[Pop up intempestifs] Popup génants

Question

Salutations, Je suis victime de fenetres de popup publicitaires intempestives ( type publicité pour antivirus, site de rencontres, casino, etc , et arrivant à un rythme constant de 2 fenêtres toutes les demi-heures environ). Juste après leur apparitions je me suis servi de Ad-Aware et de Spybot, mais le problème persiste. J'ai lu des articles évoquant des problèmes du même genre ( par exemple : popup probleme winfixer et autres ) , et je suis conscient qu'ils ont été résolus, cependant, je ne sais pas si la procédure à appliquer est la même pour mon cas.Je vous mets donc mon rapport Hijack this :Logfile of HijackThis v1.99.1Scan saved at 18:40:17, on 17/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\AlienGUIse\wbload.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTSvcCDA.EXEC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\wlancfg.exeC:\WINDOWS\system32\MsPMSPSv.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exeC:\WINDOWS\system32\ishost.exeC:\WINDOWS\system32\issearch.exeC:\WINDOWS\system32\isnotify.exeC:\WINDOWS\system32\CTHELPER.EXEC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\ismon.exeC:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exeC:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exeC:\WINDOWS\system32\RACLE~1\TTRIB~1.EXEC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\wbem\wmiapsrv.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Xfire\Xfire.exeC:\Program Files\Windows NT\Accessoires\WORDPAD.EXEC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\your user name\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.alienware.com/Mothership?Comp=AWEU&SysCode=PC-EU-AURORA-7500&ai=636E3D4532313433343226706F3D45343335313541R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - {F0586656-82E6-806C-CF3D-F6BAD8124EE0} - C:\WINDOWS\system32\bhqkan.dll (file missing)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\system32\ixt0.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO2 - BHO: (no name) - {F0586656-82E6-806C-CF3D-F6BAD8124EE0} - C:\WINDOWS\system32\bhqkan.dll (file missing)O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInitO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Miom] "C:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exe" -vt ndrvO4 - HKCU\..\Run: [Rni] C:\WINDOWS\system32\RACLE~1\TTRIB~1.EXEO4 - Startup: Moniteur & Configuration.lnk = ?O4 - Global Startup: Adobe Gamma Loader.lnk = ?O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO20 - AppInit_DLLs: wbsys.dll C:\WINDOWS\system32\mmc.dllO20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dllO20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dllO20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dllO21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - C:\WINDOWS\system32\pmnqguh.dll (file missing)O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXEO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exeEn espérant que vous puissiez m'aider, car ces popup pourrissent mes parties en ligne et que je suis proche de la calvitie prématurée :( .Merci d'avance,AltärielPs : j'ai mis ce sujet dans la section Virus/sécurité, j'espère qu'il est bien là ou il est :) . S'il doit figurer dans une autre section, merci de m'en avertir. ;)Ps² : au moment ou j'ai fait mon rapport Hijackthis, aucune fenêtre de popup n'était ouverte.

Regis59 · Answer

Salut;Télécharge ceci: (merci a S!RI pour ce programme).http://siri.urz.free.fr/Fix/SmitfraudFix.zipExécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapportCopie/colle le sur le poste stp.----------------------------------------------------------------------------A+

Altäriel · Answer

Re-bonjour,Norton bloque le script en le prenant pour une menace, dois-je suspendre Norton le temps de lancer l'application ?Merci pour vos réponses,Altäriel

Regis59 · Answer

SalutOui. Il n est pas une menace du tout, tu peux me faire confiance.a+

Altäriel · Answer

Salut, Voilà j'ai procédé comme tu m'avais indiqué, j'obtiens ceci :SmitFraudFix v2.73Rapport fait à 10:28:25,69, 18/07/2006Executé à partir de C:\Documents and Settings\your user name\Bureau\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600] - Windows_NTFix executé en mode normal»»»»»»»»»»»»»»»»»»»»»»»» C:\»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32C:\WINDOWS\system32\ishost.exe PRESENT !C:\WINDOWS\system32\ismon.exe PRESENT !C:\WINDOWS\system32\isnotify.exe PRESENT !C:\WINDOWS\system32\issearch.exe PRESENT !C:\WINDOWS\system32\ixt?.dll PRESENT !C:\WINDOWS\system32\ixt??.dll PRESENT !C:\WINDOWS\system32\ot.ico PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\your user name\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\YOURUS~1\FavorisC:\DOCUME~1\YOURUS~1\Favoris\Antivirus Test Online.url PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» Bureau»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]"Source"="About:Home""SubscribedURL"="About:Home""FriendlyName"="Ma page d'accueil" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}"»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll»»»»»»»»»»»»»»»»»»»»»»»» FinJ'attends les prochaines instructions :)a+Altäriel

^^Marie^^ · Answer

Salut,Pour avancer, ENSUITE2°/ - Démarre en mode sans échec : Pour cela, tu tapotes la touche F8 dès le début de l’allumage du PC sans t’arrêter Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape ‘Entrée’ sur ton clavier. Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres, c’est normal ! (Si F8 ne marche pas utilise la touche F5). 3°/ - Relance le programme Smitfraud, Cette fois choisit l’option 2, répond OUI à tout ; Sauvegarde le rapport, redémarre en mode normal,Copie-COLLE le rapport sauvegardé sur le forum.et tu refais un Hitjackthis MerciA++

Altäriel · Answer

Salut,Voici le rapport Smitfraud :SmitFraudFix v2.73Rapport fait à 11:27:45,79, 18/07/2006Executé à partir de C:\Documents and Settings\your user name\Bureau\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600] - Windows_NTFix executé en mode sans echec»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}"»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos FixGenericRenosFix by S!RiC:\WINDOWS\system32\pmnqguh.dll -> Missing File»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectésC:\WINDOWS\system32\ishost.exe suppriméC:\WINDOWS\system32\ismon.exe suppriméC:\WINDOWS\system32\isnotify.exe suppriméC:\WINDOWS\system32\issearch.exe suppriméC:\WINDOWS\system32\ixt?.dll suppriméC:\WINDOWS\system32\ot.ico suppriméC:\DOCUME~1\YOURUS~1\Favoris\Antivirus Test Online.url supprimé»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé.  »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» FinEt le rapport Hijackthis :Logfile of HijackThis v1.99.1Scan saved at 11:34:20, on 18/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\Program Files\AlienGUIse\wbload.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTSvcCDA.EXEC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\wlancfg.exeC:\WINDOWS\system32\MsPMSPSv.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exeC:\WINDOWS\system32\CTHELPER.EXEC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\WINDOWS\system32\RunDLL32.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEC:\Program Files\Messenger\msmsgs.exeC:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exeC:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exeC:\WINDOWS\system32\RACLE~1\TTRIB~1.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\WINDOWS\system32\wuauclt.exeC:\Documents and Settings\your user name\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - {F0586656-82E6-806C-CF3D-F6BAD8124EE0} - C:\WINDOWS\system32\bhqkan.dll (file missing)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO2 - BHO: (no name) - {F0586656-82E6-806C-CF3D-F6BAD8124EE0} - C:\WINDOWS\system32\bhqkan.dll (file missing)O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInitO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Miom] "C:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exe" -vt ndrvO4 - HKCU\..\Run: [Rni] C:\WINDOWS\system32\RACLE~1\TTRIB~1.EXEO4 - Startup: Moniteur & Configuration.lnk = ?O4 - Global Startup: Adobe Gamma Loader.lnk = ?O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO20 - AppInit_DLLs: wbsys.dll C:\WINDOWS\system32\mmc.dllO20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dllO20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXEO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exeMerci pour votre aide,Altäriel

Regis59 · Answer

SalutAh tu devrais deja voir quelques changements.Telecharge cecihttps://www.silentrunners.org/Silent%20Runners.vbs Execute le,atends quelques minutes, il va creer ensuite un dossier juste a coté de silent runner sous format texte, copie/colle ce qu il te donneraA+

