Ouverture "furtive" d'un executable

gtt -  
bonjour,
voila mon probleme, de temps en temps j'ai une programme qui s'ouvre entre 1 et 2 secondes. Cela me fait sauter l'application que j'utilise à ce moment la.

j'ai essayé une multitude d'anti virus et antispyware sans resultat

avez vous une idée....

a+

12 réponses

  2. gtt
    Logfile of HijackThis v1.99.1
    Scan saved at 22:48:38, on 08/01/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\zHotkey.exe
    C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Fichiers communs\Talkway\vmtalk.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Microsoft Money\System\mnyexpr.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
    C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
    C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
    C:\Program Files\Club-Internet\Lanceur\lanceur.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
    C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\damien\Bureau\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.carrefour.fr/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O1 - Hosts: 195.158.171.60 google.ae
    O1 - Hosts: 195.158.171.60 google.as
    O1 - Hosts: 195.158.171.60 google.at
    O1 - Hosts: 195.158.171.60 google.au
    O1 - Hosts: 195.158.171.60 google.bi
    O1 - Hosts: 195.158.171.60 google.br
    O1 - Hosts: 195.158.171.60 google.ca
    O1 - Hosts: 195.158.171.60 google.cc
    O1 - Hosts: 195.158.171.60 google.cd
    O1 - Hosts: 195.158.171.60 google.cg
    O1 - Hosts: 195.158.171.60 google.ch
    O1 - Hosts: 195.158.171.60 google.cl
    O1 - Hosts: 195.158.171.60 google.co.cr
    O1 - Hosts: 195.158.171.60 google.co.gg
    O1 - Hosts: 195.158.171.60 google.co.hu
    O1 - Hosts: 195.158.171.60 google.co.il
    O1 - Hosts: 195.158.171.60 google.co.in
    O1 - Hosts: 195.158.171.60 google.co.je
    O1 - Hosts: 195.158.171.60 google.co.jp
    O1 - Hosts: 195.158.171.60 google.co.kr
    O1 - Hosts: 195.158.171.60 google.co.ls
    O1 - Hosts: 195.158.171.60 google.co.nz
    O1 - Hosts: 195.158.171.60 google.com
    O1 - Hosts: 195.158.171.60 google.com.ae
    O1 - Hosts: 195.158.171.60 google.com.au
    O1 - Hosts: 195.158.171.60 google.com.ca
    O1 - Hosts: 195.158.171.60 google.com.do
    O1 - Hosts: 195.158.171.60 google.com.fj
    O1 - Hosts: 195.158.171.60 google.com.gr
    O1 - Hosts: 195.158.171.60 google.com.ly
    O1 - Hosts: 195.158.171.60 google.com.mt
    O1 - Hosts: 195.158.171.60 google.com.my
    O1 - Hosts: 195.158.171.60 google.com.nf
    O1 - Hosts: 195.158.171.60 google.com.ni
    O1 - Hosts: 195.158.171.60 google.com.pa
    O1 - Hosts: 195.158.171.60 google.com.pe
    O1 - Hosts: 195.158.171.60 google.com.pk
    O1 - Hosts: 195.158.171.60 google.com.pr
    O1 - Hosts: 195.158.171.60 google.com.py
    O1 - Hosts: 195.158.171.60 google.com.ru
    O1 - Hosts: 195.158.171.60 google.com.sg
    O1 - Hosts: 195.158.171.60 google.com.sv
    O1 - Hosts: 195.158.171.60 google.com.tr
    O1 - Hosts: 195.158.171.60 google.com.tw
    O1 - Hosts: 195.158.171.60 google.com.vc
    O1 - Hosts: 195.158.171.60 google.com.vn
