A voir également:
- Virus google
- Google maps satellite - Guide
- Dns google - Guide
- Google earth - Télécharger - 3D
- Google - Guide
- Créer un compte google - Guide
7 réponses
balltrap34
Messages postés
16240
Date d'inscription
jeudi 8 janvier 2004
Statut
Contributeur sécurité
Dernière intervention
28 novembre 2009
331
20 févr. 2006 à 23:05
20 févr. 2006 à 23:05
salut
fait ceci
HijackThis (ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
section virus/logiciel de securite demo animée sur la meme page
tuto animée d instalation d hijackthis http://pageperso.aol.fr/balltrap34/Hijenr.gif
telecharge le et met le dans son propre dossier ex/c :hj
clik sur do a systeme scan et save a logfile
et copier coller le rapport
demo
http://pageperso.aol.fr/balltrap34/demohijack.htm
---------------------------
fait ceci
HijackThis (ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
section virus/logiciel de securite demo animée sur la meme page
tuto animée d instalation d hijackthis http://pageperso.aol.fr/balltrap34/Hijenr.gif
telecharge le et met le dans son propre dossier ex/c :hj
clik sur do a systeme scan et save a logfile
et copier coller le rapport
demo
http://pageperso.aol.fr/balltrap34/demohijack.htm
---------------------------
meme problème
voici mes log hj
--------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 23:29:09, on 20/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Sagem\WLAN Card Utilities\Center.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\Rcman.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\EAX.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\VRC.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Center\RCenter.exe
C:\Program Files\Creative\ShareDLL\MediaDet.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\OSDMenu.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.1:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {8AD0273E-B964-44AB-B07D-EDE2685524FD} - C:\WINDOWS\system32\acleditd.dll
O2 - BHO: (no name) - {A47DE63A-7FFB-065B-8B9D-00A2D8A569C7} - (no file)
O2 - BHO: (no name) - {E6E94D79-DDE3-FF4A-9E0F-ACC81E882AC4} - C:\WINDOWS\system32\upxe.dll
O2 - BHO: (no name) - {EAE94D79-DDE3-8E4C-9E0C-DFC81D892AB1} - C:\WINDOWS\system32\upxe.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Control Center] C:\Program Files\Sagem\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\Rcman.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://ts.clariteam.com/msrdp.cab
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {A5173EA8-1337-4BAB-A67E-198C9919D9CC} (Loader Class) - http://213.11.100.127/websetup/websetup2.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab30149.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/2.0.0.33/player.virtools.com/downloads/player/Install2.0/Installer.exe
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCCDA.EXE
O23 - Service: DirectX Service (DirectSefs) - Unknown owner - c:\windows\system32\directx.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
---------------------------------------
voici mes log hj
--------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 23:29:09, on 20/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Sagem\WLAN Card Utilities\Center.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\Rcman.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\EAX.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\VRC.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Center\RCenter.exe
C:\Program Files\Creative\ShareDLL\MediaDet.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\OSDMenu.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.1:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {8AD0273E-B964-44AB-B07D-EDE2685524FD} - C:\WINDOWS\system32\acleditd.dll
O2 - BHO: (no name) - {A47DE63A-7FFB-065B-8B9D-00A2D8A569C7} - (no file)
O2 - BHO: (no name) - {E6E94D79-DDE3-FF4A-9E0F-ACC81E882AC4} - C:\WINDOWS\system32\upxe.dll
O2 - BHO: (no name) - {EAE94D79-DDE3-8E4C-9E0C-DFC81D892AB1} - C:\WINDOWS\system32\upxe.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Control Center] C:\Program Files\Sagem\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\Rcman.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://ts.clariteam.com/msrdp.cab
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {A5173EA8-1337-4BAB-A67E-198C9919D9CC} (Loader Class) - http://213.11.100.127/websetup/websetup2.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab30149.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/2.0.0.33/player.virtools.com/downloads/player/Install2.0/Installer.exe
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCCDA.EXE
O23 - Service: DirectX Service (DirectSefs) - Unknown owner - c:\windows\system32\directx.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
---------------------------------------
Nilou17
Messages postés
2349
Date d'inscription
samedi 13 août 2005
Statut
Modérateur
Dernière intervention
3 janvier 2022
1 475
20 janv. 2007 à 23:37
20 janv. 2007 à 23:37
Bonsoir.