Altäriel · Answer

Salut,Oui en effet le nombre de fenêtre a deja diminué :) .Je vais casser la croute et je fais ça après,A toute,Altäriel

Altäriel · Answer

Re-salut,Après un bon sandouiche, et après avoir lancé Silentrunners, j'obtiens ceci :"Silent Runners.vbs", revision 46, https://www.silentrunners.org/Operating System: Windows XP SP2Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\"{98A97CBA-08A3-1036-0303-051116040021}" = ""C:\Program Files\Fichiers communs\{98A97CBA-08A3-1036-0303-051116040021}\Update.exe" mc-110-12-0000272" [null data]HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"RemoteCenter" = "C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE" ["Creative Technology Ltd"]"Steam" = (empty string)"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]"Miom" = ""C:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exe" -vt ndrv" [null data]"Rni" = "C:\WINDOWS\system32\RACLE~1\TTRIB~1.EXE" [null data]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}"ZboardTray" = ""C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe" /autolaunch" [empty string]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"]"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"NvMediaCenter" = "RunDLL32.exe NvMCTray.dll,NvTaskbarInit" [MS]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)  -> {HKLM...CLSID} = "AcroIEHlprObj Class"                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {HKLM...CLSID} = (no title provided)                   \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"  -> {HKLM...CLSID} = "CNavExtBho Class"                   \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]{F0586656-82E6-806C-CF3D-F6BAD8124EE0}\(Default) = (no title provided)  -> {HKLM...CLSID} = (no title provided)                   \InProcServer32\(Default) = "C:\WINDOWS\system32\bhqkan.dll" [file not found]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"  -> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"                   \InProcServer32\(Default) = "deskpan.dll" [file not found]"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {HKLM...CLSID} = "Portable Media Devices"                   \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {HKLM...CLSID} = "Portable Media Devices Menu"                   \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {HKLM...CLSID} = "WinRAR"                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"  -> {HKLM...CLSID} = "DesktopContext Class"                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"  -> {HKLM...CLSID} = "NVIDIA CPL Extension"                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"  -> {HKLM...CLSID} = "Desktop Explorer"                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"  -> {HKLM...CLSID} = (no title provided)                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"  -> {HKLM...CLSID} = "nView Desktop Context Menu"                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"  -> {HKLM...CLSID} = "Shell Search Band"                   \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\INFECTION WARNING! "AppInit_DLLs" = "wbsys.dll C:\WINDOWS\system32\mmc.dll" ["Stardock.Net, Inc"]HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\INFECTION WARNING! WB\DLLName = "C:\Program Files\AlienGUIse\fastload.dll" ["Stardock"]INFECTION WARNING! WgaLogon\DLLName = "WgaLogon.dll" [MS]INFECTION WARNING! winjyp32\DLLName = "winjyp32.dll" [null data]INFECTION WARNING! Zboard\DLLName = "Winlognotif.dll" [null data]HKLM\Software\Classes\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {HKLM...CLSID} = "IEContextMenu Class"                   \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {HKLM...CLSID} = "WinRAR"                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {HKLM...CLSID} = "WinRAR"                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {HKLM...CLSID} = "IEContextMenu Class"                   \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {HKLM...CLSID} = "WinRAR"                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]Active Desktop and Wallpaper:-----------------------------Active Desktop is disabled at this entry:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellStateHKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\your user name\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"Enabled Screen Saver:---------------------HKCU\Control Panel\Desktop\"SCRNSAVE.EXE" = "C:\WINDOWS\system32\ssstars.scr" [MS]Startup items in "your user name" & "All Users" startup folders:----------------------------------------------------------------C:\Documents and Settings\your user name\Menu Démarrer\Programmes\Démarrage"Moniteur & Configuration" -> shortcut to: "C:\Program Files\802.11 Wireless LAN\WlanMonitor.exe" ["ATMEL"]C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]Enabled Scheduled Tasks:------------------------"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"  -> {HKLM...CLSID} = "Norton AntiVirus"                   \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"  -> {HKLM...CLSID} = "Norton AntiVirus"                   \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]Extensions (Tools menu items, main toolbar menu buttons)HKLM\Software\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\"MenuText" = "Console Java (Sun)""CLSIDExtension" = "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}"  -> {HKLM...CLSID} = "Java Plug-in 1.5.0_04"                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll" ["Sun Microsystems, Inc."]{FB5F1910-F110-11D2-BB9E-00C04F795683}\"ButtonText" = "Messenger""MenuText" = "Windows Messenger""Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]Miscellaneous IE Hijack Points------------------------------C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")Added lines (compared with English-language version):[Strings]: SAFESITE_VALUE="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2fintl%2ffr%2f%3f"Missing lines (compared with English-language version):[Strings]: 1 lineHKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\"{F0586656-82E6-806C-CF3D-F6BAD8124EE0}" = (no title provided)  -> {HKLM...CLSID} = (no title provided)                   \InProcServer32\(Default) = "C:\WINDOWS\system32\bhqkan.dll" [file not found]Running Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTSvcCDA.EXE" ["Creative Technology Ltd"]HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]}NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]SAVScan, SAVScan, ""C:\Program Files\Norton AntiVirus\SAVScan.exe"" ["Symantec Corporation"]Service de lancement de WlanCfg, Wlancfg, "C:\WINDOWS\wlancfg.exe SVC" ["Inventel"]Service Norton AntiVirus Auto-Protect, navapsvc, ""C:\Program Files\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]SymWMI Service, SymWSC, ""C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe"" ["Symantec Corporation"]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS]----------+ This report excludes default entries except where indicated.+ To see *everywhere* the script checks and *everything* it finds,  launch it from a command prompt or a shortcut with the -all parameter.+ To search all directories of local fixed drives for DESKTOP.INI  DLL launch points and all Registry CLSIDs for dormant Explorer Bars,  use the -supp parameter or answer "No" at the first message box.---------- (total run time: 34 seconds, including 18 seconds for message boxes)A+,Altä

Regis59 · Answer

SalutC'est tres infecté tout ca.Télécharge la version d'évaluation d'Ewido:https://www.avg.com/en-ww/homepageInstalle et mets à jour.Important: Pendant l'installation, sur la page "Additional Options" décoche les deux options "Install background guard" et "Install scan via context menu". Démarre Ewido avec l'icône qui se trouve sur ton Bureau. Clique sur mise à jour, attendre la fin de cette mise à jour puis, ferme le programme.Redémarre en mode Sans Échec (au démarrage, tapote immédiatement la touche F8, puis tu verras un écran avec choix de démarrages : choisis "Mode sans échec" avec les flèches du clavier, puis valide avec "Entrée". Choisis ton compte usuel (et non Administrateur). Relance Ewido et clique sur scanner puis sur scan complet du système.Si des fichiers infectés sont trouvés, garde l'option par défaut Supprimer (avec la ligne "Créer des copies de sauvegarde cryptées dans la quarantaine" cochée), et coche "Effectuer cette action avec toutes les infections".A la fin du scan, sauvegarde le rapport (Fichier/Enregistrer sous...) sur le Bureau. Redémarre en mode normal.PS: Bon le casse croute? lol

Altäriel · Answer

Salut,C'est grave docteur ? :s* Panique *Je ferai tout ça demain matin, ce soir je n'ai malheuresement pas le temps :( ..Merci pour ton aide,AltäPs : ouai super bon merci. lol

Regis59 · Answer

Re,Tu es infecté mais on va s en sortir t inquietes pas :-)Reviens des que tu peux et surtout ne mange pas trop lola++

Altäriel · Answer

Salut,Deux petites choses, tout d'abord, le lien vers la page FR ne marche pas, j'ai donc téléchargé à partir de la page anglaise.Ensuite, je n'ai pas vu de page " Additional options " pendant l'installation .. Merci d'avanceA bientôt,Altä

