Firefox infecté par Trojan-Spy.HTML.Bayfraud. Résolu

Question

Bonjour,Il y a quelques jours les marques pages de firefox ont disparu a partir de la lettre "G" , et plus moyens d'en enregister de nouveaux .L'ouverture de la fenetre  firefox se fait toujours a gauche, on ne peut plus la changer de place et la roulette de la souris ne fonctionne plus sur les fenetres firefox.Et je me suis rendu compte que j'avais été innoculé par un "Trojan-Spy.HTML.Bayfraud.dq" a partir d'un pishing Paypal.Le problème maintenant c'est que je ne sais pas comment m'en débarasser, surtout que je n'y connais pas grand chose.Est ce que que quelqu'un pourrait m'aider à  enlever ce trojan pour que je puisse enfin récupérer Firefox comme il était avant cet incident, je vous joins le scan fait par Kasperski online:Merci d'avance a tous  mercredi 26 juillet 2006 10:25:19Système d'exploitation : Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)Version de Kaspersky On-line Scanner: 5.0.78.0Dernière mise à jour de la base antivirus Kaspersky : 26/07/2006Enregistrements dans la base antivirus Kaspersky : 209890Paramètres d'analyseAnalyser avec la base antivirus suivante 	étendueAnalyser les archives 	vraiAnalyser les bases de messagerie. 	vraiCible de l'analyse 	Poste de travailC:\D:\E:\Statistiques de l'analyseTotal d'objets analysés : 	106553Nombre de virus trouvés 	1Nombre d'objets infectés 	3Nombre d'objets suspects 	0Durée de l'analyse 	01:02:32Nom de l'objet infecté 	Nom du virus 	Dernière actionC:\Documents and Settings\Christian\Application Data\Thunderbird\Profiles\51hjfn1z.default\Mail\Local Folders\Paypal/[From "service@paypal.fr" ][Date Sun, 04 Jun 2006 23:26:08 -0700]/text/[From ][Date Mon, 10 Jul 2006 06:59:01 -0600]/text 	Infecté: Trojan-Spy.HTML.Bayfraud.dq 	ignoréC:\Documents and Settings\Christian\Application Data\Thunderbird\Profiles\51hjfn1z.default\Mail\Local Folders\Paypal/[From "service@paypal.fr" ][Date Sun, 04 Jun 2006 23:26:08 -0700]/text 	Infecté: Trojan-Spy.HTML.Bayfraud.dq 	ignoréC:\Documents and Settings\Christian\Application Data\Thunderbird\Profiles\51hjfn1z.default\Mail\Local Folders\Paypal 	Mail Berkeley mbox: infecté - 2 	ignoréAnalyse terminée.encore une fois merci a tous

Regis59 · Answer

SalutTu fais des achats via Paypal? Ben si oui, arrete pour l instant !! C est grave un pishingtélécharge HijackThis ici: https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html Dézippe le dans un dossier prévu à cet effet. Par exemple C:\hijackthis < Enregistre le bien dans c : ! Démo : (Merci a Balltrap34 pour cette réalisation)   http://pageperso.aol.fr/balltrap34/Hijenr.gif Lance le puis: clique sur "do a system scan and save logfile" (cf démo) faire un copier coller du log entier sur le forumDémo : (Merci a Balltrap34 pour cette réalisation)   http://pageperso.aol.fr/balltrap34/demohijack.htm	Bon courageA+

