pc lent Fermé

Question

Bonjour, 

j'espere pouvoir trouver parmis vous solution à mon probleme,
depuis quelques jours j'ai remarqué que mon pc etait lent, on m'a conseillé de telecharger ZHP Diag, chose que j'ai faite mais je ne sais pas interpreter le rapport, meme chose pour le rapport ad remover,
sinon, ben j'utilise AVG et malewarebytes-antimalware

comment faire??

merci

PS: pc acer sous Windows XP

jacques.gache · Answer

bonjour, postes les rapports , pour ad-remover directement ici sur la discution en faisant un copier coller du contenue du doccument texte , mais pour ZHPDiag poste le par le biais de cijoint !! 

envoie-le sur : http://www.cijoint.fr/index.php 

fais parcourir comme sur la capture d'écran : http://sd-1.archive-host.com/membres/images/89820622056365782/cijoint_ima_1.jpg

recherche le rapport :http://sd-1.archive-host.com/membres/images/89820622056365782/cijoint_ima2.jpg

sélectionne le rapport soit en cliquand dessus et ouvrir ou en double cliquand dessus 

et puis sur " cliquer ici pour déposer le fichier " : http://sd-1.archive-host.com/membres/images/89820622056365782/cijoint_ima3.jpg

un lien bleu de cette forme va apparaitre :

Veuillez noter le lien ci-dessous qui vous permettra d'accéder à ce fichier. 
C'est ce même lien que vous devrez transmettre à vos correspondants
http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt 


comme sur l'image: 
http://sd-1.archive-host.com/membres/images/89820622056365782/cijjoint_ima4.jpg

et c'est ce lien qu'il te faut copier coller sur la discution , merci

emeralds · Answer

merci pour la reponse
voici le rapport ad romover

======= REPORT FROM AD-REMOVER 2.0.0.2,D | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 20/01/11 at 19:00
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
website: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Launched at 21:30:03 on 24/01/2011, Normal boot

Microsoft Windows XP Professional Service Pack 3 (X86) 
Nick@NASHLAPTOP ( ) 
 
============== ACTION(S) ==============


File deleted: C:\WINDOWS\system32\ConduitEngine.tmp
Folder deleted: C:\Documents and Settings\Nick\Local Settings\Application Data\Conduit
Folder deleted: C:\Program Files\Conduit
Folder deleted: C:\Documents and Settings\Nick\Local Settings\Application Data\ConduitEngine
Folder deleted: C:\Program Files\ConduitEngine
Folder deleted: C:\Documents and Settings\Nick\Application Data\PriceGong

(!) -- Temporary files deleted.


Key deleted: HKLM\Software\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key deleted: HKLM\Software\Classes\CLSID\{601ac3dc-786a-4eb0-bf40-ee3521e70bfb}
Key deleted: HKLM\Software\Classes\CLSID\{678E1125-3A1A-49EF-9352-848E6AC51414}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{678E1125-3A1A-49EF-9352-848E6AC51414}
Key deleted: HKLM\Software\Classes\CLSID\{72b3882f-453a-4633-aac9-8c3dced62aff}
Key deleted: HKLM\Software\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key deleted: HKLM\Software\Classes\Conduit.Engine
Key deleted: HKLM\Software\Classes\Toolbar.CT2124320
Key deleted: HKLM\Software\Classes\Toolbar.CT2535305
Key deleted: HKLM\Software\Conduit
Key deleted: HKLM\Software\conduitEngine
Key deleted: HKCU\Software\Conduit
Key deleted: HKCU\Software\conduitEngine
Key deleted: HKCU\Software\PriceGong
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8608441B-9E83-484F-9BC2-A4ED851D2924}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine

Value deleted: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{30F9B915-B755-4826-820B-08FBA6BD249D}
Value deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{30F9B915-B755-4826-820B-08FBA6BD249D}


============== ADDITIONNAL SCAN ==============

** Internet Explorer Version [8.0.6001.18702] **

[HKCU\Software\Microsoft\Internet Explorer\Main] 
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main] 
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS] 
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 90 File(s)
C:\Program Files\Ad-Remover\Backup: 14 File(s)