Altäriel · Answer

Re, dsl pour le double post, mais je viens de remarquer que des programmes viennent de surgir du néant :Tclock.exeInetget2et ipwinsVoilà, merci de votre aide,Altä

Regis59 · Answer

SalutC'est des elements infectieux.Pour ewido, installe ceci:http://perso.orange.fr/entraide-hijackthis/Ewido/ Scan ton pc avec et supprime tous ce qu il trouve !A+

Altäriel · Answer

Re,Bon j'ai procédé à un scan avec Ewido ( je n'étais pas en mode sans échec ), il a détecté deux menaces élévées mais il signale "error while deleting"  :Trojan.Starter.65 et Downloader.PurityScan.co .Voici le rapport :---------------------------------------------------------ewido anti-spyware - Scan Report--------------------------------------------------------- + Created at:	17:52:39 19/07/2006 + Scan result:	HKU\S-1-5-21-1708537768-1644491937-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{56F1D444-11BF-4879-A12B-79CF0177F038} -> Adware.180Solutions : Cleaned.C:\Documents and Settings\your user name\Application Data\s&#1091;stem\ping.exe -> Downloader.PurityScan.co : Cleaned.C:\Documents and Settings\your user name\Local Settings\Temporary Internet Files\Content.IE5\0J7MUVH8\!update-4095[1].0000 -> Downloader.PurityScan.co : Cleaned.[2424] C:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exe -> Downloader.PurityScan.co : Error during cleaning.C:\WINDOWS\system32\components\flx4.dll -> Not-A-Virus.Hoax.Win32.Renos.dw : Cleaned with backup (quarantined).:mozilla.49:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.50:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.51:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.52:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.53:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.265:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.266:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.267:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.268:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.269:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.270:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.271:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.272:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.273:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.274:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.275:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.276:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.277:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.561:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.638:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.:mozilla.228:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.:mozilla.283:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.:mozilla.806:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.:mozilla.807:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.:mozilla.299:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.:mozilla.795:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.:mozilla.796:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.:mozilla.797:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.:mozilla.798:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.:mozilla.27:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.:mozilla.34:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.:mozilla.154:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.155:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.156:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.157:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.158:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.62:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@install.bestoffersnetworks[2].txt -> TrackingCookie.Bestoffersnetworks : Cleaned.:mozilla.42:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.:mozilla.858:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.:mozilla.330:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.:mozilla.859:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@cz7.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.:mozilla.345:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Com : Cleaned.:mozilla.346:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Com : Cleaned.:mozilla.136:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.:mozilla.137:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.:mozilla.138:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.:mozilla.11:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.:mozilla.369:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Estat : Cleaned.:mozilla.294:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.:mozilla.295:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.:mozilla.296:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.:mozilla.297:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.:mozilla.298:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned.:mozilla.309:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.310:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.311:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.312:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.313:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.314:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.315:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.316:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.317:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.728:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.729:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.730:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.731:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.732:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@as1.falkag[2].txt -> TrackingCookie.Falkag : Cleaned.:mozilla.895:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned.:mozilla.48:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.:mozilla.821:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.:mozilla.822:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.:mozilla.530:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Overture : Cleaned.:mozilla.531:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Overture : Cleaned.:mozilla.247:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.:mozilla.248:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.:mozilla.249:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.:mozilla.829:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.830:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.831:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.832:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.833:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.834:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.835:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.836:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned.:mozilla.329:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.43:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.44:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.45:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.46:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.47:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.744:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.182:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.183:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.184:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.185:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.186:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.187:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.188:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.189:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.190:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.191:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.192:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.193:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.194:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.195:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.196:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.197:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.198:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.199:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.:mozilla.738:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.:mozilla.739:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.:mozilla.23:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.24:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.25:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.26:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.576:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Spylog : Cleaned.:mozilla.579:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.:mozilla.580:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.:mozilla.581:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.:mozilla.582:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.:mozilla.583:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.:mozilla.584:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.:mozilla.585:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.:mozilla.586:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.:mozilla.587:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.:mozilla.588:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.:mozilla.599:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.:mozilla.600:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.:mozilla.100:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.101:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.97:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.98:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.99:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.231:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.:mozilla.95:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.:mozilla.96:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.:mozilla.140:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.:mozilla.141:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.:mozilla.142:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@weborama[2].txt -> TrackingCookie.Weborama : Cleaned.:mozilla.232:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.:mozilla.654:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.:mozilla.663:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.:mozilla.664:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.:mozilla.665:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.:mozilla.163:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.:mozilla.164:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.:mozilla.165:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.:mozilla.166:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.:mozilla.168:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.:mozilla.169:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.:mozilla.170:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.:mozilla.171:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.:mozilla.172:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.:mozilla.173:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.C:\Program Files\Fichiers communs\{98A97CBA-08A3-1036-0303-051116040021}\Update.exe -> Trojan.Starter.65 : Cleaned.[2336] C:\Program Files\Fichiers communs\{98A97CBA-08A3-1036-0303-051116040021}\Update.exe -> Trojan.Starter.65 : Error during cleaning.::Report end* Grosse panique *Merci de me dire ce que je dois faire à présent, je suis à la limite du "nervous breakdown" lol .A+Altä

Regis59 · Answer

SalutLol, il y a un bon nettoyage de fait deja.Remet un HijackThisa+

Altäriel · Answer

Salut, ok, voici le Hijackthis :Logfile of HijackThis v1.99.1Scan saved at 19:29:27, on 19/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\AlienGUIse\wbload.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTSvcCDA.EXEC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\wlancfg.exeC:\WINDOWS\system32\MsPMSPSv.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exeC:\WINDOWS\system32\CTHELPER.EXEC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\WINDOWS\system32\RunDLL32.exeC:\Program Files\ipwins\ipwins.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\RACLE~1\TTRIB~1.EXEC:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exeC:\Program Files\TClock\TClock.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\WINDOWS\system32\wuauclt.exeC:\Documents and Settings\your user name\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - {F0586656-82E6-806C-CF3D-F6BAD8124EE0} - C:\WINDOWS\system32\bhqkan.dll (file missing)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO2 - BHO: (no name) - {F0586656-82E6-806C-CF3D-F6BAD8124EE0} - C:\WINDOWS\system32\bhqkan.dll (file missing)O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Rni] C:\WINDOWS\system32\RACLE~1\TTRIB~1.EXEO4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock	clock_install.exeO4 - Startup: Moniteur & Configuration.lnk = ?O4 - Global Startup: Adobe Gamma Loader.lnk = ?O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO20 - AppInit_DLLs: wbsys.dll C:\WINDOWS\system32\mmc.dllO20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dllO20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exeMerci pour ton aide et ton soutien,A bientôt,Altä