xety · Answer

Bonjour et merci pour ta réponse rapide, voici le copier-coler du HijackThis:Logfile of HijackThis v1.99.1Scan saved at 18:18:17, on 26/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Google\Gmail Notifier\gnotify.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exeC:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exeC:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exeC:\WINDOWS\ALCWZRD.EXEC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exeC:\Program Files\Fichiers communs\SmartCom\RTEGPRS.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\RFA\rfagent.exeC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exeC:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exeC:\WINDOWS\system32\slserv.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\HighjackThis\HijackThis.exeC:\Program Files\FreshDevices\FreshDownload\fd.exeC:\Documents and Settings\Christian\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&gl=FR&ceid=FR:frR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htmR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\pchealth\helpctr\System\panels\blank.htmR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\pchealth\helpctr\System\panels\blank.htmR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dllO2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dllO2 - BHO: (no name) - {49E0E0F0-5C30-11D4-945D-000000000010} - (no file)O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)O2 - BHO: (no name) - {6A373B7E-496E-424f-A9BE-486A5E9AB018} - (no file)O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: CAdBlocker Object - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - (no file)O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: (no name) - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - (no file)O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dllO3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdiebar.dllO4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exeO4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNCO4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMENameO4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -startO4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startupO4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exeO4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKCU\..\Run: [RTEGPRS] "C:\Program Files\Fichiers communs\SmartCom\RTEGPRS.exe" trayO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [rfagent] "C:\Program Files\RFA\rfagent.exe"O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.htmlO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~3\office11\EXCEL.EXE/3000O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://c:\PROGRA~1\MICROS~3\office11\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Antivirus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dllO9 - Extra button: Micro Application Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra 'Tools' menuitem: Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: FreshDownload - {FED69157-888F-421B-9D5C-83B7791E2ABB} - C:\Program Files\FreshDevices\FreshDownload\fd.exeO9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote K - IE 6.htm (HKCU)O9 - Extra button: Dictionnaire - {FB4AE6A3-EE20-442c-9189-251885352358} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote D - IE 6.htm (HKCU)O9 - Extra button: Synonymes - {FDD637F8-2693-49ce-817E-1AD59574900C} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote S - IE 6.htm (HKCU)O9 - Extra button: Conjugueur - {FF229BEC-9E1F-48c1-99A6-AF34ABEFAB0A} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote C - IE 6.htm (HKCU)O9 - Extra button: Grammaire - {FFB5EE7F-726F-423e-83C2-572FE7CEB3F0} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote G - IE 6.htm (HKCU)O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htmO16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.frO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site....O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {E862C832-3A5F-4CEB-BFAA-167B22010A71} (InfosFinder2.InfosFinder) - http://support.packardbell.com/files/activex/InfosFinder2.CABO16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.auctiva.com/hostedimages/activex/xupload/XUpload.ocxO17 - HKLM\System\CCS\Services\Tcpip\..\{1386713D-BD6C-4D77-BBE6-A6A2985CA822}: NameServer = 212.27.39.134O20 - AppInit_DLLs: CLKERN.DLL C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLLO20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exeO23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: MysqlInventime -   - (no file)O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeMerci encore une fois, je crois que c'est la grande pagaille dans mon pc avec ces histoires de trojan

Regis59 · Answer

SalutCa va encore, j ai deja vu pire ;-)Telecharge et installe ewidohttp://perso.orange.fr/entraide-hijackthis/Ewido/Scan ton pc avec et fournit moi le rapporta+

Lyonnais92 · Answer

Bonjour xety,Pour avancer Regis (salut),No action taken (rapport Ewido) = "j'ai vu mais j'ai rien fait ".Tu relances Ewido et tu nettoyes.Bonne suite.