C:\Ad-Report-SCAN[1].txt - 23/01/2011 (3766 Byte(s)) 
C:\Ad-Report-CLEAN[1].txt - 24/01/2011 (870 Byte(s)) 

End at: 21:32:30, 24/01/2011 
 
============== E.O.F ============== 

je vais suivre les instructions pour poster l'autre
merci

emeralds · Answer

voici le lien pour le rapport ZHP Diag

http://www.cijoint.fr/cjlink.php?file=cj201101/cijv4ZuREr.txt

emeralds · Answer

ok
ben pour le ad remover, c'est ce que j'ai fait, le rapport que je vous ai posté etait apres nettoyage et redemarage du pc
pour malwarebytes ben je l'ai deja et j'ai fait une analyse rapide, donc si je comprends bien je vais devoir refaire une analyse complete

merci beaucoup, je vais faire ce qu'il faut

emeralds · Answer

bonsoir

pour commencer voici le rapport de usbfix

############################## | UsbFix 7.038 | [Research]

User: Nick (Administrator) # NASHLAPTOP [ ]
Updated 14/01/2011 by El Desaparecido / C_XX
Started at 22:07:34 | 26/01/2011
Website: http://www.teamxscript.org
Contact: eldesaparecido@teamxscript.org

CPU: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz
CPU 2: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz
Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 8.0.6001.18702

Windows Firewall: Disabled /!\
Antivirus: AVG Anti-Virus Free Edition 2011 10.0 [Enabled | Updated]
RAM -> 2038 Mb 
C:\ (%systemdrive%) -> Fixed drive # 53 Gb (8 Mb free - 14%) [ACER] # FAT32
D:\ -> Fixed drive # 54 Gb (39 Mb free - 72%) [ACERDATA] # FAT32
E:\ -> CD-ROM
F:\ -> Removable drive # 964 Mb (12 Mb free - 1%) [CHAFIKA] # FAT
G:\ -> CD-ROM

################## | Files # Infected Folders |


Found ! C:\WINDOWS\system32\autorun
Found ! C:\WINDOWS\system32\Autorun.ini
Found ! C:\AUTORUN.INF
Found ! D:\AUTORUN.INF

################## | Registry |

Found ! HKLM\software\microsoft\windows nt\currentversion\winlogon|Taskman

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\F
Shell\AutoRun\Command = F:\msdll.exe CD
Shell\explore\Command = F:\msdll.exe CD
Shell\open\Command = F:\msdll.exe CD

HKCU\.\.\.\.\Explorer\MountPoints2\H
Shell\AutoRun\Command = H:\msdll.exe CD
Shell\explore\Command = H:\msdll.exe CD
Shell\open\Command = H:\msdll.exe CD

HKCU\.\.\.\.\Explorer\MountPoints2\{02f66920-25d1-11df-8eb8-0016d4646122}
Shell\AutoRun\Command = t8g.exe
Shell\open\Command = t8g.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{1211dd70-938f-11dd-8cad-0016d4646122}
Shell\AutoRun\Command = wscript.exe .\.vbs
Shell\open\Command = wscript.exe .\.vbs

HKCU\.\.\.\.\Explorer\MountPoints2\{3934dc8c-2af0-11df-8ec0-0016d4646122}
Shell\AutoRun\Command = H:\AutoRun.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{3934dc8d-2af0-11df-8ec0-0016d4646122}
Shell\AutoRun\Command = H:\AutoRun.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{495a8702-ecce-11de-8e6d-0016d4646122}
Shell\aUtOPlAy\Command = F:\balbma.exe
Shell\AutoRun\Command = F:\balbma.exe
Shell\ExPlOre\Command = F:\balbma.exe
Shell\OpEn\Command = F:\balbma.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{5243da6e-cd6e-11de-8e54-0016d4646122}
Shell\AutoRun\Command = F:\AutoRun.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{5243da6f-cd6e-11de-8e54-0016d4646122}
Shell\AutoRun\Command = F:\AutoRun.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{537e1222-19e4-11dc-8a5b-806d6172696f}
Shell\AutoRun\Command = msdll.exe CD
Shell\explore\Command = msdll.exe CD
Shell\open\Command = msdll.exe CD

