double cliques sur le raccourci ZHPDiag sur ton Bureau pour XP sinon clique droit et en tant que administrateur !! 

Clique sur le Tournevis puis sur Tous pour cocher toutes les cases des options. 

Cliques sur la loupe pour lancer l'analyse. 

Laisses l'outil travailler, il peut être assez long. 

A la fin de l'analyse,clique sur l'appareil photo et enregistre le rapport sur ton Bureau. 


Fermes ZHPDiag en fin d'analyse. 


Pour me le transmettre clique sur ce lien : 

http://www.cijoint.fr/index.php

Clique sur Parcourir et cherche le fichier C:\Documents and settings\le_nom_de_ta_session\bureau\.ZHPDiag.txt

ou directement en choisissant bureau et  ZHPDiag.txt clique dessus 

Clique sur Ouvrir. 

Clique sur "Cliquez ici pour déposer le fichier". 

Un lien de cette forme : 

http://www.cijoint.fr/cjlink.php?file=cj200905/cib7SU.txt 

est ajouté dans la page. 

Copie ce lien dans ta réponse.

Cirdann · Answer

Tout d'abord, merci de l'intention que vous portez a ce problème.

Voici le lien : [url]http://www.cijoint.fr/cjlink.php?file=cj201009/cij1vY5B2G.txt[/url]

Et le copié collé
======= RAPPORT D'AD-REMOVER 2.0.0.1,E | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 01/09/10 à 16:00
Contact: AdRemover.contact[AT]gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html

C:\Program Files\Ad-Remover\main.exe (SCAN [1]) -> Lancé à 22:42:50 le 03/09/2010, Mode normal

Microsoft® Windows Vista(TM) Édition Familiale Basique  Service Pack 2 (X86) 
Genelis@PC-DE-GENELIS (PACKARD BELL BV EasyNote MH36) 
 
============== RECHERCHE ==============

Service: "ASKService" Présent 
Service: "ASKUpgrade" Présent 

0,Fichier trouvé: C:\Program Files\Mozilla FireFox\Components\AskSearch.js
0,Dossier trouvé: C:\Users\Genelis\AppData\Roaming\Mozilla\FireFox\Profiles\wjo9dymj.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
0,Dossier trouvé: C:\Program Files\AskBarDis

-- Fichier ouvert: C:\Users\Genelis\AppData\Roaming\Mozilla\FireFox\Profiles\wjo9dymj.default\Prefs.js --
Ligne trouvée: user_pref("extensions.snipit.askTbInstalled", true); 
-- Fichier Fermé --
 

1,Clé trouvée: HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}
1,Clé trouvée: HKLM\Software\Classes\CLSID\{08993A7C-E764-4172-9627-BFB5EA6897B2}
1,Clé trouvée: HKLM\Software\Classes\CLSID\{128A6C66-AC6A-4617-8268-AB7F47B7215E}
1,Clé trouvée: HKLM\Software\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}
1,Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}
1,Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201f27d4-3704-41d6-89c1-aa35e39143ed}
1,Clé trouvée: HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
1,Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
1,Clé trouvée: HKLM\Software\Classes\CLSID\{571715D7-3395-4DF0-B43C-784836209E60}
1,Clé trouvée: HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}
1,Clé trouvée: HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
1,Clé trouvée: HKLM\Software\Classes\Interface\{4634804A-F0B0-4A74-A550-FC0EEF8A4362}
1,Clé trouvée: HKLM\Software\Classes\Interface\{4C07EA4F-5F52-4222-B170-4CD9ED33BAEA}
1,Clé trouvée: HKLM\Software\Classes\Interface\{C44FEFF4-EF0C-4CF7-83D0-92B4266A32B9}
1,Clé trouvée: HKLM\Software\Classes\Interface\{F131923C-381D-4E4C-A472-4A17118FD742}
1,Clé trouvée: HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}
1,Clé trouvée: HKLM\Software\Classes\TypeLib\{D2E5FA06-DCC7-46F9-BEFF-BFD06F69B9B2}
0,Clé trouvée: HKLM\Software\Classes\AskIBar.PopSwatterBarButton
0,Clé trouvée: HKLM\Software\Classes\AskIBar.PopSwatterBarButton.1
0,Clé trouvée: HKLM\Software\Classes\AskIBar.PopSwatterSettingsControl
0,Clé trouvée: HKLM\Software\Classes\AskIBar.PopSwatterSettingsControl.1
0,Clé trouvée: HKLM\Software\Classes\AskToolBar.SettingsPlugin
0,Clé trouvée: HKLM\Software\Classes\AskToolBar.SettingsPlugin.1
0,Clé trouvée: HKLM\Software\AppDataLow\AskBarDis
0,Clé trouvée: HKCU\Software\AppDataLow\AskBarDis
3,Clé trouvée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
3,Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
0,Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ask Toolbar_is1

0,Valeur trouvée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{3041D03E-FD4B-44E0-B742-2D9B88305F98}
0,Valeur trouvée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{3041D03E-FD4B-44E0-B742-2D9B88305F98}