xety · Answer

Bonjour Lyonnais92 et merci du coup de main, donc voici le nouveau scan:---------------------------------------------------------ewido anti-spyware - Scan Report--------------------------------------------------------- + Created at:	13:15:20 27/07/2006 + Scan result:	HKU\S-1-5-21-786671917-3830974030-1495346035-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} -> Adware.2020Search : Cleaned.:mozilla.13:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.14:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.15:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.16:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.17:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.18:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.19:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.20:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.21:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.22:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned.:mozilla.54:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.57:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.58:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.59:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.60:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.61:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.62:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.63:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.64:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.65:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.66:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.67:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.68:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.69:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.70:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.71:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.72:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.73:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.74:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.75:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.76:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.77:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.797:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.79:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.80:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.81:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.82:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.83:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.84:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.85:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.86:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.87:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.88:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.89:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.90:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.91:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.92:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.:mozilla.93:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@lsfnetwork.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@microsoftoffice.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.:mozilla.404:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.:mozilla.407:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.:mozilla.96:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.97:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.98:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.99:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.:mozilla.294:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.:mozilla.281:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.:mozilla.590:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.:mozilla.651:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.:mozilla.952:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.:mozilla.545:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.:mozilla.546:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.:mozilla.576:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Casinotropez : Cleaned.:mozilla.577:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Casinotropez : Cleaned.:mozilla.578:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Casinotropez : Cleaned.:mozilla.579:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Casinotropez : Cleaned.:mozilla.580:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Casinotropez : Cleaned.:mozilla.581:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Casinotropez : Cleaned.:mozilla.582:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Casinotropez : Cleaned.:mozilla.583:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Casinotropez : Cleaned.:mozilla.667:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned.:mozilla.181:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.:mozilla.677:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Com : Cleaned.:mozilla.458:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.:mozilla.459:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.:mozilla.460:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.:mozilla.903:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Counted : Cleaned.:mozilla.308:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.:mozilla.437:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.438:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.439:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.557:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.695:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.696:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.697:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.698:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.699:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.700:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.701:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.702:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.703:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.704:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.705:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@e-2dj6wfkokiajmhp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@e-2dj6wfmiwhczigp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@e-2dj6wjny-1kcjmd.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.:mozilla.35:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Estat : Cleaned.:mozilla.478:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Estat : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@estat[1].txt -> TrackingCookie.Estat : Cleaned.:mozilla.289:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.290:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.291:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.292:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.293:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.383:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.384:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.385:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.386:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.387:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.388:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.389:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.390:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.:mozilla.391:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@as1.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.:mozilla.542:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.:mozilla.543:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.:mozilla.544:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.:mozilla.547:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.:mozilla.913:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Itrack : Cleaned.:mozilla.914:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Itrack : Cleaned.:mozilla.915:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Itrack : Cleaned.:mozilla.929:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.:mozilla.930:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.:mozilla.931:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.:mozilla.441:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.:mozilla.24:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Overture : Cleaned.:mozilla.25:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Overture : Cleaned.:mozilla.808:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Overture : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.:mozilla.349:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.:mozilla.350:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.:mozilla.109:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.110:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.111:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.112:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.113:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.331:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.332:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.333:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.334:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.335:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.336:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.:mozilla.119:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.:mozilla.33:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.:mozilla.165:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.166:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.167:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.26:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.27:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.28:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.29:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.30:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.31:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Cleaned.:mozilla.329:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.:mozilla.102:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.105:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.106:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.107:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.108:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.109:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.110:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.111:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.112:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.113:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.115:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.116:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.117:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.118:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.119:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.120:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.121:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.122:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.123:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.124:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.125:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.126:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.127:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.128:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.129:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.130:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.131:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.132:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.133:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.134:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.135:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.136:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.137:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.187:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.188:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.189:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.190:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.191:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.192:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.193:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.:mozilla.396:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.:mozilla.195:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.:mozilla.560:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.:mozilla.100:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.:mozilla.103:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.:mozilla.104:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.:mozilla.37:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.:mozilla.38:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.:mozilla.39:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\ubd9nmg6.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@weborama[1].txt -> TrackingCookie.Weborama : Cleaned.:mozilla.473:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.:mozilla.474:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.:mozilla.475:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@yadro[2].txt -> TrackingCookie.Yadro : Cleaned.:mozilla.896:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.:mozilla.897:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.:mozilla.898:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.:mozilla.889:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.:mozilla.890:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.:mozilla.891:C:\Documents and Settings\Christian\Application Data\Mozilla\Firefox\Profiles\7wvcuz5j.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.C:\Documents and Settings\Christian\Cookies\christian@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.::Report end