Regis59 · Answer

Bonjour, Méthode à suivre dans l'ordre... ---------------------------------------------------------------------------- ¤Télécharge ces logiciels mais que tu n‘utilises pas tout de suite: 1/Spybot S&D 1.4 https://www.safer-networking.org/ Démo d’utilisation (merci à Balltrap34 pour cette réalisation).http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm2/Ad-Aware SE 1.06 https://www.adaware.com/ -Une aide:http://usa.lucretius-ada.com/zcvisitor/8782d344-4821-11ea-83ce-0a2cdf2c6be7?campaignid=0d1dff40-82d7-11e9-9533-0a157bfa6bfc - installe le patch français, tu pourras le trouver ici: http://download.lavasoft.de.edgesuite.net/public/pllangs.exe et une petite vidéo d'utilisation ici:(merci à Moe31 pour cette réalisation).http://pageperso.aol.fr/balltrap34/adawrevid.asf  4/ Ccleaner :https://www.pcastuces.com/logitheque/ccleaner.htm ---------------------------------------------------------------------------- ¤Affiche tous les fichiers et dossiers : Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage Coche « afficher les fichiers et dossiers cachés » Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" Décoche « masquer les extensions dont le type est connu » Puis fais «Ok» pour valider les changements. Et appliquer !---------------------------------------------------------------------------- ¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :R3 - URLSearchHook: (no name) - {F0586656-82E6-806C-CF3D-F6BAD8124EE0} - C:\WINDOWS\system32\bhqkan.dll (file missing) O2 - BHO: (no name) - {F0586656-82E6-806C-CF3D-F6BAD8124EE0} - C:\WINDOWS\system32\bhqkan.dll (file missing) O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe O20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dll ---------------------------------------------------------------------------- ¤Démarre en mode sans échec : Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! (Si F8 ne marche pas utilise la touche F5).  ----------------------------------------------------------------------------¤Recherche et supprime ceci: attention seulement les fichiers  (si présents).C:\Program Files\ipwins ----------------------------------------------------------------------------¤ Lancer et exécuter Ewido pour un scan complet et copier/coller le rapport en forum.----------------------------------------------------------------------------¤ Passe Ad-Aware et supprime tout ce qu’il trouve + supprime les quarantaines…----------------------------------------------------------------------------¤ Passe Spybot et corrige tout ce qu’il trouve + vaccine + supprime les quarantaines…-------------------------------------------------------------------------------------------¤ Lance CCleaner.  Suppression des fichiers temporairesVa dans la section "Options" situé dans la marge gauche. Va dans "Avancé" et décoche "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Retourne ensuite dans la section "Nettoyeur"Fais bien attention de cocher toutes les cases dans la marge gauche (Internet Explorer/Windows Explorer/Système/Avancé)•	Clique sur Analyse•	Patiente le temps du scan, qui peut prendre un peu de temps si c'est la première fois.•	Une fois le scan terminé, clique sur Lancer le Nettoyage Suppression des incohérence du registre•	Clique sur l'icône Erreurs situés dans la marge à gauche.•	Puis clique sur Analyser les erreurs•	Patiente pendant que CCleaner scan ton registre.•	Une fois le scan terminé, coche toutes les entrèes qu'il t'aura trouvée.•	Tu peux cliquer ensuite sur Corriger les erreurs.Si tu n'est pas sur de ce que tu fais, tu peux choisir de sauvegarder les entrées cochées pour les restaurer ultérieurement----------------------------------------------------------------------------¤ Vide ta Corbeille.----------------------------------------------------------------------------¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.Précise tes soucis s’il en reste.... Tiens-moi au courant  A+

Altäriel · Answer

Salut,J'ai fait tout ce que tu m'avais indiqué,voici le rapport Ewido :---------------------------------------------------------ewido anti-spyware - Scan Report--------------------------------------------------------- + Created at:	11:51:36 20/07/2006 + Scan result:	C:\Documents and Settings\your user name\Application Data\s&#1091;stem\ping.exe -> Downloader.PurityScan.co : Cleaned.C:\Documents and Settings\your user name\Local Settings\Temp\!update.exe -> Downloader.PurityScan.co : Cleaned.C:\Documents and Settings\your user name\Local Settings\Temporary Internet Files\Content.IE5\183B9GHJ\!update-4095[1].0000 -> Downloader.PurityScan.co : Cleaned.:mozilla.10:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.11:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.12:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.13:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.14:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.19:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.20:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.21:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.25:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.:mozilla.22:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.:mozilla.71:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.:mozilla.6:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.7:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.8:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.18:C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.C:\Documents and Settings\your user name\Cookies\your user name@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.::Report endEt le HijackThis :Logfile of HijackThis v1.99.1Scan saved at 12:19:59, on 20/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\AlienGUIse\wbload.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTSvcCDA.EXEC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\wlancfg.exeC:\WINDOWS\system32\MsPMSPSv.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exeC:\WINDOWS\system32\CTHELPER.EXEC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\WINDOWS\system32\RunDLL32.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\RACLE~1\TTRIB~1.EXEC:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exeC:\Program Files\TClock\TClock.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\Documents and Settings\your user name\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInitO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Rni] C:\WINDOWS\system32\RACLE~1\TTRIB~1.EXEO4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock	clock_install.exeO4 - Startup: Moniteur & Configuration.lnk = ?O4 - Global Startup: Adobe Gamma Loader.lnk = ?O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO20 - AppInit_DLLs: wbsys.dll C:\WINDOWS\system32\mmc.dllO20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dllO20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exeJ'espère qu'on touche au but.Sinon je vois toujours le Tclock.exe .Merci pour tout,A bientôt :)

Regis59 · Answer

Re,

1-Rend toi sur ce site :
http://www.virustotal.com/xhtml/virustotal_en.html
Clik sur parcourir
Recherche ceci :
C:\WINDOWS\system32\RACLE~1\TTRIB~1.EXE

Et celui ci aussi C:\Program Files\TClock\tclock_install.exe

Clik send et colle les 2 rapports stp

2-Telecharge ceci
https://www.silentrunners.org/Silent%20Runners.vbs
Execute le,atends quelques minutes, il va creer ensuite un dossier juste a coté de silent runner sous format texte, copie/colle ce qu il te donnera

A+

Altäriel · Answer

Salut,

Je ne trouve pas C:\WINDOWS\system32\RACLE~1\TTRIB~1.EXE
pour effectuer la recherche sur ton site.
Pour Tclock, j'obtiens :

Complete scanning result of "tclock_install.exe", received in VirusTotal at 07.20.2006, 13:20:36 (CET).

Antivirus Version Update Result
AntiVir 6.35.0.21 07.20.2006 TR/Tclock.A.1
Authentium 4.93.8 07.19.2006 no virus found
Avast 4.7.844.0 07.19.2006 no virus found
AVG 386 07.19.2006 no virus found
BitDefender 7.2 07.20.2006 no virus found
CAT-QuickHeal 8.00 07.20.2006 no virus found
ClamAV devel-20060426 07.20.2006 no virus found
DrWeb 4.33 07.20.2006 no virus found
eTrust-InoculateIT 23.72.73 07.20.2006 no virus found
eTrust-Vet 12.6.2303 07.20.2006 no virus found
Ewido 4.0 07.20.2006 no virus found
Fortinet 2.77.0.0 07.19.2006 no virus found
F-Prot 3.16f 07.19.2006 no virus found
F-Prot4 4.2.1.29 07.19.2006 no virus found
Ikarus 0.2.65.0 07.20.2006 no virus found
Kaspersky 4.0.2.24 07.20.2006 no virus found
McAfee 4810 07.19.2006 no virus found
Microsoft 1.1508 07.20.2006 Tclock (threat-c)
NOD32v2 1.1669 07.20.2006 no virus found
Norman 5.90.23 07.20.2006 no virus found
Panda 9.0.0.4 07.20.2006 no virus found
Sophos 4.07.0 07.20.2006 no virus found
Symantec 8.0 07.20.2006 no virus found
TheHacker 5.9.8.178 07.19.2006 no virus found
UNA 1.83 07.19.2006 no virus found
VBA32 3.11.0 07.19.2006 no virus found
VirusBuster 4.3.7:9 07.19.2006 no virus found

Aditional Information
File size: 140133 bytes
MD5: 56c9b143e2e0091f6b99ab8b72f64fa5
SHA1: 2c6617bed598b5007021eadd4b3390bdc1362629

( C'était bien ca que je devais te donner ? )

Ensuite, avec SilentRunners, j'obtiens :

"Silent Runners.vbs", revision 46, https://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
"{98A97CBA-08A3-1036-0303-051116040021}" = ""C:\Program Files\Fichiers communs\{98A97CBA-08A3-1036-0303-051116040021}\Update.exe" mc-110-12-0000272" [file not found]