============== SCAN ADDITIONNEL ==============

** Mozilla Firefox Version [3.6.8 (fr)] **

-- C:\Users\Genelis\AppData\Roaming\Mozilla\FireFox\Profiles\wjo9dymj.default\Prefs.js --
browser.download.lastDir, C:\Users\Genelis\Documents
browser.startup.homepage_override.mstone, rv:1.9.2.8
privacy.popups.showBrowserMessage, false

========================================

** Internet Explorer Version [7.0.6002.18005] **

[HKCU\Software\Microsoft\Internet Explorer\Main] 
AutoHide: yes
Default_Page_URL: hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=040c&s=2&o=vb32&d=0609&m=easynote_mh36
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://g.msn.fr/0SEFRFR/SAOS02
Search Page: hxxp://home.microsoft.com/access/allinone.asp
Show_ToolBar: yes
Start Page: hxxp://www.sfr.fr/kit/adsl/
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main] 
AutoHide: yes
Default_Page_URL: hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=040c&s=2&o=vb32&d=0609&m=easynote_mh36
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\system32\blank.htm
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=040c&s=2&o=vb32&d=0609&m=easynote_mh36

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS] 
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 1 Fichier(s)

C:\Ad-Report-SCAN[1].txt - 03/09/2010 (5305 Octet(s)) 

Fin à: 22:45:02, 03/09/2010 
 
============== E.O.F ==============

Cirdann · Answer

Bonjour, voilà le rapport usbfix après avoir bien NETTOTER.

############################## | UsbFix 7.023 | [Suppression]

Utilisateur: Genelis (Administrateur) # PC-DE-GENELIS [PACKARD BELL BV EasyNote MH36]
Mis à jour le 02/09/10 par El Desaparecido / C_XX
Lancé à 00:05:50 | 04/09/2010
Site Web: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com

CPU: Intel(R) Celeron(R) CPU 900 @ 2.20GHz
Microsoft® Windows Vista(TM) Édition Familiale Basique  (6.0.6002 32-Bit) # Service Pack 2
Internet Explorer 7.0.6002.18005

Pare-feu Windows: Désactivé /!\
RAM -> 2972 Mo 
C:\ (%systemdrive%) -> Disque fixe # 220 Go (62 Go libre(s) - 28%) [OS] # NTFS
D:\ -> CD-ROM
E:\ -> CD-ROM
F:\ -> CD-ROM

################## | Éléments infectieux |


################## | Registre |

Supprimé! HKCU\Software\EWABQAF7KL
Supprimé! HKCU\Software\UBC5AB1IDP

################## | Mountpoints2 |

Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{696b802c-3cb5-11df-8cc1-00238bd711db}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{80819555-0ca1-11df-b274-00238bd711db}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{887b108d-2c23-11df-84f6-00238bd711db}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{b2c32f1d-74d5-11df-bed6-00238bd711db}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{d342b7b0-74dc-11df-8051-00238bd711db}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{ece6e52f-5f74-11df-bcae-00238bd711db}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{f4fa79ce-068c-11df-bb36-00238bd711db}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{f4fa79df-068c-11df-bb36-00238bd711db}

################## | Listing |

[04/09/2010 - 00:08:57 | SHD ] 	C:\$Recycle.Bin
[13/12/2009 - 11:43:16 | A | 1667582] 	C:\08 Piste 8.wma.MP4
[26/06/2010 - 01:51:17 | D ] 	C:\1a23b5a1fc24e4888d5b57
[25/09/2009 - 19:07:35 | HD ] 	C:\ACER
[03/09/2010 - 23:58:56 | A | 5579] 	C:\Ad-Report-CLEAN[1].txt
[03/09/2010 - 22:45:02 | A | 5434] 	C:\Ad-Report-SCAN[1].txt
[18/09/2006 - 23:43:36 | A | 24] 	C:\autoexec.bat
[16/07/2010 - 13:06:58 | SHD ] 	C:\Boot
[11/04/2009 - 08:36:36 | RASH | 333257] 	C:\bootmgr
[09/01/2009 - 13:38:07 | RAS | 8192] 	C:\BOOTSECT.BAK
[30/08/2010 - 13:28:53 | SHD ] 	C:\Config.Msi
[18/09/2006 - 23:43:37 | A | 10] 	C:\config.sys
[25/09/2009 - 19:02:26 | SHD ] 	C:\Documents and Settings
[09/01/2009 - 05:52:21 | D ] 	C:\Intel
[13/12/2009 - 11:47:43 | RASH | 0] 	C:\IO.SYS
[13/12/2009 - 11:47:43 | RASH | 0] 	C:\MSDOS.SYS
[09/01/2009 - 06:02:24 | RHD ] 	C:\MSOCache
[03/09/2010 - 23:59:55 | ASH | 3430924288] 	C:\pagefile.sys
[21/01/2008 - 04:43:50 | D ] 	C:\PerfLogs
[03/09/2010 - 23:58:48 | RD ] 	C:\Program Files
[25/06/2010 - 12:22:55 | HD ] 	C:\ProgramData
[09/01/2009 - 05:59:37 | A | 426] 	C:\RHDSetup.log
[03/09/2010 - 13:12:11 | SHD ] 	C:\System Volume Information
[04/09/2010 - 00:08:57 | D ] 	C:\UsbFix
[04/09/2010 - 00:05:50 | A | 2816] 	C:\UsbFix.txt
[25/09/2009 - 19:06:13 | RD ] 	C:\Users
[29/08/2010 - 18:48:14 | D ] 	C:\Windows