Regis59 · Answer

Ok,remet un HijackThisa+

xety · Answer

Salut Régis,Je te remet un HighjackThis:Dis moi comment se fait il que mon antivirus Kaspersky ne detruit pas le triojan, il l'a mis en quarantaine seulement.Logfile of HijackThis v1.99.1Scan saved at 10:48:24, on 28/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Google\Gmail Notifier\gnotify.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exeC:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exeC:\WINDOWS\ALCWZRD.EXEC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exeC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\Program Files\Fichiers communs\SmartCom\RTEGPRS.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\RFA\rfagent.exeC:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exeC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exeC:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\WINDOWS\system32\slserv.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\HighjackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&gl=FR&ceid=FR:frR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htmR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\pchealth\helpctr\System\panels\blank.htmR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\pchealth\helpctr\System\panels\blank.htmR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dllO2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dllO2 - BHO: (no name) - {49E0E0F0-5C30-11D4-945D-000000000010} - (no file)O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)O2 - BHO: (no name) - {6A373B7E-496E-424f-A9BE-486A5E9AB018} - (no file)O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: CAdBlocker Object - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - (no file)O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: (no name) - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - (no file)O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dllO3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdiebar.dllO4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exeO4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNCO4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMENameO4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -startO4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startupO4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exeO4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimizedO4 - HKCU\..\Run: [RTEGPRS] "C:\Program Files\Fichiers communs\SmartCom\RTEGPRS.exe" trayO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [rfagent] "C:\Program Files\RFA\rfagent.exe"O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.htmlO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~3\office11\EXCEL.EXE/3000O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://c:\PROGRA~1\MICROS~3\office11\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Antivirus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dllO9 - Extra button: Micro Application Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra 'Tools' menuitem: Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: FreshDownload - {FED69157-888F-421B-9D5C-83B7791E2ABB} - C:\Program Files\FreshDevices\FreshDownload\fd.exeO9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote K - IE 6.htm (HKCU)O9 - Extra button: Dictionnaire - {FB4AE6A3-EE20-442c-9189-251885352358} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote D - IE 6.htm (HKCU)O9 - Extra button: Synonymes - {FDD637F8-2693-49ce-817E-1AD59574900C} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote S - IE 6.htm (HKCU)O9 - Extra button: Conjugueur - {FF229BEC-9E1F-48c1-99A6-AF34ABEFAB0A} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote C - IE 6.htm (HKCU)O9 - Extra button: Grammaire - {FFB5EE7F-726F-423e-83C2-572FE7CEB3F0} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote G - IE 6.htm (HKCU)O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htmO16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.frO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site....O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {E862C832-3A5F-4CEB-BFAA-167B22010A71} (InfosFinder2.InfosFinder) - http://support.packardbell.com/files/activex/InfosFinder2.CABO16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.auctiva.com/hostedimages/activex/xupload/XUpload.ocxO17 - HKLM\System\CCS\Services\Tcpip\..\{1386713D-BD6C-4D77-BBE6-A6A2985CA822}: NameServer = 212.27.39.134O20 - AppInit_DLLs: CLKERN.DLL C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLLO20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exeO23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: MysqlInventime -   - (no file)O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeMerci a toi et a plus.

Regis59 · Answer

Salutkav, est un antivirus donc sa fonction c est les virus meme s il s oriente un peu vers les trojans.Je peux savoir ce qu il te detecte?Rend toi sur ce site :http://www.virustotal.com/xhtml/virustotal_en.html Clik sur parcourirRecherche ceci :C:\Program Files\RFA\rfagent.exeClik send et colle le rapport stpA+