Relance HijackThis et coche les cases devant les lignes suivantes :
O2 - BHO: (no name) - {8AD0273E-B964-44AB-B07D-EDE2685524FD} - C:\WINDOWS\system32\acleditd.dll
O2 - BHO: (no name) - {A47DE63A-7FFB-065B-8B9D-00A2D8A569C7} - (no file)
O2 - BHO: (no name) - {E6E94D79-DDE3-FF4A-9E0F-ACC81E882AC4} - C:\WINDOWS\system32\upxe.dll
O2 - BHO: (no name) - {EAE94D79-DDE3-8E4C-9E0C-DFC81D892AB1} - C:\WINDOWS\system32\upxe.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
+ toutes les lignes 016
Puis clique sur [Fix Checked]
Supprime ces fichiers :
C:\WINDOWS\system32\upxe.dll
C:\WINDOWS\system32\acleditd.dll
A la fin de cette manipulation, remets un nouveau log HijackThis.
A++++
Relance HijackThis et coche les cases devant les lignes suivantes :
O2 - BHO: (no name) - {8AD0273E-B964-44AB-B07D-EDE2685524FD} - C:\WINDOWS\system32\acleditd.dll
O2 - BHO: (no name) - {A47DE63A-7FFB-065B-8B9D-00A2D8A569C7} - (no file)
O2 - BHO: (no name) - {E6E94D79-DDE3-FF4A-9E0F-ACC81E882AC4} - C:\WINDOWS\system32\upxe.dll
O2 - BHO: (no name) - {EAE94D79-DDE3-8E4C-9E0C-DFC81D892AB1} - C:\WINDOWS\system32\upxe.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
+ toutes les lignes 016
Puis clique sur [Fix Checked]
Supprime ces fichiers :
C:\WINDOWS\system32\upxe.dll
C:\WINDOWS\system32\acleditd.dll
A la fin de cette manipulation, remets un nouveau log HijackThis.
A++++
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Nilou17
Messages postés
2349
Date d'inscription
samedi 13 août 2005
Statut
Modérateur
Dernière intervention
3 janvier 2022
1 475
21 janv. 2007 à 17:22
21 janv. 2007 à 17:22
Salut ! :-)
Peux-tu remettre, juste pour vérifier, un nouveau log d'HijackThis ?
Merci. ;-)
Peux-tu remettre, juste pour vérifier, un nouveau log d'HijackThis ?
Merci. ;-)
boitagant
Messages postés
1
Date d'inscription
samedi 19 mai 2007
Statut
Membre
Dernière intervention
19 mai 2007
19 mai 2007 à 11:58
19 mai 2007 à 11:58
Bonjour,
J'ai exactement le même problème : virus sur google qui dirige les liens vers d'autres pages que celles souhaitées.
Voici mon rapport.
Merci d'avance.
Logfile of HijackThis v1.99.1
Scan saved at 11:37:17, on 19/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Apps\ActivBoard\nhksrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Program
Files\Freenet\bin\wrapper-windows-x86-32.exe
C:\Program Files\Fichiers communs\Microsoft
Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\java.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Virtual CD v4
SDK\system\vcssecs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Virtual CD v4
SDK\system\vcsplay.exe
C:\WINDOWS\tppaldr.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Program Files\iNote\iNote.exe
C:\Apps\ActivBoard\MMKeybd.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers
communs\Real\Update_OB\realsched.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Apps\ActivBoard\OSD.exe
C:\Program Files\Mindjet\MindManager
6\MMReminderService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Vidalia\vidalia.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Tracker Software\PDF-XChange
3\pdfSaver\pdfSaver3.exe
C:\Program
Files\Google\GoogleToolbarNotifier\1.2.908.5008\Goog
leToolbarNotifier.exe
C:\Program Files\Harrap's
Multimédia\Shorter\bin\HiHarrapsTray.exe
C:\Program Files\Privoxy\privoxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.5.0_08\bin\jucheck.exe
C:\Program Files\Tor\tor.exe
C:\Documents and Settings\Fr\Mes documents\PIM
C\EssentialPIM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Start Page =
https://www.hautetfort.com/login.php
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL =
https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Search_URL =
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Search Page =
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet
Explorer\Main,Start Page =
https://www.msn.com/fr-fr/?ocid=iehp
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Inter
net Settings,ProxyServer = 127.0.0.1:80
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Inter
net Settings,ProxyOverride = ;localhost
R0 - HKCU\Software\Microsoft\Internet
Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Altavista Toolbar -
{4E7BD74F-2B8D-469E-92EA-EC65A294AE31} -
C:\PROGRA~1\ALTAVI~1\ALTAVI~1.DLL
O2 - BHO: (no name) -
{53707962-6F74-2D53-2644-206D7942484F} - C:\Program
Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) -
{60DF4425-F36F-42D7-AECF-A409EBE4558C} -
C:\PROGRA~1\MICROA~1\INTERN~1\tbcghost.dll
O2 - BHO: SSVHelper Class -
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program
Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: ST -
{9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program
Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program
files\google\googletoolbar1.dll
O2 - BHO: CmjBrowserHelperObject Object -
{AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program
Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: MSNToolBandBHO -
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program
Files\MSN Apps\MSN Toolbar\MSN
Toolbar\01.02.5000.1021\fr-ch\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper -
{C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program
Files\PDFCreator
Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: (no name) -
{FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program
Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN -
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program
Files\MSN Apps\MSN Toolbar\MSN
Toolbar\01.02.5000.1021\fr-ch\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de
fenêtres pop-up -
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program
Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: SimonTools -
{CC48EB38-F950-48C0-9F22-D64F829AE3DF} -
C:\PROGRA~1\MICROA~1\INTERN~1\tbcghost.dll
O3 - Toolbar: &Google -
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar -
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program
Files\PDFCreator
Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Altavista Toolbar -
{4E7BD74F-2B8D-469E-92EA-EC65A294AE31} -