################## | Vaccin |

C:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)

################## | E.O.F |


Maintenant, le rapport Malwarebites

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4237

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

04/09/2010 14:31:54
mbam-log-2010-09-04 (14-31-54).txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|)
Elément(s) analysé(s): 264410
Temps écoulé: 1 heure(s), 10 minute(s), 30 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)


Et pour finir en lien le ZHP :

http://www.cijoint.fr/cjlink.php?file=cj201009/cijsUIFuVX.txt

Cirdann · Answer

Ca rame toujours exactement de la même manière ^^

Cirdann · Answer

Aucune idée de ce que ça peut être ? J'en fais quoi ? Je trouve un moyen de le supprimer ?

Cirdann · Answer

SmitFraudFix v2.424

Scan done at 16:16:58,68, 04/09/2010
Run from C:\Users\Genelis\Downloads\SmitfraudFix
OS: Microsoft Windows [version 6.0.6002] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Packard Bell\Packard Bell Recovery Management\Service\ETService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\IoctlSvc.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe
C:\Program Files\CyberLink\PlayMovie\PMVService.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32	askeng.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\System32\alg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Dofus 2\app\UpLauncher.exe
C:\Program Files\Dofus 2\app\DofusMod.exe
C:\Program Files\Dofus 2\appeg\Reg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Genelis


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Genelis\AppData\Local\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Genelis\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Genelis\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
 
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\Windows\system32\Userinit.exe,"
"Windows Shell (ezShellStart)"="C:\Windows\system32\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]




»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Ralink 802.11n Wireless LAN Card
DNS Server Search Order: 192.168.1.1
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1CE5EF62-62FD-488B-832A-51856449E927}: DhcpNameServer=192.168.1.1 192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

Cirdann · Answer

Le lien, je connais oui, c'tait une pub que je voyais lorsque j'allais sur un site de dl torrent. Tu crois que ça peut venir de là ?

Sinon, les rapports :

http://www.cijoint.fr/cjlink.php?file=cj201009/cijcUzPHB1.txt

SmitFraudFix v2.424

Scan done at 19:09:48,64, 04/09/2010
Run from C:\Users\Genelis\Downloads\SmitfraudFix
OS: Microsoft Windows [version 6.0.6002] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» DNS Before Fix

Description: Ralink 802.11n Wireless LAN Card
DNS Server Search Order: 192.168.1.1
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1CE5EF62-62FD-488B-832A-51856449E927}: DhcpNameServer=192.168.1.1 192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» DNS After Fix

Description: Ralink 802.11n Wireless LAN Card
DNS Server Search Order: 192.168.1.1
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1CE5EF62-62FD-488B-832A-51856449E927}: DhcpNameServer=192.168.1.1 192.168.1.1