    O1 - Hosts: 195.158.171.60 google.cr
    O1 - Hosts: 195.158.171.60 google.de
    O1 - Hosts: 195.158.171.60 google.dj
    O1 - Hosts: 195.158.171.60 google.do
    O1 - Hosts: 195.158.171.60 google.es
    O1 - Hosts: 195.158.171.60 google.fj
    O1 - Hosts: 195.158.171.60 google.fr
    O1 - Hosts: 195.158.171.60 google.gg
    O1 - Hosts: 195.158.171.60 google.gl
    O1 - Hosts: 195.158.171.60 google.gm
    O1 - Hosts: 195.158.171.60 google.gr
    O1 - Hosts: 195.158.171.60 google.hn
    O1 - Hosts: 195.158.171.60 google.hu
    O1 - Hosts: 195.158.171.60 google.ie
    O1 - Hosts: 195.158.171.60 google.il
    O1 - Hosts: 195.158.171.60 google.in
    O1 - Hosts: 195.158.171.60 google.it
    O1 - Hosts: 195.158.171.60 google.je
    O1 - Hosts: 195.158.171.60 google.jp
    O1 - Hosts: 195.158.171.60 google.kr
    O1 - Hosts: 195.158.171.60 google.kz
    O1 - Hosts: 195.158.171.60 google.ls
    O1 - Hosts: 195.158.171.60 google.lt
    O1 - Hosts: 195.158.171.60 google.lu
    O1 - Hosts: 195.158.171.60 google.lv
    O1 - Hosts: 195.158.171.60 google.ly
    O1 - Hosts: 195.158.171.60 google.mt
    O1 - Hosts: 195.158.171.60 google.mu
    O1 - Hosts: 195.158.171.60 google.mw
    O1 - Hosts: 195.158.171.60 google.my
    O1 - Hosts: 195.158.171.60 google.nf
    O1 - Hosts: 195.158.171.60 google.ni
    O1 - Hosts: 195.158.171.60 google.nl
    O1 - Hosts: 195.158.171.60 google.nz
    O1 - Hosts: 195.158.171.60 google.pa
    O1 - Hosts: 195.158.171.60 google.pe
    O1 - Hosts: 195.158.171.60 google.pk
    O1 - Hosts: 195.158.171.60 google.pl
    O1 - Hosts: 195.158.171.60 google.pn
    O1 - Hosts: 195.158.171.60 google.pr
    O1 - Hosts: 195.158.171.60 google.pt
    O1 - Hosts: 195.158.171.60 google.py
    O1 - Hosts: 195.158.171.60 google.ru
    O1 - Hosts: 195.158.171.60 google.rw
    O1 - Hosts: 195.158.171.60 google.se
    O1 - Hosts: 195.158.171.60 google.sg
    O1 - Hosts: 195.158.171.60 google.sh
    O1 - Hosts: 195.158.171.60 google.sk
    O1 - Hosts: 195.158.171.60 google.sm
    O1 - Hosts: 195.158.171.60 google.sv
    O1 - Hosts: 195.158.171.60 google.td
    O1 - Hosts: 195.158.171.60 google.tr
    O1 - Hosts: 195.158.171.60 google.tw
    O1 - Hosts: 195.158.171.60 google.uz
    O1 - Hosts: 195.158.171.60 google.vc
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [vmtalk] C:\Program Files\Fichiers communs\Talkway\vmtalk.exe
    O4 - HKLM\..\Run: [BDSwitchAgent] "C:\progra~1\softwin\bitdef~1\bdswitch.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
    O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
    O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Picture Package Menu.lnk = ?
    O4 - Global Startup: Picture Package VCD Maker.lnk = ?
    O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.carrefour.fr/
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119456806656
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1121082381687
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
    O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
    1. incognito02 Contributeur
      Bonsoir,