xety · Answer

Voici ce qu'indique KAV: -placé en quarantaine : cheval de Troie Trojan-Spy.HTML.Fraud.gen (modification) Le message: [From:"PayPal" ][Subject:Update your account information within 72 hours to avoid suspension][Time:2006/05/31 03:57:56] ext/html Potentiellement infecté : cheval de Troie Trojan-Spy.HTML.Fraud.gen (modification) [From:"PayPal" ][Subject:Update your account information within 72 hours to avoid suspension][Time:2006/05/31 03:57:56] ext/html 5.3 Ko 25/07/2006 10:13:26 Et voici le rapport du dernier scan que tu m'as demandé d'effectuer: Complete scanning result of "rfagent.exe", received in VirusTotal at 07.28.2006, 12:47:11 (CET). Antivirus Version Update Result AntiVir 6.35.1.0 07.28.2006 no virus found Authentium 4.93.8 07.28.2006 no virus found Avast 4.7.844.0 07.26.2006 no virus found AVG 386 07.27.2006 no virus found BitDefender 7.2 07.28.2006 no virus found CAT-QuickHeal 8.00 07.26.2006 no virus found ClamAV devel-20060426 07.27.2006 no virus found DrWeb 4.33 07.28.2006 no virus found eTrust-InoculateIT 23.72.80 07.28.2006 no virus found eTrust-Vet 12.6.2314 07.28.2006 no virus found Ewido 4.0 07.27.2006 no virus found Fortinet 2.77.0.0 07.27.2006 no virus found F-Prot 3.16f 07.27.2006 no virus found F-Prot4 4.2.1.29 07.27.2006 no virus found Ikarus 0.2.65.0 07.27.2006 no virus found Kaspersky 4.0.2.24 07.28.2006 no virus found McAfee 4816 07.27.2006 no virus found Microsoft 1.1508 07.27.2006 no virus found NOD32v2 1.1682 07.27.2006 no virus found Norman 5.90.23 07.28.2006 no virus found Panda 9.0.0.4 07.27.2006 no virus found Sophos 4.07.0 07.28.2006 no virus found Symantec 8.0 07.28.2006 no virus found TheHacker 5.9.8.182 07.27.2006 no virus found UNA 1.83 07.27.2006 no virus found VBA32 3.11.0 07.27.2006 no virus found VirusBuster 4.3.7:9 07.27.2006 no virus found Aditional Information File size: 365568 bytes MD5: 007322c8db7671fe9a1965b949e4db63 SHA1: 78c0cfeebaebe0b089c2da28efc32ff2a42eaf65

Regis59 · Answer

SalutOk, remet un HijackThisa+

xety · Answer

Voici le scan hijackThis et encore une fois merci pour tout.Logfile of HijackThis v1.99.1Scan saved at 20:27:03, on 28/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Google\Gmail Notifier\gnotify.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exeC:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exeC:\WINDOWS\ALCWZRD.EXEC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exeC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\Program Files\Fichiers communs\SmartCom\RTEGPRS.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\RFA\rfagent.exeC:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exeC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exeC:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\WINDOWS\system32\slserv.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\PROGRA~1\MOZILL~1\FIREFOX.EXEC:\Program Files\Mozilla Firefox\firefox.exeC:\HighjackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&gl=FR&ceid=FR:frR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htmR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\pchealth\helpctr\System\panels\blank.htmR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\pchealth\helpctr\System\panels\blank.htmR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dllO2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dllO2 - BHO: (no name) - {49E0E0F0-5C30-11D4-945D-000000000010} - (no file)O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)O2 - BHO: (no name) - {6A373B7E-496E-424f-A9BE-486A5E9AB018} - (no file)O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: CAdBlocker Object - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - (no file)O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: (no name) - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - (no file)O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dllO3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdiebar.dllO4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exeO4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNCO4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMENameO4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -startO4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startupO4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exeO4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimizedO4 - HKCU\..\Run: [RTEGPRS] "C:\Program Files\Fichiers communs\SmartCom\RTEGPRS.exe" trayO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [rfagent] "C:\Program Files\RFA\rfagent.exe"O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.htmlO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~3\office11\EXCEL.EXE/3000O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://c:\PROGRA~1\MICROS~3\office11\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Antivirus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dllO9 - Extra button: Micro Application Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra 'Tools' menuitem: Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: FreshDownload - {FED69157-888F-421B-9D5C-83B7791E2ABB} - C:\Program Files\FreshDevices\FreshDownload\fd.exeO9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote K - IE 6.htm (HKCU)O9 - Extra button: Dictionnaire - {FB4AE6A3-EE20-442c-9189-251885352358} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote D - IE 6.htm (HKCU)O9 - Extra button: Synonymes - {FDD637F8-2693-49ce-817E-1AD59574900C} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote S - IE 6.htm (HKCU)O9 - Extra button: Conjugueur - {FF229BEC-9E1F-48c1-99A6-AF34ABEFAB0A} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote C - IE 6.htm (HKCU)O9 - Extra button: Grammaire - {FFB5EE7F-726F-423e-83C2-572FE7CEB3F0} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote G - IE 6.htm (HKCU)O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htmO16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.frO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site....O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {E862C832-3A5F-4CEB-BFAA-167B22010A71} (InfosFinder2.InfosFinder) - http://support.packardbell.com/files/activex/InfosFinder2.CABO16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.auctiva.com/hostedimages/activex/xupload/XUpload.ocxO17 - HKLM\System\CCS\Services\Tcpip\..\{1386713D-BD6C-4D77-BBE6-A6A2985CA822}: NameServer = 212.27.39.134O20 - AppInit_DLLs: CLKERN.DLL C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLLO20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exeO23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: MysqlInventime -   - (no file)O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