Cirdann · Answer

J'te relance :O

Cirdann · Answer

Avant de faire l'option clean, voilà les deux rapports. Le Lits-em ¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.1.0.3 ¤¤¤¤¤¤¤¤¤¤ User : Genelis (Administrateurs) Update on 03/09/2010 by g3n-h@ckm@n ::::: 14.30 Start at: 22:04:03 | 04/09/2010 Intel(R) Celeron(R) CPU 900 @ 2.20GHz Microsoft® Windows Vista(TM) Édition Familiale Basique (6.0.6002 32-bit) # Service Pack 2 Internet Explorer 7.0.6002.18005 Windows Firewall Status : Disabled C:\ -> Disque fixe local | 219,88 Go (62,01 Go free) [OS] | NTFS D:\ -> Disque CD-ROM E:\ -> Disque CD-ROM F:\ -> Disque CD-ROM Boot: Normal ¤¤¤¤¤¤ Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer C:\Windows\System32\smss.exe ---- 616 Ko ---- Normal ---- \SystemRoot\System32\smss.exe ---- C:\Windows\system32\csrss.exe ---- 5948 Ko ---- Normal ---- C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ---- C:\Windows\system32\wininit.exe ---- 3400 Ko ---- High ---- wininit.exe ---- C:\Windows\system32\csrss.exe ---- 8760 Ko ---- Normal ---- C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ---- C:\Windows\system32\winlogon.exe ---- 4888 Ko ---- High ---- winlogon.exe ---- C:\Windows\system32\services.exe ---- 6268 Ko ---- Normal ---- C:\Windows\system32\services.exe ---- C:\Windows\system32\lsass.exe ---- 1956 Ko ---- Normal ---- C:\Windows\system32\lsass.exe ---- C:\Windows\system32\lsm.exe ---- 3356 Ko ---- Normal ---- C:\Windows\system32\lsm.exe ---- C:\Windows\system32\svchost.exe ---- 5452 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k DcomLaunch ---- C:\Windows\system32\svchost.exe ---- 5972 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k rpcss ---- C:\Windows\System32\svchost.exe ---- 36972 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k secsvcs ---- C:\Windows\System32\svchost.exe ---- 12428 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted ---- C:\Windows\System32\svchost.exe ---- 85204 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted ---- C:\Windows\system32\svchost.exe ---- 28068 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k netsvcs ---- C:\Windows\system32\SLsvc.exe ---- 6596 Ko ---- Normal ---- C:\Windows\system32\SLsvc.exe ---- C:\Windows\system32\svchost.exe ---- 11128 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k LocalService ---- C:\Windows\system32\svchost.exe ---- 12148 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k NetworkService ---- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe ---- 304 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" ---- ALWIL Software C:\Program Files\Alwil Software\Avast4\ashServ.exe ---- 33480 Ko ---- High ---- "C:\Program Files\Alwil Software\Avast4\ashServ.exe" ---- ALWIL Software C:\Windows\System32\spoolsv.exe ---- 8812 Ko ---- Normal ---- C:\Windows\System32\spoolsv.exe ---- C:\Windows\system32\svchost.exe ---- 12964 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork ---- C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ---- 732 Ko ---- Normal ---- "C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe" ---- Adobe Systems Incorporated C:\Program Files\Packard Bell\Packard Bell Recovery Management\Service\ETService.exe ---- 12580 Ko ---- Normal ---- "C:\Program Files\Packard Bell\Packard Bell Recovery Management\Service\ETService.exe" ---- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe ---- 5804 Ko ---- Normal ---- "C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe" ---- Nero AG C:\Windows\system32 askeng.exe ---- 5264 Ko ---- Below Normal ---- taskeng.exe {16808C04-4111-434E-A83B-13193561EAE9} ---- C:\Windows\system32\Dwm.exe ---- 32992 Ko ---- High ---- "C:\Windows\system32\Dwm.exe" ---- C:\Windows\system32\IoctlSvc.exe ---- 2444 Ko ---- Normal ---- C:\Windows\system32\IoctlSvc.exe ---- C:\Windows\Explorer.EXE ---- 51824 Ko ---- Normal ---- C:\Windows\Explorer.EXE ---- C:\Windows\system32\svchost.exe ---- 4264 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted ---- C:\Windows\system32\svchost.exe ---- 5468 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k imgsvc ---- C:\Program Files\Windows Defender\MSASCui.exe ---- 7216 Ko ---- Normal ---- "C:\Program Files\Windows Defender\MSASCui.exe" -hide ---- Microsoft Windows C:\Windows\RtHDVCpl.exe ---- 8440 Ko ---- Normal ---- "C:\Windows\RtHDVCpl.exe" ---- Realtek Semiconductor Corp C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ---- 5292 Ko ---- Normal ---- "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ---- Synaptics Incorporated C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe ---- 5504 Ko ---- Normal ---- "C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe" ---- Packard Bell B.V. C:\Windows\System32\hkcmd.exe ---- 4608 Ko ---- Normal ---- "C:\Windows\System32\hkcmd.exe" ---- Intel Corporation C:\Windows\System32\igfxpers.exe ---- 4136 Ko ---- Normal ---- "C:\Windows\System32\igfxpers.exe" ---- Intel Corporation C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe ---- 7200 Ko ---- Normal ---- "C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe" ---- C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe ---- 11300 Ko ---- Normal ---- "C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe" ---- C:\Program