Resultat de nettoyage
chouettemc
Messages postés
56
Statut
Membre
-
chouettemc Messages postés 56 Statut Membre -
chouettemc Messages postés 56 Statut Membre -
bonjour, j'ai nettoyé mon P.C selon vos conseils et je vous envoie les résultats, comme demandé:
---------------------------------------------------------
ewido anti-spyware - Scan-Bericht
---------------------------------------------------------
+ Erstellt um: 22:07:30 02/08/2006
+ Scan-Ergebnis:
HKLM\SOFTWARE\Classes\CLSID\{EA0D26BD-9029-431A-86E0-83152D67828A} -> Adware.180Solutions : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{EA0D26BD-9029-431A-86E0-83152D67828A} -> Adware.180Solutions : Keine Aktion durchgeführt.
HKU\S-1-5-21-57989841-1957994488-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EA0D26BD-9029-431A-86E0-83152D67828A} -> Adware.180Solutions : Keine Aktion durchgeführt.
[3232] C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll -> Adware.Agent : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\AppInfo -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\CMEII -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\Gator -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\Gator\dyn -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH\_gs -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\Trickler -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\trickles -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106 -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106\Trickler -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106\Trickler\trickle.gator.com:80/download/trickler6.cfg -> Adware.Gator : Keine Aktion durchgeführt.
HKU\S-1-5-21-57989841-1957994488-1060284298-1003\Software\Gator.com -> Adware.Gator : Keine Aktion durchgeführt.
C:\WINDOWS\system32\__delete_on_reboot__r_l_l_s_._d_l_l_ -> Adware.RK : Keine Aktion durchgeführt.
C:\WINDOWS\system32\__delete_on_reboot__r_l_v_k_n_l_g_._e_x_e_ -> Adware.RK : Keine Aktion durchgeführt.
C:\WINDOWS\system32\rk.bin -> Adware.RK : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Classes\WUSN.1 -> Adware.SaveNow : Keine Aktion durchgeführt.
C:\WINDOWS\Temp\MT\GangBangDemolition[1].exe -> Dialer.CapreDeam.k : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Classes\SysWebTelecom.SysWebTelecom -> Dialer.Generic : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Classes\SysWebTelecom.SysWebTelecom\CLSID -> Dialer.Generic : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Classes\SysWebTelecom.SysWebTelecom\CurVer -> Dialer.Generic : Keine Aktion durchgeführt.
C:\WINDOWS\system32\drivers\erssdd.sys -> Rootkit.Agent.af : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@ad.adocean[2].txt -> TrackingCookie.Adocean : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@gde.adocean[2].txt -> TrackingCookie.Adocean : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@burstnet[2].txt -> TrackingCookie.Burstnet : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@casalemedia[1].txt -> TrackingCookie.Casalemedia : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@com[1].txt -> TrackingCookie.Com : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@estat[1].txt -> TrackingCookie.Estat : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@ilead.itrack[2].txt -> TrackingCookie.Itrack : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@ivwbox[2].txt -> TrackingCookie.Ivwbox : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@banners.searchingbooth[1].txt -> TrackingCookie.Searchingbooth : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@serving-sys[1].txt -> TrackingCookie.Serving-sys : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@statcounter[1].txt -> TrackingCookie.Statcounter : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@media.top-banners[1].txt -> TrackingCookie.Top-banners : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@weborama[2].txt -> TrackingCookie.Weborama : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Keine Aktion durchgeführt.