Regis59 · Answer

Bonjour, Méthode à suivre dans l'ordre... ---------------------------------------------------------------------------- ¤Télécharge ces logiciels mais que tu n‘utilises pas tout de suite: 1/Spybot S&D 1.4 https://www.safer-networking.org/ Démo d’utilisation (merci à Balltrap34 pour cette réalisation).http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm2/Ad-Aware SE 1.06 https://www.adaware.com/ -Une aide:http://usa.lucretius-ada.com/zcvisitor/8782d344-4821-11ea-83ce-0a2cdf2c6be7?campaignid=0d1dff40-82d7-11e9-9533-0a157bfa6bfc - installe le patch français, tu pourras le trouver ici: http://download.lavasoft.de.edgesuite.net/public/pllangs.exe et une petite vidéo d'utilisation ici:(merci à Moe31 pour cette réalisation).http://pageperso.aol.fr/balltrap34/adawrevid.asf 3/ Ewido: http://perso.orange.fr/entraide-hijackthis/Ewido/  Installation puis mises à jour. 4/ Ccleaner :https://www.pcastuces.com/logitheque/ccleaner.htm ---------------------------------------------------------------------------- ¤Affiche tous les fichiers et dossiers : Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage Coche « afficher les fichiers et dossiers cachés » Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" Décoche « masquer les extensions dont le type est connu » Puis fais «Ok» pour valider les changements. Et appliquer !---------------------------------------------------------------------------- ¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\pchealth\helpctr\System\panels\blank.htmR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\pchealth\helpctr\System\panels\blank.htm O2 - BHO: (no name) - {49E0E0F0-5C30-11D4-945D-000000000010} - (no file)   O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)  O2 - BHO: (no name) - {6A373B7E-496E-424f-A9BE-486A5E9AB018} - (no file) O2 - BHO: CAdBlocker Object - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - (no file)   O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)  O3 - Toolbar: (no name) - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - (no file) O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.auctiva.com/hostedimages/activex/xupload/XUpload.ocx ----------------------------------------------------------------------------¤ Lancer et exécuter Ewido pour un scan complet et copier/coller le rapport en forum.-----------------------------------------------¤ Passe Ad-Aware et supprime tout ce qu’il trouve + supprime les quarantaines…----------------------------------------------------------------------------¤ Passe Spybot et corrige tout ce qu’il trouve + vaccine + supprime les quarantaines…-------------------------------------------------------------------------------------------¤ Lance CCleaner.  Suppression des fichiers temporairesVa dans la section "Options" situé dans la marge gauche. Va dans "Avancé" et décoche "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Retourne ensuite dans la section "Nettoyeur"Fais bien attention de cocher toutes les cases dans la marge gauche (Internet Explorer/Windows Explorer/Système/Avancé)•	Clique sur Analyse•	Patiente le temps du scan, qui peut prendre un peu de temps si c'est la première fois.•	Une fois le scan terminé, clique sur Lancer le Nettoyage Suppression des incohérence du registre•	Clique sur l'icône Erreurs situés dans la marge à gauche.•	Puis clique sur Analyser les erreurs•	Patiente pendant que CCleaner scan ton registre.•	Une fois le scan terminé, coche toutes les entrèes qu'il t'aura trouvée.•	Tu peux cliquer ensuite sur Corriger les erreurs.Si tu n'est pas sur de ce que tu fais, tu peux choisir de sauvegarder les entrées cochées pour les restaurer ultérieurement----------------------------------------------------------------------------¤ Vide ta Corbeille.----------------------------------------------------------------------------¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.Précise tes soucis s’il en reste.... Tiens-moi au courant  A+