Files\CyberLink\PlayMovie\PMVService.exe ---- 6216 Ko ---- Normal ---- "C:\Program Files\CyberLink\PlayMovie\PMVService.exe" ---- C:\Program Files\Java\jre6\bin\jusched.exe ---- 3048 Ko ---- Normal ---- "C:\Program Files\Java\jre6\bin\jusched.exe" ---- Sun Microsystems, Inc. C:\Program Files\Common Files\Real\Update_OB ealsched.exe ---- 228 Ko ---- Normal ---- "C:\Program Files\Common Files\Real\Update_OB ealsched.exe" -osboot ---- RealNetworks, Inc. C:\Program Files\Alwil Software\Avast4\ashDisp.exe ---- 1984 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\ashDisp.exe" ---- ALWIL Software C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe ---- 980 Ko ---- Normal ---- "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" ---- Google Inc C:\Program Files\Windows Live\Messenger\msnmsgr.exe ---- 6348 Ko ---- Normal ---- "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background ---- Microsoft Corporation C:\Program Files\DAEMON Tools Lite\DTLite.exe ---- 7452 Ko ---- Normal ---- "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun ---- DT Soft Ltd C:\Program Files\Windows Media Player\wmpnscfg.exe ---- 4424 Ko ---- Normal ---- "C:\Program Files\Windows Media Player\wmpnscfg.exe" ---- C:\Windows\System32\svchost.exe ---- 1828 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k WerSvcGroup ---- C:\Windows\system32\SearchIndexer.exe ---- 14800 Ko ---- Normal ---- C:\Windows\system32\SearchIndexer.exe /Embedding ---- C:\Program Files\OpenOffice.org 3\program\soffice.exe ---- 2508 Ko ---- Normal ---- "C:\Program Files\OpenOffice.org 3\program\soffice.exe" -quickstart ---- C:\Windows\system32\igfxext.exe ---- 3920 Ko ---- Normal ---- C:\Windows\system32\igfxext.exe -Embedding ---- Intel Corporation C:\Windows\system32\igfxsrvc.exe ---- 4940 Ko ---- Normal ---- C:\Windows\system32\igfxsrvc.exe -Embedding ---- Intel Corporation C:\Windows\system32 askeng.exe ---- 12044 Ko ---- Normal ---- taskeng.exe {78D4173A-5F7E-4C15-9CA0-303419516D49} ---- C:\Program Files\OpenOffice.org 3\program\soffice.bin ---- 14800 Ko ---- Normal ---- "C:\Program Files\OpenOffice.org 3\program\soffice.exe" "-quickstart" "-env:OOO_CWD=2C:\Program Files\OpenOffice.org 3\program" ---- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe ---- 2112 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service ---- ALWIL Software C:\Program Files\Alwil Software\Avast4\ashWebSv.exe ---- 3136 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service ---- ALWIL Software C:\Windows\System32\alg.exe ---- 3852 Ko ---- Normal ---- C:\Windows\System32\alg.exe ---- C:\Program Files\Windows Media Player\wmpnetwk.exe ---- 6748 Ko ---- Normal ---- "C:\Program Files\Windows Media Player\wmpnetwk.exe" ---- C:\Windows\system32\wbem\unsecapp.exe ---- 4268 Ko ---- Normal ---- C:\Windows\system32\wbem\unsecapp.exe -Embedding ---- C:\Windows\system32\wbem\wmiprvse.exe ---- 5316 Ko ---- Normal ---- C:\Windows\system32\wbem\wmiprvse.exe ---- C:\Windows\system32\conime.exe ---- 3408 Ko ---- Normal ---- C:\Windows\system32\conime.exe ---- C:\Program Files\Dofus 2\app\UpLauncher.exe ---- 12844 Ko ---- Normal ---- "C:\Program Files\Dofus 2\app\UpLauncher.exe" ---- C:\Program Files\Dofus 2\app\DofusMod.exe ---- 293828 Ko ---- Normal ---- DofusMod.exe ---- C:\Program Files\Dofus 2\app eg\Reg.exe ---- 35080 Ko ---- Normal ---- reg/Reg.exe ---- C:\Program Files\Mozilla Firefox\firefox.exe ---- 93396 Ko ---- Normal ---- "C:\Program Files\Mozilla Firefox\firefox.exe" ---- Mozilla Corporation C:\Program Files\Mozilla Firefox\plugin-container.exe ---- 95188 Ko ---- Normal ---- "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=920.798e580.137009632 "C:\Windows\system32\Macromed\Flash\NPSWF32.dll" 920 plugin \.\pipe\gecko-crash-server-pipe.920 ---- Mozilla Corporation C:\Windows\system32\cmd.exe ---- 2204 Ko ---- Normal ---- C:\Windows\system32\cmd.exe /K List'em.bat ---- C:\Windows\system32\wbem\wmiprvse.exe ---- 8456 Ko ---- Normal ---- C:\Windows\system32\wbem\wmiprvse.exe ---- C:\Program Files\List_Kill'em\pv.exe ---- 5660 Ko ---- Normal ---- pv -o"%f ---- %m Ko ---- %p ---- %l ---- %s" ---- ¤¤¤¤¤¤¤¤¤¤ Keys "Run" ¤¤¤¤¤¤¤¤¤¤ [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] SmpcSys = C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe swg = "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" msnmsgr = "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] Windows Defender = %ProgramFiles%\Windows Defender\MSASCui.exe -hide RtHDVCpl = RtHDVCpl.exe SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe Google Desktop Search = "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup SmpcSys = C:\Program Files\Packard Bell\SetupMyPC\SmpSys.exe IgfxTray = C:\Windows\system32\igfxtray.exe HotKeysCmds = C:\Windows\system32\hkcmd.exe Persistence = C:\Windows\system32\igfxpers.exe PCMAgent = "C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe" CLMLServer = "C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe" PlayMovie = "C:\Program Files\CyberLink\PlayMovie\PMVService.exe" SunJavaUpdateSched = "C:\Program Files\Java\jre6\bin\jusched.exe" TkBellExe = "C:\Program Files\Common Files\Real\Update_OB ealsched.exe" -osboot avast! = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe Adobe ARM = "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] ¤¤¤¤¤¤¤¤¤¤ Other System Keys ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] ConsentPromptBehaviorAdmin = 2 (0x2) ConsentPromptBehaviorUser = 1 (0x1) EnableInstallerDetection = 1 (0x1) EnableLUA = 0 (0x0) EnableSecureUIAPaths = 1 (0x1) EnableVirtualization = 1 (0x1) PromptOnSecureDesktop = 1 (0x1) ValidateAdminCodeSignatures = 0 (0x0) dontdisplaylastusername = 0 (0x0) legalnoticecaption = legalnoticetext = scforceoption = 0 (0x0) shutdownwithoutlogon = 1 (0x1) undockwithoutlogon = 1 (0x1) FilterAdministratorToken = 0 (0x0) EnableUIADesktopToggle = 0 (0x0) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] NoDriveTypeAutoRun = 0 (0x0) NoDriveAutoRun = 0 (0x0) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] BindDirectlyToPropertySetStorage = 0 (0x0) NoDriveAutoRun = 0 (0x0) NoDriveTypeAutoRun = 0 (0x0) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLS = ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] ReportBootOk = 1 Shell = Explorer.exe Userinit = C:\Windows\system32\Userinit.exe, VmApplet = rundll32 shell32,Control_RunDLL "sysdm.cpl" AutoRestartShell = 1 (0x1) LegalNoticeCaption = LegalNoticeText = PowerdownAfterShutdown = 0 ShutdownWithoutLogon = 0 cachedlogonscount = 10 forceunlocklogon = 0 (0x0) passwordexpirywarning = 14 (0xe) Background = 0 0 0 DebugServerCommand = no WinStationsDisabled = 0 DisableCAD = 1 (0x1) scremoveoption = 0 ShutdownFlags = 39 (0x27) Windows Shell (ezShellStart) = C:\Windows\system32\userinit.exe, ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\igfxcui] ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] {E54729E8-BB3D-4270-9D49-7389EA579090} = EasyBits Security Shield Hook - prevents launching insecure programs by kids ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] ¤¤¤¤¤¤¤¤¤¤ ActivX | COM ¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3C3901C5-3455-3E0A-A214-0B093A5070A6}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] ¤¤¤¤¤¤¤¤¤¤ BHO ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] ¤¤¤¤¤¤¤¤¤¤ DNS ¤¤¤¤¤¤¤¤¤¤ HKLM\SYSTEM\CCS\Services\Tcpip\..\{1CE5EF62-62FD-488B-832A-51856449E927}: DhcpNameServer=192.168.1.1 192.168.1.1 ¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.msn.com/fr-fr Local Page = %SystemRoot%\system32\blank.htm Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.msn.com/fr-fr Local Page = C:\Windows\system32\blank.htm ¤¤¤¤¤ Proxy Internet Explorer [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings] ProxyEnable = 0 (0x0) ¤¤¤¤¤¤¤¤¤¤ Proxy Firefox ¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤¤¤¤¤¤ TaskCache ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule askcache ree\Apple] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule askcache ree\GoogleUpdateTaskMachineCore] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule askcache ree\GoogleUpdateTaskMachineUA] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule askcache ree\Microsoft] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule askcache ree\WPD] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule askcache ree\{48F4FE94-381B-4B7E-891D-4AF8D848D4BC}] ¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AcroRd32.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DllNXOptions] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\IEInstal.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iexplore.exe] ¤¤¤¤¤¤¤¤¤¤ File Protection ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection] KnownDllList = nlhtml.dll ¤¤¤¤¤¤¤¤¤¤ Safemode ¤¤¤¤¤¤¤¤¤¤ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !! ¤¤¤¤¤¤¤¤¤¤ Atapi.sys ¤¤¤¤¤¤¤¤¤¤ C:\Windows\System32\drivers\atapi.sys : [MD5.1f05b78ab91c9075565a9d8a4b880bc4] [SHA256.737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd] C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys : [MD5.1f05b78ab91c9075565a9d8a4b880bc4] [SHA256.737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd] C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys : [MD5.4f4fcb8b6ea06784fb6d475b7ec7300f] [SHA256.6202d85c9a75e3f01f5f94f069c4cd8a2b9295a182301eae5940ec3bc2c1d896] C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys : [MD5.2d9c903dc76a66813d350a562de40ed9] [SHA256.82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3] C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys : [MD5.2d9c903dc76a66813d350a562de40ed9] [SHA256.82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3] C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys : [MD5.1f05b78ab91c9075565a9d8a4b880bc4] [SHA256.737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd] ¤¤¤¤¤ Reference Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867 Win XP_32b : a64013e98426e1877cb653685c5c0009 Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51 Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674 Vista_32b : e03e8c99d15d0381e02743c36afc7c6f Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9 Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4 Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC Windows 7_32b : 338c86357871c167a96ab976519bf59e Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C ¤¤¤¤¤¤¤¤¤¤ Drive ¤¤¤¤¤¤¤¤¤¤ D'fragmenteur de disque Windows