::Berichtende
BitDefender Online Scanner
Scan report generated at: Thu, Aug 03, 2006 - 00:12:12
Scan path: A:\;C:\;D:\;E:\;
Statistics
Time 01:57:16
Files 223399
Folders 2914
Boot Sectors 3
Archives 2499
Packed Files 27542
Results
Identified Viruses 6
Infected Files 15
Suspect Files 0
Warnings 0
Disinfected 0
Deleted Files 15
Engines Info
Virus Definitions 426122
Engine build AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)
Scan plugins 13
Archive plugins 39
Unpack plugins 5
E-mail plugins 6
System plugins 1
Scan Settings
First Action Disinfect
Second Action Delete
Heuristics Yes
Enable Warnings Yes
Scanned Extensions *;
Exclude Extensions
Scan Emails Yes
Scan Archives Yes
Scan Packed Yes
Scan Files Yes
Scan Boot Yes
Scanned File Status
C:\Documents and Settings\moi\Local Settings\Temp\ssqbn.exe Infected with: Dropped:Trojan.Downloader.Small.AZX
C:\Documents and Settings\moi\Local Settings\Temp\ssqbn.exe Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temp\ssqbn.exe Deleted
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Infected with: Trojan.Downloader.VB.QB
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Deleted
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o) Update failed
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Infected with: Trojan.Downloader.Small.AJC
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Deleted
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o) Update failed
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\ssqbn[1].exe Infected with: Dropped:Trojan.Downloader.Small.AZX
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\ssqbn[1].exe Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\ssqbn[1].exe Deleted
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0003 Infected with: Trojan.Downloader.VB.QB
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0003 Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0003 Deleted
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o) Update failed
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0004 Infected with: Trojan.Downloader.Small.AJC
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0004 Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0004 Deleted
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o) Update failed
C:\Program Files\ErrorGuard\setupactive.exe Detected with: Application.ErrorGuard.A
C:\Program Files\ErrorGuard\setupactive.exe Disinfection failed
C:\Program Files\ErrorGuard\setupactive.exe Deleted
C:\Program Files\Montorgueil\GangBangDemolition\GangBangDemolition.exe Infected with: Trojan.Dialer.MQ
C:\Program Files\Montorgueil\GangBangDemolition\GangBangDemolition.exe Disinfection failed
C:\Program Files\Montorgueil\GangBangDemolition\GangBangDemolition.exe Deleted
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089982.sys Infected with: Trojan.Ntrootkit.47
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089982.sys Disinfection failed
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089982.sys Deleted
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089983.exe Detected with: Application.ErrorGuard.A
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089983.exe Disinfection failed
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089983.exe Deleted
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089984.exe Infected with: Trojan.Dialer.MQ
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089984.exe Disinfection failed
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089984.exe Deleted
C:\VSL.dl_ Infected with: Trojan.Downloader.VB.QB
C:\VSL.dl_ Disinfection failed
C:\VSL.dl_ Deleted
C:\WINDOWS\system32\ssqbn.exe Infected with: Dropped:Trojan.Downloader.Small.AZX
C:\WINDOWS\system32\ssqbn.exe Disinfection failed
C:\WINDOWS\system32\ssqbn.exe Deleted
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Infected with: Trojan.Downloader.VB.QB
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Disinfection failed
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Deleted
C:\WINDOWS\system32\VSL13.exe=>(NSIS o) Update failed
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Infected with: Trojan.Downloader.Small.AJC