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"RemoteCenter" = "C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE" ["Creative Technology Ltd"]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"Rni" = "C:\WINDOWS\system32\RACLE~1\TTRIB~1.EXE" [null data]
"TClock.exe" = "C:\Program Files\TClock\tclock_install.exe" [null data]
"Miom" = ""C:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exe" -vt ndrv" [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}
"ZboardTray" = ""C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe" /autolaunch" [empty string]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RunDLL32.exe NvMCTray.dll,NvTaskbarInit" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"
-> {HKLM...CLSID} = "CNavExtBho Class"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
-> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
INFECTION WARNING! "AppInit_DLLs" = "wbsys.dll C:\WINDOWS\system32\mmc.dll" ["Stardock.Net, Inc"]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! WB\DLLName = "C:\Program Files\AlienGUIse\fastload.dll" ["Stardock"]
INFECTION WARNING! WgaLogon\DLLName = "WgaLogon.dll" [MS]
INFECTION WARNING! winjyp32\DLLName = "winjyp32.dll" [null data]
INFECTION WARNING! Zboard\DLLName = "Winlognotif.dll" [null data]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {HKLM...CLSID} = "IEContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {HKLM...CLSID} = "IEContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\your user name\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\ssstars.scr" [MS]

Startup items in "your user name" & "All Users" startup folders:
----------------------------------------------------------------

C:\Documents and Settings\your user name\Menu Démarrer\Programmes\Démarrage
"Moniteur & Configuration" -> shortcut to: "C:\Program Files\802.11 Wireless LAN\WlanMonitor.exe" ["ATMEL"]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
"Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]

Enabled Scheduled Tasks:
------------------------

"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"
-> {HKLM...CLSID} = "Norton AntiVirus"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"
-> {HKLM...CLSID} = "Norton AntiVirus"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Console Java (Sun)"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}"
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_04"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll" ["Sun Microsystems, Inc."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: SAFESITE_VALUE="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2fintl%2ffr%2f%3f"

Missing lines (compared with English-language version):
[Strings]: 1 line

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTSvcCDA.EXE" ["Creative Technology Ltd"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]}
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
SAVScan, SAVScan, ""C:\Program Files\Norton AntiVirus\SAVScan.exe"" ["Symantec Corporation"]
Service de lancement de WlanCfg, Wlancfg, "C:\WINDOWS\wlancfg.exe SVC" ["Inventel"]
Service Norton AntiVirus Auto-Protect, navapsvc, ""C:\Program Files\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]
Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
SymWMI Service, SymWSC, ""C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe"" ["Symantec Corporation"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 27 seconds, including 11 seconds for message boxes)

Voilà,
A+

Regis59 · Answer

Tu peux analyser celui ci:C:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exemerci

Altäriel · Answer

Re,

Voici l'analyse demandée :

Complete scanning result of "ping.exe", received in VirusTotal at 07.20.2006, 13:52:40 (CET).

Antivirus Version Update Result
AntiVir n - no virus found
Authentium n - no virus found
Avast n - no virus found
AVG n - no virus found
BitDefender n - no virus found
CAT-QuickHeal n - no virus found
ClamAV n - no virus found
DrWeb n - no virus found
eTrust-InoculateIT n - no virus found
eTrust-Vet n - no virus found
Ewido n - no virus found
Fortinet n - no virus found
F-Prot n - no virus found
F-Prot4 n - no virus found
Ikarus n - no virus found
Kaspersky n - no virus found
McAfee n - no virus found
Microsoft n - no virus found
NOD32v2 n - no virus found
Norman n - no virus found
Panda n - no virus found
Sophos n - no virus found
Symantec n - no virus found
TheHacker n - no virus found
UNA n - no virus found
VBA32 n - no virus found
VirusBuster n - no virus found

Aditional Information
File size: 0 bytes
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
packers: ACProtect

Alors, ca se présente comment chef ? :-)

A+

Regis59 · Answer

Salut

Fixe ceci:
O4 - HKCU\..\Run: [Rni] C:\WINDOWS\system32\RACLE~1\TTRIB~1.EXE

O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe

O20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dll

Supprime
C:\Program Files\TClock

Redemarre et remet un hijack

a+

Altäriel · Answer

Bonsoir :),Voici le hijackthis :Logfile of HijackThis v1.99.1Scan saved at 22:51:49, on 20/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\AlienGUIse\wbload.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTSvcCDA.EXEC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\wlancfg.exeC:\WINDOWS\system32\MsPMSPSv.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exeC:\WINDOWS\system32\CTHELPER.EXEC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\WINDOWS\system32\RunDLL32.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEC:\Program Files\Messenger\msmsgs.exeC:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exeC:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\your user name\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInitO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Miom] "C:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exe" -vt ndrvO4 - Startup: Moniteur & Configuration.lnk = ?O4 - Global Startup: Adobe Gamma Loader.lnk = ?O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO20 - AppInit_DLLs: wbsys.dll C:\WINDOWS\system32\mmc.dllO20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dllO20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exeVotre verdict maitre ? Le patient est-il en bonne santé ? lolA bientôt :)

Regis59 · Answer

SalutIl reste une petite choseFixe ceciO20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dll SupprimeC:\WINDOWS\SYSTEM32\winjyp32.dll Redemarre et remet un Hijacka+

Altäriel · Answer

Re,Impossible de le supprimer ( Impossible de supprimer Winjyp32 : accès refusé )Comment dois-je m'y prendre ?

Regis59 · Answer

Salut

Essai en mode sans echec mais je pense qu il va falloir chercher plus loin...

¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).

A+

Altäriel · Answer

Salut,Ca n'a rien donné en mode sans échec.* Se cogne la tête très fort sur un mur *J'attends tes instructions :).A bientôt

Regis59 · Answer

Ok,remet moi un hijack this + silent runner stpA+

Altäriel · Answer

Re,

voici le Hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 14:53:57, on 21/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wlancfg.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exe
C:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\a?sembly\w?auboot.exe
C:\Documents and Settings\your user name\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Miom] "C:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exe" -vt ndrv
O4 - HKCU\..\Run: [Tos] C:\Program Files\a?sembly\w?auboot.exe
O4 - Startup: Moniteur & Configuration.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O20 - AppInit_DLLs: wbsys.dll C:\WINDOWS\system32\mmc.dll
O20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dll
O20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exe

Et le silentrunners :

"Silent Runners.vbs", revision 46, https://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
"{98A97CBA-08A3-1036-0303-051116040021}" = ""C:\Program Files\Fichiers communs\{98A97CBA-08A3-1036-0303-051116040021}\Update.exe" mc-110-12-0000272" [file not found]

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"RemoteCenter" = "C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE" ["Creative Technology Ltd"]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"Miom" = ""C:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exe" -vt ndrv" [null data]
"Tos" = "C:\Program Files\a*sembly\w*auboot.exe" (unwritable string) [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}
"ZboardTray" = ""C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe" /autolaunch" [empty string]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RunDLL32.exe NvMCTray.dll,NvTaskbarInit" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"
-> {HKLM...CLSID} = "CNavExtBho Class"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
-> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
INFECTION WARNING! "AppInit_DLLs" = "wbsys.dll C:\WINDOWS\system32\mmc.dll" ["Stardock.Net, Inc"]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! WB\DLLName = "C:\Program Files\AlienGUIse\fastload.dll" ["Stardock"]
INFECTION WARNING! WgaLogon\DLLName = "WgaLogon.dll" [MS]
INFECTION WARNING! winjyp32\DLLName = "winjyp32.dll" [null data]
INFECTION WARNING! Zboard\DLLName = "Winlognotif.dll" [null data]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {HKLM...CLSID} = "IEContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {HKLM...CLSID} = "IEContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\your user name\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\ssstars.scr" [MS]

Startup items in "your user name" & "All Users" startup folders:
----------------------------------------------------------------

C:\Documents and Settings\your user name\Menu Démarrer\Programmes\Démarrage
"Moniteur & Configuration" -> shortcut to: "C:\Program Files\802.11 Wireless LAN\WlanMonitor.exe" ["ATMEL"]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
"Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]