HKCU\.\.\.\.\Explorer\MountPoints2\{537e1223-19e4-11dc-8a5b-806d6172696f}
Shell\AutoRun\Command = msdll.exe CD
Shell\explore\Command = msdll.exe CD
Shell\open\Command = msdll.exe CD

HKCU\.\.\.\.\Explorer\MountPoints2\{5d8b8838-79a8-11dd-8c77-0016d4646122}
Shell\AutoRun\Command = F:\xih9.cmd
Shell\explore\Command = F:\xih9.cmd
Shell\open\Command = F:\xih9.cmd

HKCU\.\.\.\.\Explorer\MountPoints2\{b902c368-3644-11dd-8c10-0016d4646122}
Shell\AutoRun\Command = F:\StartVMCLite.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{b902c369-3644-11dd-8c10-0016d4646122}
Shell\AutoRun\Command = F:\StartVMCLite.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{bf826c1c-05c1-11e0-8fee-0016d4646122}
Shell\AutoRun\Command = U3ROM/system32.exe
Shell\explore\Command = U3ROM/system32.exe
Shell\open\Command = U3ROM/system32.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{d1671476-9513-11dd-8cb2-0016d4646122}
Shell\AutoRun\Command = wscript.exe .\.vbs
Shell\open\Command = wscript.exe .\.vbs

HKCU\.\.\.\.\Explorer\MountPoints2\{d72257a8-746c-11dd-8c6c-0016d4646122}
Shell\AutoRun\Command = wscript.exe .\.vbs
Shell\open\Command = wscript.exe .\.vbs


################## | Vaccin |

C:\Autorun.inf -> Folder created by Panda USB Vaccine
D:\Autorun.inf -> Folder created by Panda USB Vaccine

################## | E.O.F |


et voici le rapport de ZPHDiag

http://www.cijoint.fr/cjlink.php?file=cj201101/cij16n8qH1.txt

merci pour votre aide

emeralds · Answer

bonjour,
c'est vrai j'avais malcompris, voici le rapport de la suppression:

############################## | UsbFix 7.038 | [Deletion]

User: Nick (Administrator) # NASHLAPTOP [ ]
Updated 14/01/2011 by El Desaparecido / C_XX
Started at 11:08:17 | 28/01/2011
Website: http://www.teamxscript.org
Contact: eldesaparecido@teamxscript.org

CPU: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz
CPU 2: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz
Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 8.0.6001.18702

Windows Firewall: Disabled /!\
Antivirus: AVG Anti-Virus Free Edition 2011 10.0 [Enabled | Updated]
RAM -> 2038 Mb 
C:\ (%systemdrive%) -> Fixed drive # 53 Gb (8 Mb free - 14%) [ACER] # FAT32
D:\ -> Fixed drive # 54 Gb (39 Mb free - 72%) [ACERDATA] # FAT32
E:\ -> CD-ROM
F:\ -> Removable drive # 964 Mb (12 Mb free - 1%) [CHAFIKA] # FAT
G:\ -> CD-ROM
H:\ -> Removable drive # 255 Mb (213 Mb free - 83%) [ CHAFIKA] # FAT

################## | Files # Infected Folders |


Deleted ! C:\WINDOWS\system32\autorun
Deleted ! C:\WINDOWS\system32\Autorun.ini
Deleted ! C:\Recycler\S-1-5-21-0175921455-9335478796-504816735-7729
Deleted ! C:\Recycler\S-1-5-21-9053922070-7865078747-518874714-8777
Deleted ! C:\Recycler\S-1-5-21-8887373424-2512875561-253658919-7176
Deleted ! C:\Recycler\S-1-5-21-0638460363-1539085767-406147083-4579
Deleted ! C:\Recycler\S-1-5-21-9831153200-6426361657-433295007-4505
Deleted ! C:\AUTORUN.INF
Deleted ! D:\AUTORUN.INF