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Disinfection failed
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Deleted
C:\WINDOWS\system32\VSL13.exe=>(NSIS o) Update failed
Logfile of HijackThis v1.99.1
Scan saved at 00:19:37, on 03/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1407D8CB-9712-4D5D-9C19-03EE3D48C129} - \
O2 - BHO: (no name) - {1FBA6AA2-729E-47A3-B957-EA6786F97A32} - \
O2 - BHO: (no name) - {21AAD024-0208-462D-A63F-30860388C36A} - \
O2 - BHO: (no name) - {273E429A-34FE-45FD-8BE2-64C8003F8B8E} - \
O2 - BHO: (no name) - {284BE451-71F0-4851-877A-D72F2E63DEEA} - \
O2 - BHO: (no name) - {31344728-FE2E-4440-B6B3-86728C0D4513} - \
O2 - BHO: (no name) - {37901E3F-2512-423C-8A4D-56E9EA04BCC8} - \
O2 - BHO: (no name) - {429A1DC5-C814-49C5-A7D1-5CC35B35C111} - \
O2 - BHO: (no name) - {42A3BD9D-D89F-42C2-BBD9-41D6CFA9D6C5} - \
O2 - BHO: (no name) - {447AB3D8-9C5E-405F-9455-5925DF530C3B} - \
O2 - BHO: (no name) - {470DA321-52DB-4192-A9AB-97995DE3326F} - \
O2 - BHO: (no name) - {5E10950D-2820-4B0B-9C53-69BAD8126D52} - \
O2 - BHO: (no name) - {6737193E-EEB6-460B-8E1F-99D392E77F1F} - \
O2 - BHO: (no name) - {69018F1D-3771-4D2D-9FE8-3064B08DDE54} - \
O2 - BHO: (no name) - {71362384-0741-4A55-BFB3-324629A118AC} - \
O2 - BHO: (no name) - {7296880E-3223-4E49-8DD5-BDC81A0E4F44} - \
O2 - BHO: (no name) - {72CDA4A9-15C6-4099-99FD-7D2C67040655} - \
O2 - BHO: (no name) - {7733B1F6-B03A-429E-A87F-735A486911F8} - \
O2 - BHO: (no name) - {7A0BA8B0-D5E8-425D-9132-ACC4375912C4} - \
O2 - BHO: (no name) - {7C02E251-6AB9-4C31-9595-FB2A8B679C8D} - \
O2 - BHO: (no name) - {85D9EBAE-0F21-4148-BC0A-CC799400E15E} - \
O2 - BHO: (no name) - {86E4D8A3-BFDC-4D17-B662-BA37F0ACCE6C} - \
O2 - BHO: (no name) - {8FBFEB97-5CB9-465F-ADFF-9922B625D789} - \
O2 - BHO: (no name) - {93ABA520-0A6F-421F-89D1-5C1B76863100} - \
O2 - BHO: (no name) - {998737F5-7B43-4A78-958E-4394FA157D28} - \
O2 - BHO: (no name) - {9B3166FE-0926-49A0-9E4C-0D87A452B165} - \
O2 - BHO: (no name) - {9B4D8E82-36C0-462D-BADE-23DE722756DB} - \
O2 - BHO: (no name) - {AE1DA048-7270-44AB-8BB8-1D738E4A48B4} - \
O2 - BHO: (no name) - {AF38D289-92FE-4704-9D6E-2F986BF334BF} - \
O2 - BHO: (no name) - {B824FD8F-D7D7-48C0-BAD1-DA45AADDD263} - \
O2 - BHO: (no name) - {B8A98BB0-F5B9-478F-9622-8993F3591BC1} - \
O2 - BHO: (no name) - {C22A2B13-7419-46B0-84ED-87C5052E19D1} - \
O2 - BHO: (no name) - {C60017BB-66CE-4403-A5D0-03A6FE294CAB} - \
O2 - BHO: (no name) - {C7A60D9E-4C8D-4861-8190-A7B658871C11} - \
O2 - BHO: (no name) - {CEACAA7E-1F12-4B8F-9515-7ACD0C63CD64} - \
O2 - BHO: (no name) - {D5DE22D6-37DD-43CF-B0A2-6AF9DB427371} - \
O2 - BHO: (no name) - {DD823717-85B2-4A48-BCEE-A06B106E8884} - \
O2 - BHO: (no name) - {EC1325C7-CB30-4066-BE24-83C327A17DB5} - \
O2 - BHO: (no name) - {EC81249D-D211-4ECC-A60C-CBF2C89BB5C4} - \
O2 - BHO: (no name) - {ECAD5DAC-6C9A-448B-9507-DBDE79397A5B} - \
O2 - BHO: (no name) - {F0972675-83E8-4759-9014-BE3BC6ACF543} - \
O2 - BHO: (no name) - {F293A737-766F-4B5B-AC22-C283EF689E15} - \
O2 - BHO: (no name) - {F5572073-F6E8-4FC6-8DCC-01497C34E742} - \
O2 - BHO: (no name) - {F56C8605-282B-4700-BBF5-59FBB30D49FD} - \
O2 - BHO: (no name) - {F9E8FC25-1EE9-4AFB-9BE3-71A068B468AE} - \
O2 - BHO: (no name) - {FAB9BF49-B551-8B58-0AB9-C60DD71ED535} - C:\WINDOWS\nhln.dll (file missing)
O2 - BHO: (no name) - {FFBF4A74-BF3C-4723-BCD1-531D66010AB2} - \
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [wallp2.exe] C:\WINDOWS\system32\wallp2.exe
O4 - HKCU\..\Run: [VSL13.exe] C:\WINDOWS\system32\VSL13.exe
O4 - HKCU\..\Run: [1201.exe] C:\Documents and Settings\moi\Application Data\System Restore\1201.exe
O4 - HKCU\..\Run: [ssqbn.exe] C:\WINDOWS\system32\ssqbn.exe
O4 - Global Startup: Logitech SetPoint.lnk = D:\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {4AD73894-A895-4FC2-B233-299867E08753} (Cadwkzctl Object) - http://apps.deskwizz.com/ax/adwerkz.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_s...
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} (VirginMega DownloadManager) - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/bridge-c32.cab?e53dccdf6f5f50cca42c1ef49...