xety · Answer

Bonjour Régis, J'ai fait ce que tu as demandé et je te poste le dernier rapport de hijckThis, mais il me reste tout de meme le plus gros soucis c'est que le troyen est toujours la en quarantaine chez KAV, et qui s'alarme de temps en temps: placé en quarantaine : cheval de Troie Trojan-Spy.HTML.Fraud.gen (modification) Le message: [From:"PayPal" ][Subject:Update your account information within 72 hours to avoid suspension][Time:2006/05/31 03:57:56] ext/html Potentiellement infecté : cheval de Troie Trojan-Spy.HTML.Fraud.gen (modification) [From:"PayPal" ][Subject:Update your account information within 72 hours to avoid suspension][Time:2006/05/31 03:57:56] ext/html 5.3 Ko 25/07/2006 10:13:26 Comment peut on faire pour l'éradiquer complètement, et merci d'avance pour ton aide. Rapport HijckThis: Logfile of HijackThis v1.99.1 Scan saved at 05:03:56, on 29/07/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\Program Files\Fichiers communs\SmartCom\RTEGPRS.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\RFA fagent.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\system32\wuauclt.exe C:\HighjackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://news.google.com/topstories?hl=fr&gl=FR&ceid=FR:fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdiebar.dll O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [RTEGPRS] "C:\Program Files\Fichiers communs\SmartCom\RTEGPRS.exe" tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [rfagent] "C:\Program Files\RFA fagent.exe" O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~3\office11\EXCEL.EXE/3000 O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://c:\PROGRA~1\MICROS~3\office11\EXCEL.EXE/3000 O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Antivirus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll O9 - Extra button: Micro Application Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: FreshDownload - {FED69157-888F-421B-9D5C-83B7791E2ABB} - C:\Program Files\FreshDevices\FreshDownload\fd.exe O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote K - IE 6.htm (HKCU) O9 - Extra button: Dictionnaire - {FB4AE6A3-EE20-442c-9189-251885352358} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote D - IE 6.htm (HKCU) O9 - Extra button: Synonymes - {FDD637F8-2693-49ce-817E-1AD59574900C} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote S - IE 6.htm (HKCU) O9 - Extra button: Conjugueur - {FF229BEC-9E1F-48c1-99A6-AF34ABEFAB0A} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote C - IE 6.htm (HKCU) O9 - Extra button: Grammaire - {FFB5EE7F-726F-423e-83C2-572FE7CEB3F0} - C:\PROGRA~1\Druide\Antidote\Antidote\Internet Explorer\6\Antidote G - IE 6.htm (HKCU) O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.... O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {E862C832-3A5F-4CEB-BFAA-167B22010A71} (InfosFinder2.InfosFinder) - http://support.packardbell.com/files/activex/InfosFinder2.CAB O17 - HKLM\System\CCS\Services\Tcpip\..\{1386713D-BD6C-4D77-BBE6-A6A2985CA822}: NameServer = 212.27.39.134 O20 - AppInit_DLLs: CLKERN.DLL C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing) O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: MysqlInventime - - (no file) O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