      Pour avancer Bernie,

      Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :

      O1 - Hosts: 195.158.171.60 google.ae
      O1 - Hosts: 195.158.171.60 google.as
      O1 - Hosts: 195.158.171.60 google.at
      O1 - Hosts: 195.158.171.60 google.au
      O1 - Hosts: 195.158.171.60 google.bi
      O1 - Hosts: 195.158.171.60 google.br
      O1 - Hosts: 195.158.171.60 google.ca
      O1 - Hosts: 195.158.171.60 google.cc
      O1 - Hosts: 195.158.171.60 google.cd
      O1 - Hosts: 195.158.171.60 google.cg
      O1 - Hosts: 195.158.171.60 google.ch
      O1 - Hosts: 195.158.171.60 google.cl
      O1 - Hosts: 195.158.171.60 google.co.cr
      O1 - Hosts: 195.158.171.60 google.co.gg
      O1 - Hosts: 195.158.171.60 google.co.hu
      O1 - Hosts: 195.158.171.60 google.co.il
      O1 - Hosts: 195.158.171.60 google.co.in
      O1 - Hosts: 195.158.171.60 google.co.je
      O1 - Hosts: 195.158.171.60 google.co.jp
      O1 - Hosts: 195.158.171.60 google.co.kr
      O1 - Hosts: 195.158.171.60 google.co.ls
      O1 - Hosts: 195.158.171.60 google.co.nz
      O1 - Hosts: 195.158.171.60 google.com
      O1 - Hosts: 195.158.171.60 google.com.ae
      O1 - Hosts: 195.158.171.60 google.com.au
      O1 - Hosts: 195.158.171.60 google.com.ca
      O1 - Hosts: 195.158.171.60 google.com.do
      O1 - Hosts: 195.158.171.60 google.com.fj
      O1 - Hosts: 195.158.171.60 google.com.gr
      O1 - Hosts: 195.158.171.60 google.com.ly
      O1 - Hosts: 195.158.171.60 google.com.mt
      O1 - Hosts: 195.158.171.60 google.com.my
      O1 - Hosts: 195.158.171.60 google.com.nf
      O1 - Hosts: 195.158.171.60 google.com.ni
      O1 - Hosts: 195.158.171.60 google.com.pa
      O1 - Hosts: 195.158.171.60 google.com.pe
      O1 - Hosts: 195.158.171.60 google.com.pk
      O1 - Hosts: 195.158.171.60 google.com.pr
      O1 - Hosts: 195.158.171.60 google.com.py
      O1 - Hosts: 195.158.171.60 google.com.ru
      O1 - Hosts: 195.158.171.60 google.com.sg
      O1 - Hosts: 195.158.171.60 google.com.sv
      O1 - Hosts: 195.158.171.60 google.com.tr
      O1 - Hosts: 195.158.171.60 google.com.tw
      O1 - Hosts: 195.158.171.60 google.com.vc
      O1 - Hosts: 195.158.171.60 google.com.vn
      O1 - Hosts: 195.158.171.60 google.cr
      O1 - Hosts: 195.158.171.60 google.de
      O1 - Hosts: 195.158.171.60 google.dj
      O1 - Hosts: 195.158.171.60 google.do
      O1 - Hosts: 195.158.171.60 google.es
      O1 - Hosts: 195.158.171.60 google.fj
      O1 - Hosts: 195.158.171.60 google.fr
      O1 - Hosts: 195.158.171.60 google.gg
      O1 - Hosts: 195.158.171.60 google.gl
      O1 - Hosts: 195.158.171.60 google.gm
      O1 - Hosts: 195.158.171.60 google.gr
      O1 - Hosts: 195.158.171.60 google.hn
      O1 - Hosts: 195.158.171.60 google.hu
      O1 - Hosts: 195.158.171.60 google.ie
      O1 - Hosts: 195.158.171.60 google.il
      O1 - Hosts: 195.158.171.60 google.in
      O1 - Hosts: 195.158.171.60 google.it
      O1 - Hosts: 195.158.171.60 google.je
      O1 - Hosts: 195.158.171.60 google.jp
      O1 - Hosts: 195.158.171.60 google.kr
      O1 - Hosts: 195.158.171.60 google.kz
      O1 - Hosts: 195.158.171.60 google.ls
      O1 - Hosts: 195.158.171.60 google.lt
      O1 - Hosts: 195.158.171.60 google.lu
      O1 - Hosts: 195.158.171.60 google.lv
      O1 - Hosts: 195.158.171.60 google.ly
      O1 - Hosts: 195.158.171.60 google.mt
      O1 - Hosts: 195.158.171.60 google.mu
      O1 - Hosts: 195.158.171.60 google.mw
      O1 - Hosts: 195.158.171.60 google.my
      O1 - Hosts: 195.158.171.60 google.nf
      O1 - Hosts: 195.158.171.60 google.ni
      O1 - Hosts: 195.158.171.60 google.nl
      O1 - Hosts: 195.158.171.60 google.nz
      O1 - Hosts: 195.158.171.60 google.pa
      O1 - Hosts: 195.158.171.60 google.pe
      O1 - Hosts: 195.158.171.60 google.pk
      O1 - Hosts: 195.158.171.60 google.pl
      O1 - Hosts: 195.158.171.60 google.pn
      O1 - Hosts: 195.158.171.60 google.pr
      O1 - Hosts: 195.158.171.60 google.pt
      O1 - Hosts: 195.158.171.60 google.py
      O1 - Hosts: 195.158.171.60 google.ru
      O1 - Hosts: 195.158.171.60 google.rw
      O1 - Hosts: 195.158.171.60 google.se
      O1 - Hosts: 195.158.171.60 google.sg
      O1 - Hosts: 195.158.171.60 google.sh
      O1 - Hosts: 195.158.171.60 google.sk
      O1 - Hosts: 195.158.171.60 google.sm
      O1 - Hosts: 195.158.171.60 google.sv
      O1 - Hosts: 195.158.171.60 google.td
      O1 - Hosts: 195.158.171.60 google.tr
      O1 - Hosts: 195.158.171.60 google.tw
      O1 - Hosts: 195.158.171.60 google.uz
      O1 - Hosts: 195.158.171.60 google.vc