Enabled Scheduled Tasks:
------------------------

"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"
-> {HKLM...CLSID} = "Norton AntiVirus"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"
-> {HKLM...CLSID} = "Norton AntiVirus"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Console Java (Sun)"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}"
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_04"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll" ["Sun Microsystems, Inc."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: SAFESITE_VALUE="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2fintl%2ffr%2f%3f"

Missing lines (compared with English-language version):
[Strings]: 1 line

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Carte de performance WMI, WmiApSrv, "C:\WINDOWS\system32\wbem\wmiapsrv.exe" [MS]
Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTSvcCDA.EXE" ["Creative Technology Ltd"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]}
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
SAVScan, SAVScan, ""C:\Program Files\Norton AntiVirus\SAVScan.exe"" ["Symantec Corporation"]
Service de lancement de WlanCfg, Wlancfg, "C:\WINDOWS\wlancfg.exe SVC" ["Inventel"]
Service Norton AntiVirus Auto-Protect, navapsvc, ""C:\Program Files\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]
Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
SymWMI Service, SymWSC, ""C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe"" ["Symantec Corporation"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 21 seconds, including 3 seconds for message boxes)

Voilà

Norton a bien détecté le Winjyp32, mais il met" impossible de réparer le fichie"r, suivi de "accès au fichier interdit"

Merci et A bientôt

Regis59 · Answer

Salut

Il doit etre relié a autre chose.

Ceci me semble tres curieux:

Rend toi sur ce site :
http://www.virustotal.com/xhtml/virustotal_en.html
Clik sur parcourir
Recherche ceci :
C:\Program Files\a*sembly\w*auboot.exe
Clik send et colle le rapport stp

A+

Altäriel · Answer

Salut,

On nage en plein mystère ? ^^

Voici le rapport :

Complete scanning result of "w_auboot.exe", received in VirusTotal at 07.22.2006, 09:50:39 (CET).

Antivirus Version Update Result
AntiVir n - no virus found
Authentium n - no virus found
Avast n - no virus found
AVG n - no virus found
BitDefender n - no virus found
CAT-QuickHeal n - no virus found
ClamAV n - no virus found
DrWeb n - no virus found
eTrust-InoculateIT n - no virus found
eTrust-Vet n - no virus found
Ewido n - no virus found
Fortinet n - no virus found
F-Prot n - no virus found
F-Prot4 n - no virus found
Ikarus n - no virus found

Kaspersky n - no virus found
McAfee n - no virus found
Microsoft n - no virus found
NOD32v2 n - no virus found
Norman n - no virus found
Panda n - no virus found
Sophos n - no virus found
Symantec n - no virus found
TheHacker n - no virus found
UNA n - no virus found
VBA32 n - no virus found
VirusBuster n - no virus found

Aditional Information
File size: 0 bytes
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
packers: UPX

A bientôt,
Altä

Regis59 · Answer

Salute !Ca va?Lance ce scan stphttps://www.pandasecurity.com/?ref=www.pandasoftware.com/activescan/fr/activescan_principal.htm A+

Altäriel · Answer

Re,Je suis en train de faire le scan, je fais quoi une fois qu'il est fini ? :)A tte, Altä

Regis59 · Answer

Re,tu me donnes le rapport et apres je te dirais quoi ;-)A+

Altäriel · Answer

Bonjour !Désolé j'ai du m'absenter quelques jours,Voici le rapport :Incident                                                                        Statut                        Analyse                                                                                                                                                                                                                                                         Adware:Adware/PurityScan                                                        No Désinfecté                 c:\docume~1\yourus~1\applic~1\sstem~1\ping.exe                                                                                                                                                                                                                  Adware:Adware/PurityScan                                                        No Désinfecté                 C:\WINDOWS\system32\mmc.dll                                                                                                                                                                                                                                     Adware:adware/yazzle                                                            No Désinfecté                 Registre Windows                                                                                                                                                                                                                                                Spyware:Cookie/Xiti                                                             No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.xiti.com/]                                                                                                                                     Spyware:Cookie/RealMedia                                                        No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.247realmedia.com/]                                                                                                                             Spyware:Cookie/Doubleclick                                                      No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.doubleclick.net/]                                                                                                                              Spyware:Cookie/Adtech                                                           No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.adtech.de/]                                                                                                                                    Spyware:Cookie/Mediaplex                                                        No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.mediaplex.com/]                                                                                                                                Spyware:Cookie/Bluestreak                                                       No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.bluestreak.com/]                                                                                                                               Spyware:Cookie/Serving-sys                                                      No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.serving-sys.com/]                                                                                                                              Adware:Adware/PurityScan                                                        No Désinfecté                 C:\Documents and Settings\your user name\Application Data\s?stem\ping.exe                                                                                                                                                                                       Outil indésirable:Application/Processor                                         No Désinfecté                 C:\Documents and Settings\your user name\Bureau\SmitfraudFix\Process.exe                                                                                                                                                                                        Adware:Adware/PurityScan                                                        No Désinfecté                 C:\Documents and Settings\your user name\Local Settings\Temp\!update.exe                                                                                                                                                                                        Adware:Adware/PurityScan                                                        No Désinfecté                 C:\Documents and Settings\your user name\Local Settings\Temporary Internet Files\Content.IE5\ODARCLSJ\!update-4095[1].0000                                                                                                                                      Spyware:Spyware/Virtumonde                                                      No Désinfecté                 C:\Program Files\Fichiers communs\{98A97CBA-08A3-1036-0303-051116040021}\services.dll                                                                                                                                                                           Outil indésirable:Application/Zango                                             No Désinfecté                 C:\Program Files\Mozilla Firefox\plugins
pclntax.dll                                                                                                                                                                                                           Outil indésirable:Application/Processor                                         No Désinfecté                 C:\WINDOWS\system32\Process.exeA bientôt,Altä

Regis59 · Answer

Salut

Télécharge VirtumundoBegone sur le bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions.
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis.
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu.

Altäriel · Answer

Re,Voici le rapport VBG.exe :[07/24/2006, 16:03:51] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\your user name\Bureau\VirtumundoBeGone.exe" )[07/24/2006, 16:04:12] - Detected System Information:[07/24/2006, 16:04:12] -  Windows Version: 5.1.2600, Service Pack 2[07/24/2006, 16:04:12] -  Current Username: your user name (Admin)[07/24/2006, 16:04:12] -  Windows is in NORMAL mode.[07/24/2006, 16:04:12] - Searching for Browser Helper Objects:[07/24/2006, 16:04:12] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)[07/24/2006, 16:04:12] -  BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()[07/24/2006, 16:04:12] - WARNING: BHO has no default name. Checking for Winlogon reference.[07/24/2006, 16:04:12] -  Checking for HKLM\...\Winlogon\Notify\SDHelper[07/24/2006, 16:04:12] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.[07/24/2006, 16:04:12] -  BHO 3: {BDF3E430-B101-42AD-A544-FADC6B084872} (CNavExtBho Class)[07/24/2006, 16:04:12] - Finished Searching Browser Helper Objects[07/24/2006, 16:04:12] - Finishing up...[07/24/2006, 16:04:12] - Nothing found! Exiting...Et le Hijackthis :Logfile of HijackThis v1.99.1Scan saved at 16:08:32, on 24/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\AlienGUIse\wbload.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTSvcCDA.EXEC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\wlancfg.exeC:\WINDOWS\system32\MsPMSPSv.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exeC:\WINDOWS\system32\CTHELPER.EXEC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\WINDOWS\system32\RunDLL32.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEC:\Program Files\Messenger\msmsgs.exeC:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exeC:\Program Files\a?sembly\w?auboot.exeC:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\your user name\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInitO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Miom] "C:\DOCUME~1\YOURUS~1\APPLIC~1\SSTEM~1\ping.exe" -vt ndrvO4 - HKCU\..\Run: [Tos] C:\Program Files\a?sembly\w?auboot.exeO4 - Startup: Moniteur & Configuration.lnk = ?O4 - Global Startup: Adobe Gamma Loader.lnk = ?O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO20 - AppInit_DLLs: wbsys.dll  C:\WINDOWS\system32\mmc.dllO20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dllO20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exeVoilà, ca donne quoi ?A toute, Altä