Regis59 · Answer

SalutVide la quarantaine de KavPuis,Lance ce scan en ligne: https://www.kaspersky.fr/?domain=webscanner.kaspersky.frCopie/colle le rapporta+

xety · Answer

Bonsoir,Désolé pour le retard mais je m'etais absenté, alors je t'envoie le rappoert de l'analyse KAV online, merci d'avance pour tout et bonne soirée:KASPERSKY ON-LINE SCANNER - RAPPORT  lundi 31 juillet 2006 21:24:10Système d'exploitation : Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)Version de Kaspersky On-line Scanner: 5.0.78.0Dernière mise à jour de la base antivirus Kaspersky : 31/07/2006Enregistrements dans la base antivirus Kaspersky : 211149  Paramètres d'analyse Analyser avec la base antivirus suivante étendue Analyser les archives vrai Analyser les bases de messagerie. vrai  Cible de l'analyse Poste de travail C:\D:\E:\F:\G:\H:\I:\   Statistiques de l'analyse Total d'objets analysés : 114759 Nombre de virus trouvés 1 Nombre d'objets infectés 3 Nombre d'objets suspects 0 Durée de l'analyse 01:15:31 Nom de l'objet infecté Nom du virus Dernière action C:\Documents and Settings\Christian\Application Data\Thunderbird\Profiles\51hjfn1z.default\Mail\Local Folders\Paypal/[From "service@paypal.fr" ][Date Sun, 04 Jun 2006 23:26:08 -0700]/text/[From ][Date Mon, 10 Jul 2006 06:59:01 -0600]/text  Infecté: Trojan-Spy.HTML.Bayfraud.dq  ignoré   C:\Documents and Settings\Christian\Application Data\Thunderbird\Profiles\51hjfn1z.default\Mail\Local Folders\Paypal/[From "service@paypal.fr" ][Date Sun, 04 Jun 2006 23:26:08 -0700]/text  Infecté: Trojan-Spy.HTML.Bayfraud.dq  ignoré   C:\Documents and Settings\Christian\Application Data\Thunderbird\Profiles\51hjfn1z.default\Mail\Local Folders\Paypal  Mail Berkeley mbox: infecté - 2  ignoré   Analyse terminée. Il est tres résistant ce trojan apparemment!!!

Regis59 · Answer

Salut;Supprime ceci:C:\Documents and Settings\Christian\Application Data\Thunderbird\Profiles\51hjfn1z.default\Mail\Local Folders\PaypalRelance un scana+

xety · Answer

j'ai supprimé ce que tu as demandé et relancé un scan, voici le rapport, plutôt le non rapport car apparemment le trojan n'y est plus:Le rapport est vide.  Please note: le logiciel gratuit Kaspersky On-line Scanner n’offre pas une protection globale et ne peut empêcher les infections futures. Il ne détecte que les codes malveillants qui ont déjà pénétré dans vos disques de stockage. Nous vous conseillons vivement d’utiliser entièrement un logiciel antivirus opérationnel afin de protéger votre ordinateur en permanence.   Patientez, car ce processus peut prendre un certain temps en fonction de la cible sélectionnée. Si vous souhaitez continuer à surfer, ouvrez une seconde fenêtre.   Progression de l'analyse [99%]:                                                                                                                                     Total de fichiers analysés : 107793 Nombre de virus trouvés : 0 Nombre d'objets infectés : 0 Nombre d'objets suspects : 0 Durée de l'analyse : 01:12:44  Je te remercie, ainsi que toute l'équipe pour cette aide qui m'a été tres précieuse, car sans vous j'aurais été obligé de formater.Bonne soiréeChristian

Regis59 · Answer

Salut ChristianOu en sont tes soucis?a+

Firefox infecté par Trojan-Spy.HTML.Bayfraud.

18 réponses

Discussions similaires

Newsletters