      et ces 2 la :

      O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

      O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

      Précise tes soucis, si il en reste.

      A+
      4. gtt
        re

        bon mauvaise nouvelle ça me le fait toujour au demarage...
        de + kerio me met une alert de connection par svchost.fr

        à vous....
        1. boulepate
          Salut,

          remet un rapport HijackThis
      5. gtt
        voila le nouveau scan

        Logfile of HijackThis v1.99.1
        Scan saved at 07:47:13, on 09/01/2006
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
        C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
        C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
        C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
        C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
        C:\WINDOWS\system32\RunDll32.exe
        C:\WINDOWS\zHotkey.exe
        C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
        C:\WINDOWS\AGRSMMSG.exe
        C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
        C:\Program Files\Fichiers communs\Talkway\vmtalk.exe
        C:\Program Files\Microsoft IntelliPoint\point32.exe
        C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        C:\Program Files\Microsoft Money\System\mnyexpr.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
        C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
        C:\Program Files\Club-Internet\Lanceur\lanceur.exe
        C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
        C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Documents and Settings\damien\Bureau\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.carrefour.fr/
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr/
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
        O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
        O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
        O4 - HKLM\..\Run: [vmtalk] C:\Program Files\Fichiers communs\Talkway\vmtalk.exe
        O4 - HKLM\..\Run: [BDSwitchAgent] "C:\progra~1\softwin\bitdef~1\bdswitch.exe"
        O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
        O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize
        O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
        O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
        O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
        O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
        O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: Picture Package Menu.lnk = ?
        O4 - Global Startup: Picture Package VCD Maker.lnk = ?
        O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119456806656
        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1121082381687
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
        O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
        O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
        O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
        O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
        O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
        O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
        O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

        à vous de jouer lol

        et d'avance merci...
        1. boulepate
          Rien de spécial .. tu as quoi comme logiciel anti-spyware?

          Puis fait ceci:
          Télécharge SmitfraudFix
          http://siri.urz.free.fr/Fix/SmitfraudFix.zip
          décomprime SmitfraudFix
          Lance le fichier SmitfraudFix, et choisir l’option 1 copie le rapport ici
      6. gtt
        voila le rapport....