C:\PROGRA~1\ALTAVI~1\ALTAVI~1.DLL
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program
Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TPP Auto Loader]
C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck]
C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [iNote] C:\Program
Files\iNote\iNote.exe
O4 - HKLM\..\Run: [EM_EXEC]
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [drawsoftwarestupidplatform]
C:\Documents and Settings\All Users\Application
Data\Cake flaw draw software\soapwipe.exe
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe
-autorun
O4 - HKLM\..\Run: [CleanEasyImg]
c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [ActivSurf]
C:\apps\ActivSurf\4448364\Program\backweb-4448364.ex
e
O4 - HKLM\..\Run: [ACTIVBOARD]
C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [itype] "C:\Program
Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program
Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Site joy media else] C:\Documents
and Settings\All Users\Application
Data\plancompsitejoy\ownsjugs.exe
O4 - HKLM\..\Run: [KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program
Files\Fichiers communs\Real\Update_OB\realsched.exe"
-osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program
Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [MMReminderService] C:\Program
Files\Mindjet\MindManager 6\MMReminderService.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program
Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Update Service]
C:\PROGRA~1\FICHIE~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\Run: [Pense-Bête] C:\Program
Files\Pense-bete\pb79b.exe
O4 - HKCU\..\Run: [peak plan]
C:\DOCUME~1\Fr\APPLIC~1\SOAPCU~1\Acid flap.exe
O4 - HKCU\..\Run: [LDM] C:\Program
Files\Logitech\Desktop
Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Vidalia] "C:\Program
Files\Vidalia\vidalia.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program
Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program
Files\Tracker Software\PDF-XChange
3\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [swg] C:\Program
Files\Google\GoogleToolbarNotifier\1.2.908.5008\Goog
leToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program
Files\Adobe\Acrobat
7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
-reboot 1
O4 - Global Startup: Ask Harrap's Shorter.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk
= C:\Program Files\Logitech\Desktop
Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk =
C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Privoxy.lnk = C:\Program
Files\Privoxy\privoxy.exe
O8 - Extra context menu item: Recherche AltaVista -
file://C:\Documents and Settings\Fr\Application
Data\ALTAVISTA\SelectedContextSearch_Recherche
AltaVista.htm
O8 - Extra context menu item: Save with Download
Manager... - file://C:\Program Files\J River\Media
Center 11\DMDownload.htm
O8 - Extra context menu item: Traduction -
file://C:\Documents and Settings\Fr\Application
Data\ALTAVISTA\SelectedContextTranslation.htm
O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Packard Bell -
{1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} -
C:\Apps\IECustom\script.htm
O9 - Extra button: Send to Mindjet MindManager -
{531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program
Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: (no name) -
{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide -
{E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program
Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) -
{e2e2dd38-d088-4134-82b7-f2ba38496583} -
%windir%\Network Diagnostic\xpnetdiag.exe (file
missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
{e2e2dd38-d088-4134-82b7-f2ba38496583} -
%windir%\Network Diagnostic\xpnetdiag.exe (file
missing)
O9 - Extra button: Ghost Navigator -
{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program
Files\Ghost Navigator2_6_0\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator -
{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program
Files\Ghost Navigator2_6_0\Ghost (file missing)
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF:
START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE}
(TDServer Control) -
http://fr.encyclopedia.yahoo.com/rsc/tdserver.cab
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545}
(FVLiteLoad Class) -
http://digitalflip.net/fvlite22/fvlite.cab
O16 - DPF: {BA83FD38-CE14-4DA3-BEF5-96050D55F78A} -
https://www.flipviewer.com/exe/fvgen1.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7}
(Photodex Presenter AX control) -
http://www.photodex.com/pxplay.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF}
(Live365Player Class) -
https://live365.com/
O23 - Service: avast! iAVS4 Control Service
(aswUpdSv) - Unknown owner - C:\Program Files\Alwil
Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner -
C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner -
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe"
/service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner -
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe"
/service (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd -
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: Freenet 0.7 darknet-8888
(freenet-darknet-8888) - Unknown owner - C:\Program
Files\Freenet\bin\wrapper-windows-x86-32.exe" -s
"C:\Program Files\Freenet\wrapper.conf (file
missing)
O23 - Service: InstallDriver Table Manager
(IDriverT) - Macrovision Corporation - C:\Program
Files\Fichiers
communs\InstallShield\Driver\1150\Intel
32\IDriverT.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown
owner - C:\Apps\ActivBoard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc)
- NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner -
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: SmartLinkService (SLService) - -
C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK -
Version) (VCSSecS) - H+H Software GmbH - C:\Program
Files\Virtual CD v4 SDK\system\vcssecs.exe
J'ai exactement le même problème : virus sur google qui dirige les liens vers d'autres pages que celles souhaitées.