Regis59 · Answer

SalutAffiche les fichiers cache et supprime cecic:\docume~1\yourus~1\applic~1\sstem~1\ping.exe C:\WINDOWS\system32\mmc.dll C:\Documents and Settings\your user name\Application Data\s?stem\ping.exe C:\Documents and Settings\your user name\Local Settings\Temp\!update.exe  C:\Documents and Settings\your user name\Local Settings\Temporary Internet Files\Content.IE5\ODARCLSJ\!update-4095[1].0000 C:\Program Files\Fichiers communs\{98A97CBA-08A3-1036-0303-051116040021}\services.dll Puis refais un scan sur pandaa+

Altäriel · Answer

Re,J'ai pu supprimer :C:\Documents and Settings\your user name\Local Settings\Temp\!update.exeC:\Documents and Settings\your user name\Local Settings\Temporary Internet Files\Content.IE5\ODARCLSJ\!update-4095[1].0000C:\Program Files\Fichiers communs\{98A97CBA-08A3-1036-0303-051116040021}\services.dll Pour les autres, ca me dit :" Impossible de supprimer : mmc.dll ( de même pour ping.exe )Vérifiez que le dique n'est pas plein ou protégé en écriture, et que le fichier n'est pas utilisé actuellement "Voilà,A+PS : Dis moi, ce soir j'ai rendez vous en guilde sur world of warcraft, ca fait une semaine que je n'ai pas joué par sécurité, est-ce que je peux jouer sans risque ou vaut-il mieux que je m'abstienne ? Merci :)

Regis59 · Answer

SalutSupprime en mode sans echec ceux que tu n as pas reussiPour ton jeu, fait toi plaisir, pas de probleme, vas y !!!!lola+

Altäriel · Answer

Re,En mode sans échec j'ai pu supprimer :c:\docume~1\yourus~1\applic~1\sstem~1\ping.exe Pour C:\WINDOWS\system32\mmc.dl , il me dit la même chose qu'en mode normal :/ .Voilou . Dois-je refaire un scan avec panda ou autre chose ? Merci, je metsdonc fin à ma période de privation ^^.A bientôt

Regis59 · Answer

lolTu peux te faire plaisir ;-)Oui relance un scan stpa+

Altäriel · Answer

Re :)Voici le rapport panda :Incident                                                                        Statut                        Analyse                                                                                                                                                                                                                                                         Adware:Adware/PurityScan                                                        No Désinfecté                 c:\docume~1\yourus~1\mesdoc~1\ecurit~1undll.exe                                                                                                                                                                                                               Adware:Adware/PurityScan                                                        No Désinfecté                 C:\WINDOWS\system32\mmc.dll                                                                                                                                                                                                                                     Adware:adware/yazzle                                                            No Désinfecté                 Registre Windows                                                                                                                                                                                                                                                Outil indésirable:Application/Processor                                         No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\Cache\038E337Bd01[²ƒÇ]                                                                                                                                      Spyware:Cookie/Xiti                                                             No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.xiti.com/]                                                                                                                                     Spyware:Cookie/Doubleclick                                                      No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.doubleclick.net/]                                                                                                                              Spyware:Cookie/Serving-sys                                                      No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.serving-sys.com/]                                                                                                                              Spyware:Cookie/Zedo                                                             No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.c5.zedo.com/]                                                                                                                                  Spyware:Cookie/Zedo                                                             No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.zedo.com/]                                                                                                                                     Spyware:Cookie/Adtech                                                           No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.adtech.de/]                                                                                                                                    Spyware:Cookie/Mediaplex                                                        No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.mediaplex.com/]                                                                                                                                Spyware:Cookie/RealMedia                                                        No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.247realmedia.com/]                                                                                                                             Spyware:Cookie/Weborama                                                         No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.weborama.fr/]                                                                                                                                  Spyware:Cookie/Bluestreak                                                       No Désinfecté                 C:\Documents and Settings\your user name\Application Data\Mozilla\Firefox\Profiles\56fybc5a.default\cookies.txt[.bluestreak.com/]                                                                                                                               Outil indésirable:Application/Processor                                         No Désinfecté                 C:\Documents and Settings\your user name\Bureau\SmitfraudFix\Process.exe                                                                                                                                                                                        Outil indésirable:Application/Processor                                         No Désinfecté                 C:\Documents and Settings\your user name\Bureau\VirtumundoBeGone.exe[²ƒÇ]                                                                                                                                                                                       Spyware:Cookie/Weborama                                                         No Désinfecté                 C:\Documents and Settings\your user name\Cookies\your user name@weborama[2].txt                                                                                                                                                                                 Spyware:Cookie/Xiti                                                             No Désinfecté                 C:\Documents and Settings\your user name\Cookies\your user name@xiti[1].txt                                                                                                                                                                                     Spyware:Cookie/Zedo                                                             No Désinfecté                 C:\Documents and Settings\your user name\Cookies\your user name@zedo[2].txt                                                                                                                                                                                     Adware:Adware/PurityScan                                                        No Désinfecté                 C:\Documents and Settings\your user name\Local Settings\Temp\!update.exe                                                                                                                                                                                        Outil indésirable:Application/Processor                                         No Désinfecté                 C:\Documents and Settings\your user name\Local Settings\Temp
sx5B2.tmp                                                                                                                                                                                         Adware:Adware/PurityScan                                                        No Désinfecté                 C:\Documents and Settings\your user name\Local Settings\Temporary Internet Files\Content.IE5\N0E428GG\!update-4095[1].0000                                                                                                                                      Adware:Adware/PurityScan                                                        No Désinfecté                 C:\Documents and Settings\your user name\Mes documents\?ecurityundll.exe                                                                                                                                                                                      Outil indésirable:Application/Zango                                             No Désinfecté                 C:\Program Files\Mozilla Firefox\plugins
pclntax.dll                                                                                                                                                                                                           Outil indésirable:Application/Processor                                         No Désinfecté                 C:\WINDOWS\system32\Process.exe                                                                                                                                Voilà, merci pour tout,Altä

Altäriel · Answer

Bonjou Regis :)Et oui je suis de retour, car les popups ont fait leur réapparition...Est-ce du au éléments que je n'avais pas pu supprimer ?Dis moi ce que je dois te fournir ( Hijackthis, etc .. )Merci d'avance,Altäriel

Regis59 · Answer

SalutPeux tu remettre un Hijack this stpa+

Altäriel · Answer

Re, le voici :Logfile of HijackThis v1.99.1Scan saved at 23:31:03, on 03/08/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\AlienGUIse\wbload.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTSvcCDA.EXEC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\wlancfg.exeC:\WINDOWS\system32\MsPMSPSv.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exeC:\WINDOWS\system32\ishost.exeC:\WINDOWS\system32\CTHELPER.EXEC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\WINDOWS\system32\RunDLL32.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEC:\Program Files\Messenger\msmsgs.exeC:\DOCUME~1\YOURUS~1\MESDOC~1\ECURIT~1undll.exeC:\WINDOWS\system32\ismon.exeC:\Program Files\a?sembly\w?auboot.exeC:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\WINDOWS\system32\issearch.exeC:\WINDOWS\system32\isnotify.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\your user name\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\system32\ixt0.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\Safety Bar.dllO4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInitO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Miom] "C:\DOCUME~1\YOURUS~1\MESDOC~1\ECURIT~1undll.exe" -vt ndrvO4 - HKCU\..\Run: [Tos] C:\Program Files\a?sembly\w?auboot.exeO4 - Startup: Moniteur & Configuration.lnk = ?O4 - Global Startup: Adobe Gamma Loader.lnk = ?O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO20 - AppInit_DLLs: wbsys.dll   C:\WINDOWS\system32\mmc.dllO20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dllO20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exeVoilà, A+