        SmitFraudFix v2.12

        Rapport fait à 8:56:54,06 le 09/01/2006
        Executé à partir de C:\Documents and Settings\damien\Bureau\smit\SmitfraudFix
        OS: Microsoft Windows XP [version 5.1.2600]

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32\LogFiles

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\damien\Application Data

        C:\Documents and Settings\damien\Application Data\Install.dat PRESENT !

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
        "Source"="About:Home"
        "SubscribedURL"="About:Home"
        "FriendlyName"="Ma page d'accueil"

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
        "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui"
        "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"

        »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

        »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
      7. gtt
        et 1 de plus lol

        SmitFraudFix v2.12

        Rapport fait à 9:11:02,34 le 09/01/2006
        Executé à partir de C:\Documents and Settings\damien\Bureau\smit\SmitfraudFix
        OS: Microsoft Windows XP [version 5.1.2600]

        »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

        »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

        C:\Documents and Settings\damien\Application Data\Install.dat supprimé
        C:\Program Files\Common Files\VCClient supprimé

        »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage Fichiers Temporaires

        »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

        Nettoyage terminé.

        »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
        2. gtt
          ---------------------------------------------------------
          ewido anti-malware - Rapport de scan
          ---------------------------------------------------------

          + Créé le: 09:44:53, 09/01/2006
          + Somme de contrôle: 9235FDE3

          + Résultats du scan:

          HKU\S-1-5-21-4233972484-3679103368-44858256-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Nettoyer et sauvegarder
          C:\Documents and Settings\damien\Cookies\damien@estat[1].txt -> Spyware.Cookie.Estat : Nettoyer et sauvegarder

          ::Fin du rapport

          désolé je l'avais oublié celui la...
          1. boulepate
            Lol, oui ..

            Remet un rapport HijackThis en precisant ou en sont tes problémes
        3. gtt
          le voila

          Logfile of HijackThis v1.99.1
          Scan saved at 15:07:13, on 09/01/2006
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\RunDll32.exe
          C:\WINDOWS\zHotkey.exe
          C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
          C:\WINDOWS\AGRSMMSG.exe
          C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
          C:\Program Files\Fichiers communs\Talkway\vmtalk.exe
          C:\Program Files\Microsoft IntelliPoint\point32.exe
          C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
          C:\Program Files\Microsoft Money\System\mnyexpr.exe
          C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
          C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
          C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
          C:\Program Files\ewido anti-malware\ewidoctrl.exe
          C:\Program Files\ewido anti-malware\ewidoguard.exe
          C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
          C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
          C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\Program Files\MSN Messenger\msnmsgr.exe
          C:\Documents and Settings\damien\Bureau\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
          O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
          O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
          O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
          O4 - HKLM\..\Run: [vmtalk] C:\Program Files\Fichiers communs\Talkway\vmtalk.exe
          O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
          O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
          O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize
          O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119456806656
          O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1121082381687
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
          O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
          O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
          O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
          O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
          O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
          O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
          O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
          O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
          O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

          alors j'ai desei,stallé la moitier de logiciel de mon Pc pour valider...

          utilisé deux douzaine de programe( adaware,spybot,a²,cc clean, etc....)
          et toujour ce foutu prog qui se met en route 1 à 2 seconde et qui me faite sauter la fenetre en cours d'execution. Que ce soit IE ou un jeu ....

          à toi de voir...
          1. boulepate
            C'est quoi ce programme(nom et fonctionnalité) qui se met en route ?

        Discussions similaires

        Antimalware service Executable consomme 45% de RAM.
        KalenShiv

        8 réponses
        Verrouillage par fermeture de coque Samsung Galaxy
        jicece33

        8 réponses
        Désactiver Antimalware Service Executable
        quentin882

        8 réponses
        Antimalware service executable windows : problème
        Pierre

        11 réponses
        Samsung S22 Allumage écran à l ouverture clapet ?
        broccoli

        3 réponses