################## | Registry |

Deleted ! HKLM\software\microsoft\windows nt\currentversion\winlogon|Taskman

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\F
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\H
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{1211dd70-938f-11dd-8cad-0016d4646122}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{3934dc8c-2af0-11df-8ec0-0016d4646122}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{495a8702-ecce-11de-8e6d-0016d4646122}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{5243da6f-cd6e-11de-8e54-0016d4646122}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{5d8b8838-79a8-11dd-8c77-0016d4646122}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{b902c368-3644-11dd-8c10-0016d4646122}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{bf826c1c-05c1-11e0-8fee-0016d4646122}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{d1671476-9513-11dd-8cb2-0016d4646122}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{d72257a8-746c-11dd-8c6c-0016d4646122}

################## | Listing |

[15/10/2004 - 10:04:08 | D ] 	C:\DOCS
[15/10/2004 - 10:04:08 | D ] 	C:\DOTNETFX
[10/08/2006 - 13:27:10 | D ] 	C:\I386
[15/10/2004 - 10:12:02 | D ] 	C:\SUPPORT
[26/07/2008 - 23:50:46 | D ] 	C:\FOUND.000
[15/10/2004 - 16:42:18 | D ] 	C:\CMPNENTS
[26/08/2008 - 14:55:02 | D ] 	C:\FOUND.001
[07/09/2008 - 16:41:40 | D ] 	C:\FOUND.002
[09/09/2008 - 23:18:46 | D ] 	C:\FOUND.003
[12/09/2008 - 07:05:52 | D ] 	C:\FOUND.004
[10/08/2006 - 13:27:04 | D ] 	C:\Book
[10/08/2006 - 13:27:04 | D ] 	C:\Sysinfo
[10/08/2006 - 13:27:06 | D ] 	C:\WINDOWS
[18/08/2006 - 21:40:02 | D ] 	C:\Documents and Settings
[18/08/2006 - 21:52:34 | D ] 	C:\Program Files
[18/08/2006 - 22:47:02 | D ] 	C:\Acer
[11/11/2010 - 21:13:52 | N | 250048] 	C:
tldr
[10/08/2004 - 20:00:00 | N | 47564] 	C:\NTDETECT.COM
[22/01/2011 - 00:16:54 | N | 209] 	C:\boot.ini
[18/08/2006 - 21:54:18 | N | 0] 	C:\CONFIG.SYS
[18/08/2006 - 22:41:54 | N | 50] 	C:\AUTOEXEC.BAT
[18/08/2006 - 21:54:18 | N | 0] 	C:\IO.SYS
[18/08/2006 - 21:54:18 | N | 0] 	C:\MSDOS.SYS
[18/08/2006 - 22:31:32 | N | 519] 	C:\RHDSetup.log
[19/08/2006 - 08:27:58 | N | 84] 	C:\Preload.aaa
[09/11/2008 - 21:57:28 | D ] 	C:\FOUND.005
[24/11/2008 - 22:41:30 | D ] 	C:\FOUND.006
[11/11/1999 - 00:17:54 | N | 49] 	C:\MCE.TAG
[06/01/2009 - 14:46:28 | D ] 	C:\FOUND.007
[16/01/2009 - 21:57:32 | D ] 	C:\FOUND.008
[28/01/2011 - 11:03:02 | ASH | 2137116672] 	C:\hiberfil.sys
[19/02/2009 - 14:12:40 | D ] 	C:\FOUND.009
[09/03/2009 - 20:02:46 | D ] 	C:\FOUND.010