Voici mon rapport.
Merci d'avance.
Logfile of HijackThis v1.99.1
Scan saved at 11:37:17, on 19/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Apps\ActivBoard\nhksrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Program
Files\Freenet\bin\wrapper-windows-x86-32.exe
C:\Program Files\Fichiers communs\Microsoft
Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\java.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Virtual CD v4
SDK\system\vcssecs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Virtual CD v4
SDK\system\vcsplay.exe
C:\WINDOWS\tppaldr.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Program Files\iNote\iNote.exe
C:\Apps\ActivBoard\MMKeybd.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers
communs\Real\Update_OB\realsched.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Apps\ActivBoard\OSD.exe
C:\Program Files\Mindjet\MindManager
6\MMReminderService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Vidalia\vidalia.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Tracker Software\PDF-XChange
3\pdfSaver\pdfSaver3.exe
C:\Program
Files\Google\GoogleToolbarNotifier\1.2.908.5008\Goog
leToolbarNotifier.exe
C:\Program Files\Harrap's
Multimédia\Shorter\bin\HiHarrapsTray.exe
C:\Program Files\Privoxy\privoxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.5.0_08\bin\jucheck.exe
C:\Program Files\Tor\tor.exe
C:\Documents and Settings\Fr\Mes documents\PIM
C\EssentialPIM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Start Page =
https://www.hautetfort.com/login.php
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL =
https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Search_URL =
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Search Page =
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet
Explorer\Main,Start Page =
https://www.msn.com/fr-fr/?ocid=iehp
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Inter
net Settings,ProxyServer = 127.0.0.1:80
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Inter
net Settings,ProxyOverride = ;localhost
R0 - HKCU\Software\Microsoft\Internet
Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Altavista Toolbar -
{4E7BD74F-2B8D-469E-92EA-EC65A294AE31} -
C:\PROGRA~1\ALTAVI~1\ALTAVI~1.DLL
O2 - BHO: (no name) -
{53707962-6F74-2D53-2644-206D7942484F} - C:\Program
Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) -
{60DF4425-F36F-42D7-AECF-A409EBE4558C} -
C:\PROGRA~1\MICROA~1\INTERN~1\tbcghost.dll
O2 - BHO: SSVHelper Class -
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program
Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: ST -
{9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program
Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program
files\google\googletoolbar1.dll
O2 - BHO: CmjBrowserHelperObject Object -
{AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program
Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: MSNToolBandBHO -
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program
Files\MSN Apps\MSN Toolbar\MSN
Toolbar\01.02.5000.1021\fr-ch\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper -
{C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program
Files\PDFCreator
Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: (no name) -
{FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program
Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN -
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program
Files\MSN Apps\MSN Toolbar\MSN
Toolbar\01.02.5000.1021\fr-ch\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de
fenêtres pop-up -
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program
Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: SimonTools -
{CC48EB38-F950-48C0-9F22-D64F829AE3DF} -
C:\PROGRA~1\MICROA~1\INTERN~1\tbcghost.dll
O3 - Toolbar: &Google -
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar -
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program
Files\PDFCreator
Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Altavista Toolbar -
{4E7BD74F-2B8D-469E-92EA-EC65A294AE31} -
C:\PROGRA~1\ALTAVI~1\ALTAVI~1.DLL
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program
Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TPP Auto Loader]
C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck]
C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [iNote] C:\Program
Files\iNote\iNote.exe
O4 - HKLM\..\Run: [EM_EXEC]
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [drawsoftwarestupidplatform]
C:\Documents and Settings\All Users\Application
Data\Cake flaw draw software\soapwipe.exe
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe
-autorun
O4 - HKLM\..\Run: [CleanEasyImg]
c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [ActivSurf]
C:\apps\ActivSurf\4448364\Program\backweb-4448364.ex
e
O4 - HKLM\..\Run: [ACTIVBOARD]
C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [itype] "C:\Program
Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program
Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Site joy media else] C:\Documents