Regis59 · Answer

reTélécharge ceci: (merci a S!RI pour ce programme).http://siri.urz.free.fr/Fix/SmitfraudFix.zipExécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapportCopie/colle le sur le poste stp.----------------------------------------------------------------------------Démarre en mode sans échec : Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! (Si F8 ne marche pas utilise la touche F5).  ----------------------------------------------------------------------------Relance le programme Smitfraud,Cette fois choisit l’option 2, répond oui a tous ;Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le foruma+

Altäriel · Answer

Re, Voici le premier rapport :SmitFraudFix v2.73Rapport fait à 18:10:58,76, 04/08/2006Executé à partir de C:\Documents and Settings\your user name\Bureau\S‚curit‚\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600] - Windows_NTFix executé en mode normal»»»»»»»»»»»»»»»»»»»»»»»» C:\»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32C:\WINDOWS\system32\ishost.exe PRESENT !C:\WINDOWS\system32\ismon.exe PRESENT !C:\WINDOWS\system32\isnotify.exe PRESENT !C:\WINDOWS\system32\issearch.exe PRESENT !C:\WINDOWS\system32\ixt?.dll PRESENT !C:\WINDOWS\system32\ixt??.dll PRESENT !C:\WINDOWS\system32\ot.ico PRESENT !C:\WINDOWS\system32	s.ico PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\your user name\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\YOURUS~1\FavorisC:\DOCUME~1\YOURUS~1\Favoris\Antivirus Test Online.url PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» Bureau»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll»»»»»»»»»»»»»»»»»»»»»»»» FinEt voici le rapport après le nettoyage en mode sans échec :SmitFraudFix v2.73Rapport fait à 18:16:10,93, 04/08/2006Executé à partir de C:\Documents and Settings\your user name\Bureau\S‚curit‚\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600] - Windows_NTFix executé en mode sans echec»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos FixGenericRenosFix by S!Ri»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectésC:\WINDOWS\system32\ishost.exe suppriméC:\WINDOWS\system32\ismon.exe suppriméC:\WINDOWS\system32\isnotify.exe suppriméC:\WINDOWS\system32\issearch.exe suppriméC:\WINDOWS\system32\ixt?.dll suppriméC:\WINDOWS\system32\ot.ico suppriméC:\WINDOWS\system32	s.ico suppriméC:\DOCUME~1\YOURUS~1\Favoris\Antivirus Test Online.url supprimé»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé.  »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» FinVoilou voilou :)A+( PS : rien à voir avec le sujet, mais le 59 dans ton pseudo, est ce parce que tu es du Nord ? :) )

Regis59 · Answer

SalutOuep je suis du nord pourquoi? Toi aussi? lolRemet un HijackThisTu devrais voir la difference deja.a+

Altäriel · Answer

Re :)Logfile of HijackThis v1.99.1Scan saved at 19:31:57, on 04/08/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\AlienGUIse\wbload.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTSvcCDA.EXEC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\wlancfg.exeC:\WINDOWS\system32\MsPMSPSv.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exeC:\WINDOWS\system32\CTHELPER.EXEC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\WINDOWS\system32\RunDLL32.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEC:\Program Files\Messenger\msmsgs.exeC:\DOCUME~1\YOURUS~1\MESDOC~1\ECURIT~1undll.exeC:\Program Files\a?sembly\w?auboot.exeC:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\your user name\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\Safety Bar.dllO4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInitO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Miom] "C:\DOCUME~1\YOURUS~1\MESDOC~1\ECURIT~1undll.exe" -vt ndrvO4 - HKCU\..\Run: [Tos] C:\Program Files\a?sembly\w?auboot.exeO4 - Startup: Moniteur & Configuration.lnk = ?O4 - Global Startup: Adobe Gamma Loader.lnk = ?O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO20 - AppInit_DLLs: wbsys.dll   C:\WINDOWS\system32\mmc.dllO20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dllO20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exeOui j'ai vu la différence :)Et oui je suis originaire d'Armentières lol .a+

Regis59 · Answer

Moi de cambrai :-)Supprime smitfraudfix de ton pc puis retelecharge le et refais la meme manipTélécharge ceci: (merci a S!RI pour ce programme).http://siri.urz.free.fr/Fix/SmitfraudFix.zipExécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapportCopie/colle le sur le poste stp.----------------------------------------------------------------------------Démarre en mode sans échec : Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! (Si F8 ne marche pas utilise la touche F5).  ----------------------------------------------------------------------------Relance le programme Smitfraud,Cette fois choisit l’option 2, répond oui a tous ;Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum----------------------------------------------------------------------------A+

Altäriel · Answer

Salut, je n'arrive plus à m'identifier sur le site, bizarre ..Enfin bref, voici les rapports :mitFraudFix v2.79Rapport fait à 10:57:10,10, 05/08/2006Executé à partir de C:\Documents and Settings\your user name\Bureau\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600] - Windows_NTFix executé en mode normal»»»»»»»»»»»»»»»»»»»»»»»» C:\»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\your user name\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\YOURUS~1\Favoris»»»»»»»»»»»»»»»»»»»»»»»» Bureau»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\Safety Bar\ PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll»»»»»»»»»»»»»»»»»»»»»»»» FinEt le second :SmitFraudFix v2.79Rapport fait à 11:00:32,04, 05/08/2006Executé à partir de C:\Documents and Settings\your user name\Bureau\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600] - Windows_NTFix executé en mode sans echec»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos FixGenericRenosFix by S!Ri»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectésC:\Program Files\Safety Bar\ supprimé»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé.  »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» FinVoilà :)A+

Regis59 · Answer

Ok super !T'arrives pas a t identifier, prkoi, que se passe t il?Remet un HijackThisa+

Altäriel · Answer

Bonjour Régis :)Désolé de ne pas avoir répondu mais j'étais parti en vacances ^^ .Voici le rapport Hijackthis :Logfile of HijackThis v1.99.1Scan saved at 10:48:06, on 17/08/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\AlienGUIse\wbload.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTSvcCDA.EXEC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\wlancfg.exeC:\WINDOWS\system32\MsPMSPSv.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exeC:\WINDOWS\system32\CTHELPER.EXEC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\WINDOWS\system32\RunDLL32.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEC:\Program Files\Messenger\msmsgs.exeC:\DOCUME~1\YOURUS~1\MESDOC~1\ECURIT~1undll.exeC:\Program Files\a?sembly\w?auboot.exeC:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\TEMP\win44F9.tmp.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\your user name\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInitO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXEO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Miom] "C:\DOCUME~1\YOURUS~1\MESDOC~1\ECURIT~1undll.exe" -vt ndrvO4 - HKCU\..\Run: [Tos] C:\Program Files\a?sembly\w?auboot.exeO4 - Startup: Moniteur & Configuration.lnk = ?O4 - Global Startup: Adobe Gamma Loader.lnk = ?O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO20 - AppInit_DLLs: wbsys.dll   O20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO20 - Winlogon Notify: winjyp32 - C:\WINDOWS\SYSTEM32\winjyp32.dllO20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\WINDOWS\wlancfg.exeA signaler également qu'une fenêtre nommée Dialer se lance de temps en temps ( et forçant ainsi un retour windows assez pénible ), pour me dire ( en italien ) que la connexion ne peut etre établi et que le programme va être arrêté. Voilà je ne sais pas ce que c'est, merci de me venir une fois de plus en aide.A bientôt, Altä

^^Marie^^ · Answer

UP

[Pop up intempestifs] Popup génants

58 réponses

Votre réponse

Discussions similaires

Newsletters