Copyright (c) 2006 Microsoft Corp. Rapport d'analyse pour le volume C: OS Taille du volume = 220 Go Espace libre = 62.02 Go tendue d'espace libre la plus grande = 45.69 Go Pourcentage de fragmentation des fichiers = 0 % Remarqueÿ: sur les volumes NTFS, les fragments de fichiers de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation. Il n'est pas n'cessaire de d'fragmenter ce volume. ¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤¤¤¤¤¤ Rogues Infections ¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤¤¤¤¤¤ Files/folders ¤¤¤¤¤¤¤¤¤¤ Present !! : C:\Windows\meta4.exe Present !! : C:\Windows\System32\404Fix.exe Present !! : C:\Windows\System32\dumphive.exe Present !! : C:\Windows\System32\EZUPBH~1.DLL Present !! : C:\Windows\System32\IEDFix.exe Present !! : C:\Windows\system32\Install.cmd Present !! : C:\Windows\System32\Process.exe Present !! : C:\Windows\System32\SrchSTS.exe Present !! : C:\Windows\System32 mp.reg Present !! : C:\Windows\System32\VACFix.exe Present !! : C:\Windows\System32\VCCLSID.exe Present !! : C:\Windows\System32\WS2Fix.exe Present !! : C:\Users\Genelis\AppData\Local\d3d8caps.dat Present !! : C:\Users\Genelis\AppData\Local\d3d9caps.dat Present !! : C:\Users\Genelis\AppData\Local\GDIPFONTCACHEV1.DAT ¤¤¤¤¤¤¤¤¤¤ Keys : Present !! : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} Present !! : HKCR\ezUPBHook.ShellObj Present !! : HKCR\ezUPBHook.ShellObj.1 Present !! : HKCR\TypeLib\{478CAB91-9E28-11D4-97FF-0050047D51FB} Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4} Present !! : HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179} Present !! : HKLM\Software\Classes\Interface\{01009AEC-AFAA-4982-9F2B-6411C5C27E77} FEATURE_BROWSER_EMULATION | svchost : ==================================== ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-09-04 22:21:38 Windows 6.0.6002 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x854381F8]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\atapi -> 0x854381f8 Warning: possible MBR rootkit infection ! user & kernel MBR OK Use "Recovery Console" command "fixmbr" to clear infection ! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] cval = 1 (0x1) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ End of scan : 22:22:35,50 Puis le ZhP'FIx : Rapport de ZHPFix v1.12.3143 par Nicolas Coolman, Update du 01/09/2010 Fichier d'export Registre : Run by Genelis at 04/09/2010 21:57:35 Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html Contact : nicolascoolman@yahoo.fr ========== Clé(s) du Registre ========== HKCU\Software\Totem => Clé supprimée avec succès ========== Valeur(s) du Registre ========== O4 - HKLM\..\Run: [eRecoveryService] Clé orpheline => Valeur supprimée avec succès O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\QTTask.exe => Valeur supprimée avec succès O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe => Valeur supprimée avec succès O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe => Valeur supprimée avec succès O4 - HKCU\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe => Valeur supprimée avec succès O4 - HKUS\S-1-5-21-3972564767-1054751291-3089694727-1000\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe => Valeur absente O4 - HKUS\S-1-5-21-3972564767-1054751291-3089694727-1000\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe => Valeur absente ========== Dossier(s) ========== C:\Program Files\vghd => Dossier absent ========== Récapitulatif ========== 1 : Clé(s) du Registre 7 : Valeur(s) du Registre 1 : Dossier(s) End of the scan Voilà le résultat du dernier truc ¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.0.3 ¤¤¤¤¤¤¤¤¤¤ User : Genelis (Administrateurs) Update on 03/09/2010 by g3n-h@ckm@n ::::: 14.30 Start at: 22:26:20 | 04/09/2010 Intel(R) Celeron(R) CPU 900 @ 2.20GHz Microsoft® Windows Vista(TM) Édition Familiale Basique (6.0.6002 32-bit) # Service Pack 2 Internet Explorer 7.0.6002.18005 Windows Firewall Status : Disabled C:\ -> Disque fixe local | 219,88 Go (62,01 Go free) [OS] | NTFS D:\ -> Disque CD-ROM E:\ -> Disque CD-ROM F:\ -> Disque CD-ROM ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ------- Memory(Ko) C:\Windows\System32\smss.exe ----628 Ko C:\Windows\system32\csrss.exe ----5976 Ko C:\Windows\system32\wininit.exe ----3400 Ko C:\Windows\system32\csrss.exe ----8112 Ko C:\Windows\system32\winlogon.exe ----4924 Ko C:\Windows\system32\services.exe ----6268 Ko C:\Windows\system32\lsass.exe ----2052 Ko C:\Windows\system32\lsm.exe ----3356 Ko C:\Windows\system32\svchost.exe ----5460 Ko C:\Windows\system32\svchost.exe ----6744 Ko C:\Windows\System32\svchost.exe ----37236 Ko C:\Windows\System32\svchost.exe ----12504 Ko C:\Windows\System32\svchost.exe ----90708 Ko C:\Windows\system32\svchost.exe ----28256 Ko C:\Windows\system32\SLsvc.exe ----6596 Ko C:\Windows\system32\svchost.exe ----11148 Ko C:\Windows\system32\svchost.exe ----12180 Ko C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe ----304 Ko C:\Program Files\Alwil Software\Avast4\ashServ.exe ----33480 Ko C:\Windows\System32\spoolsv.exe ----8824 Ko C:\Windows\system32\svchost.exe ----13176 Ko C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ----732 Ko C:\Program Files\Packard Bell\Packard Bell Recovery Management\Service\ETService.exe ----12580 Ko C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe ----5804 Ko C:\Windows\system32 askeng.exe ----5264 Ko C:\Windows\system32\Dwm.exe ----37256 Ko C:\Windows\system32\IoctlSvc.exe ----2444 Ko C:\Windows\Explorer.EXE ----50324 Ko C:\Windows\system32\svchost.exe ----4280 Ko C:\Windows\system32\svchost.exe ----5504 Ko C:\Program Files\Windows Defender\MSASCui.exe ----7256 Ko C:\Windows\RtHDVCpl.exe ----8444 Ko C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ----5292 Ko C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe ----5504 Ko C:\Windows\System32\hkcmd.exe ----4608 Ko C:\Windows\System32\igfxpers.exe ----4136 Ko C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe ----7200 Ko C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe ----11308 Ko C:\Program Files\CyberLink\PlayMovie\PMVService.exe ----6216 Ko C:\Program Files\Java\jre6\bin\jusched.exe ----3048 Ko C:\Program Files\Common Files\Real\Update_OB ealsched.exe ----248 Ko C:\Program Files\Alwil Software\Avast4\ashDisp.exe ----2008 Ko C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe ----996 Ko C:\Program Files\DAEMON Tools Lite\DTLite.exe ----7456 Ko C:\Program Files\Windows Media Player\wmpnscfg.exe ----4424 Ko C:\Windows\System32\svchost.exe ----1848 Ko C:\Windows\system32\SearchIndexer.exe ----16040 Ko C:\Program Files\OpenOffice.org 3\program\soffice.exe ----2508 Ko C:\Windows\system32\igfxext.exe ----3920 Ko C:\Windows\system32\igfxsrvc.exe ----4992 Ko C:\Windows\system32 askeng.exe ----12048 Ko C:\Program Files\OpenOffice.org 3\program\soffice.bin ----14800 Ko C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe ----2112 Ko C:\Program Files\Alwil Software\Avast4\ashWebSv.exe ----3820 Ko C:\Windows\System32\alg.exe ----3852 Ko C:\Program Files\Windows Media Player\wmpnetwk.exe ----6748 Ko C:\Windows\system32\wbem\unsecapp.exe ----4300 Ko C:\Windows\system32\wbem\wmiprvse.exe ----5316 Ko C:\Windows\system32\conime.exe ----3416 Ko C:\Program Files\Dofus 2\app\UpLauncher.exe ----12844 Ko C:\Program Files\Dofus 2\app\DofusMod.exe ----312020 Ko C:\Program Files\Dofus 2\app eg\Reg.exe ----39304 Ko C:\Windows\system32\cmd.exe ----2472 Ko C:\Windows\system32\wbem\wmiprvse.exe ----8468 Ko C:\Windows\system32\SearchProtocolHost.exe ----7688 Ko C:\Windows\system32\SearchFilterHost.exe ----4612 Ko C:\Program Files\List_Kill'em\ERUNT.EXE ----5828 Ko C:\Program Files\List_Kill'em\pv.exe ----5652 Ko ¤¤¤¤¤¤¤¤¤¤ Files/folders : Quarantined & Deleted !! : C:\Windows\meta4.exe Quarantined & Deleted !! : C:\Windows\System32\404Fix.exe Quarantined & Deleted !! : C:\Windows\System32\dumphive.exe Quarantined & Deleted !! : C:\Windows\System32\EZUPBH~1.DLL Quarantined & Deleted !! : C:\Windows\System32\IEDFix.exe Quarantined & Deleted !! : C:\Windows\system32\Install.cmd Quarantined & Deleted !! : C:\Windows\System32\Process.exe Quarantined & Deleted !! : C:\Windows\System32\SrchSTS.exe Quarantined & Deleted !! : C:\Windows\System32 mp.reg Quarantined & Deleted !! : C:\Windows\System32\VACFix.exe Quarantined & Deleted !! : C:\Windows\System32\VCCLSID.exe Quarantined & Deleted !! : C:\Windows\System32\WS2Fix.exe Quarantined & Deleted !! : C:\Users\Genelis\AppData\Local\d3d8caps.dat Quarantined & Deleted !! : C:\Users\Genelis\AppData\Local\d3d9caps.dat Quarantined & Deleted !! : C:\Users\Genelis\AppData\Local\GDIPFONTCACHEV1.DAT ¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤ 127.0.0.1 localhost ¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤ Deleted : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} Deleted : HKCR\ezUPBHook.ShellObj Deleted : HKCR\ezUPBHook.ShellObj.1 Deleted : HKCR\TypeLib\{478CAB91-9E28-11D4-97FF-0050047D51FB} Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4} Deleted : HKLM\Software\Classes\Interface\{01009AEC-AFAA-4982-9F2B-6411C5C27E77} ¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.msn.com/fr-fr/?ocid=iehp Local Page = C:\WINDOWS\system32\blank.htm Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.google.com/?gws_rd=ssl Local Page = C:\WINDOWS\system32\blank.htm Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] cval = 1 () FirstRunDisabled = 1 () AntiVirusDisableNotify = 0 (0x0) FirewallDisableNotify = 0 (0x0) UpdatesDisableNotify = 0 (0x0) AntiVirusOverride = 0 (0x0) FirewallOverride = 0 (0x0) ¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤ Ndisuio : Start = 3 EapHost : Start = 2 Wlansvc : Start = 2 SharedAccess : Start = 2 windefend : Start = 2 wuauserv : Start = 2 wscsvc : Start = 2 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Disk Cleaned anti-ver blaster : OK Prefetch cleaned ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ FEATURE_BROWSER_EMULATION | svchost : ==================================== Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x854381F8]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\atapi -> 0x854381f8 Warning: possible MBR rootkit infection ! user & kernel MBR OK Use "Recovery Console" command "fixmbr" to clear infection ! ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Cirdann · Answer

Désolé, mais c'est toujours la même chose :(

Internet lent, puis non, puis lent, puis non.

10 réponses

Votre réponse

Discussions similaires

Newsletters