and Settings\All Users\Application
Data\plancompsitejoy\ownsjugs.exe
O4 - HKLM\..\Run: [KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program
Files\Fichiers communs\Real\Update_OB\realsched.exe"
-osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program
Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [MMReminderService] C:\Program
Files\Mindjet\MindManager 6\MMReminderService.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program
Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Update Service]
C:\PROGRA~1\FICHIE~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\Run: [Pense-Bête] C:\Program
Files\Pense-bete\pb79b.exe
O4 - HKCU\..\Run: [peak plan]
C:\DOCUME~1\Fr\APPLIC~1\SOAPCU~1\Acid flap.exe
O4 - HKCU\..\Run: [LDM] C:\Program
Files\Logitech\Desktop
Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program
Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Vidalia] "C:\Program
Files\Vidalia\vidalia.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program
Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program
Files\Tracker Software\PDF-XChange
3\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [swg] C:\Program
Files\Google\GoogleToolbarNotifier\1.2.908.5008\Goog
leToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program
Files\Adobe\Acrobat
7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
-reboot 1
O4 - Global Startup: Ask Harrap's Shorter.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk
= C:\Program Files\Logitech\Desktop
Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk =
C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Privoxy.lnk = C:\Program
Files\Privoxy\privoxy.exe
O8 - Extra context menu item: Recherche AltaVista -
file://C:\Documents and Settings\Fr\Application
Data\ALTAVISTA\SelectedContextSearch_Recherche
AltaVista.htm
O8 - Extra context menu item: Save with Download
Manager... - file://C:\Program Files\J River\Media
Center 11\DMDownload.htm
O8 - Extra context menu item: Traduction -
file://C:\Documents and Settings\Fr\Application
Data\ALTAVISTA\SelectedContextTranslation.htm
O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Packard Bell -
{1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} -
C:\Apps\IECustom\script.htm
O9 - Extra button: Send to Mindjet MindManager -
{531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program
Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: (no name) -
{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide -
{E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program
Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) -
{e2e2dd38-d088-4134-82b7-f2ba38496583} -
%windir%\Network Diagnostic\xpnetdiag.exe (file
missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
{e2e2dd38-d088-4134-82b7-f2ba38496583} -
%windir%\Network Diagnostic\xpnetdiag.exe (file
missing)
O9 - Extra button: Ghost Navigator -
{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program
Files\Ghost Navigator2_6_0\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator -
{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program
Files\Ghost Navigator2_6_0\Ghost (file missing)
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF:
START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE}
(TDServer Control) -
http://fr.encyclopedia.yahoo.com/rsc/tdserver.cab
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545}
(FVLiteLoad Class) -
http://digitalflip.net/fvlite22/fvlite.cab
O16 - DPF: {BA83FD38-CE14-4DA3-BEF5-96050D55F78A} -
https://www.flipviewer.com/exe/fvgen1.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7}
(Photodex Presenter AX control) -
http://www.photodex.com/pxplay.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF}
(Live365Player Class) -
https://live365.com/
O23 - Service: avast! iAVS4 Control Service
(aswUpdSv) - Unknown owner - C:\Program Files\Alwil
Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner -
C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner -
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe"
/service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner -
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe"
/service (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd -
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: Freenet 0.7 darknet-8888
(freenet-darknet-8888) - Unknown owner - C:\Program
Files\Freenet\bin\wrapper-windows-x86-32.exe" -s
"C:\Program Files\Freenet\wrapper.conf (file
missing)
O23 - Service: InstallDriver Table Manager
(IDriverT) - Macrovision Corporation - C:\Program
Files\Fichiers
communs\InstallShield\Driver\1150\Intel
32\IDriverT.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown
owner - C:\Apps\ActivBoard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc)
- NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner -
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: SmartLinkService (SLService) - -
C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK -
Version) (VCSSecS) - H+H Software GmbH - C:\Program
Files\Virtual CD v4 SDK\system\vcssecs.exe