[30/03/2009 - 07:24:12 | D ] 	C:\FOUND.011
[19/04/2009 - 22:31:24 | D ] 	C:\FOUND.012
[06/06/2009 - 21:31:32 | D ] 	C:\FOUND.013
[26/07/2009 - 19:52:40 | D ] 	C:\FOUND.014
[27/07/2009 - 21:17:48 | N | 262144] 	C:
tuser.dat
[27/07/2009 - 21:17:48 | N | 1024] 	C:
tuser.dat.LOG
[30/07/2009 - 17:35:40 | D ] 	C:\FOUND.015
[16/08/2009 - 18:22:12 | D ] 	C:\FOUND.016
[28/01/2011 - 11:03:00 | ASH | 2145386496] 	C:\pagefile.sys
[10/11/2009 - 16:39:52 | D ] 	C:\FOUND.017
[17/10/2009 - 22:59:38 | N | 8582] 	C:\Rescued document.txt
[13/11/2009 - 13:38:40 | D ] 	C:\FOUND.018
[29/06/2010 - 17:53:20 | D ] 	C:\FOUND.019
[17/08/2010 - 19:10:38 | D ] 	C:\FOUND.020
[18/08/2010 - 01:44:16 | RSHD ] 	C:\RECYCLER
[21/10/2010 - 17:51:36 | D ] 	C:\FOUND.025
[20/08/2010 - 16:14:34 | D ] 	C:\FOUND.021
[21/09/2010 - 10:46:18 | D ] 	C:\FOUND.022
[02/10/2010 - 21:25:52 | D ] 	C:\FOUND.023
[03/10/2010 - 10:27:16 | D ] 	C:\FOUND.024
[18/10/2010 - 21:34:42 | D ] 	C:\$AVG
[08/11/2010 - 08:08:52 | D ] 	C:\FOUND.026
[17/12/2010 - 16:27:26 | D ] 	C:\Config.Msi
[12/11/2010 - 14:26:58 | D ] 	C:\FOUND.027
[18/11/2010 - 19:03:32 | D ] 	C:\FOUND.028
[18/11/2010 - 19:14:52 | D ] 	C:\FOUND.029
[15/12/2010 - 15:53:30 | D ] 	C:\FOUND.030
[06/01/2011 - 15:46:00 | D ] 	C:\FOUND.031
[23/01/2011 - 18:06:44 | N | 3766] 	C:\Ad-Report-SCAN[1].txt
[24/01/2011 - 21:32:48 | N | 4021] 	C:\Ad-Report-CLEAN[1].txt
[26/01/2011 - 22:00:42 | D ] 	C:\UsbFix
[28/01/2011 - 11:07:02 | N | 1543] 	C:\UsbFix.txt
[08/06/2007 - 22:52:24 | SHD ] 	C:\Recycled
[13/06/2007 - 20:32:28 | SHD ] 	C:\System Volume Information
[14/06/2007 - 14:18:48 | D ] 	C:	emp
[09/08/2008 - 15:01:10 | D ] 	C:\Drivers
[06/10/2010 - 11:46:38 | D ] 	D:\soudan
[21/06/2010 - 20:17:00 | D ] 	D:\DOWNLOADS
[06/10/2010 - 10:52:02 | D ] 	D:\New Folder
[06/10/2010 - 10:46:04 | D ] 	D:\diaporama
[18/10/2010 - 21:34:44 | D ] 	D:\$AVG
[02/03/2010 - 08:43:28 | D ] 	D:\a839d603486090459f
[06/10/2010 - 11:03:18 | D ] 	D:\Album inconnu (07-05-2008 11-25-31)
[08/06/2007 - 15:02:34 | RHD ] 	D:\MSOCache
[08/06/2007 - 15:09:02 | SHD ] 	D:\Recycled
[13/06/2007 - 20:35:22 | SHD ] 	D:\System Volume Information
[30/01/2008 - 16:12:46 | D ] 	D:\3d118205ade34047a41f49b23f43
[22/04/2008 - 11:58:32 | D ] 	D:\Outlook Express Data
[01/09/2008 - 07:29:24 | D ] 	D:\MyWorks

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
D:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_NASHLAPTOP.zip
http://www.teamxscript.org/Upload.php
Thank you for your contribution.

################## | E.O.F |

merci dfe votre aide

Pc lent

6 réponses