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/cab/14/en/SysWebTelecomInt.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - C:\Program Files\FileZilla Server\FileZilla Server.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
voilà, j'espère que cela va vous servir et m'aider à faire le "ménage" sur mon ordi
merci d'avance pour vos réponses
---------------------------------------------------------
ewido anti-spyware - Scan-Bericht
---------------------------------------------------------
+ Erstellt um: 22:07:30 02/08/2006
+ Scan-Ergebnis:
HKLM\SOFTWARE\Classes\CLSID\{EA0D26BD-9029-431A-86E0-83152D67828A} -> Adware.180Solutions : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{EA0D26BD-9029-431A-86E0-83152D67828A} -> Adware.180Solutions : Keine Aktion durchgeführt.
HKU\S-1-5-21-57989841-1957994488-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EA0D26BD-9029-431A-86E0-83152D67828A} -> Adware.180Solutions : Keine Aktion durchgeführt.
[3232] C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll -> Adware.Agent : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\AppInfo -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\CMEII -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\Gator -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\Gator\dyn -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH\_gs -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\Trickler -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\trickles -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106 -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106\Trickler -> Adware.Gator : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106\Trickler\trickle.gator.com:80/download/trickler6.cfg -> Adware.Gator : Keine Aktion durchgeführt.
HKU\S-1-5-21-57989841-1957994488-1060284298-1003\Software\Gator.com -> Adware.Gator : Keine Aktion durchgeführt.
C:\WINDOWS\system32\__delete_on_reboot__r_l_l_s_._d_l_l_ -> Adware.RK : Keine Aktion durchgeführt.
C:\WINDOWS\system32\__delete_on_reboot__r_l_v_k_n_l_g_._e_x_e_ -> Adware.RK : Keine Aktion durchgeführt.
C:\WINDOWS\system32\rk.bin -> Adware.RK : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Classes\WUSN.1 -> Adware.SaveNow : Keine Aktion durchgeführt.
C:\WINDOWS\Temp\MT\GangBangDemolition[1].exe -> Dialer.CapreDeam.k : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Classes\SysWebTelecom.SysWebTelecom -> Dialer.Generic : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Classes\SysWebTelecom.SysWebTelecom\CLSID -> Dialer.Generic : Keine Aktion durchgeführt.
HKLM\SOFTWARE\Classes\SysWebTelecom.SysWebTelecom\CurVer -> Dialer.Generic : Keine Aktion durchgeführt.
C:\WINDOWS\system32\drivers\erssdd.sys -> Rootkit.Agent.af : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@ad.adocean[2].txt -> TrackingCookie.Adocean : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@gde.adocean[2].txt -> TrackingCookie.Adocean : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@burstnet[2].txt -> TrackingCookie.Burstnet : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@casalemedia[1].txt -> TrackingCookie.Casalemedia : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@com[1].txt -> TrackingCookie.Com : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@estat[1].txt -> TrackingCookie.Estat : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@ilead.itrack[2].txt -> TrackingCookie.Itrack : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@ivwbox[2].txt -> TrackingCookie.Ivwbox : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@banners.searchingbooth[1].txt -> TrackingCookie.Searchingbooth : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@serving-sys[1].txt -> TrackingCookie.Serving-sys : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@statcounter[1].txt -> TrackingCookie.Statcounter : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@media.top-banners[1].txt -> TrackingCookie.Top-banners : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@weborama[2].txt -> TrackingCookie.Weborama : Keine Aktion durchgeführt.
C:\Documents and Settings\moi\Cookies\moi@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Keine Aktion durchgeführt.
::Berichtende
BitDefender Online Scanner
Scan report generated at: Thu, Aug 03, 2006 - 00:12:12
Scan path: A:\;C:\;D:\;E:\;
Statistics
Time 01:57:16
Files 223399
Folders 2914
Boot Sectors 3
Archives 2499
Packed Files 27542
Results
Identified Viruses 6
Infected Files 15
Suspect Files 0
Warnings 0
Disinfected 0
Deleted Files 15
Engines Info
Virus Definitions 426122
Engine build AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)
Scan plugins 13
Archive plugins 39
Unpack plugins 5
E-mail plugins 6
System plugins 1
Scan Settings
First Action Disinfect
Second Action Delete
Heuristics Yes
Enable Warnings Yes
Scanned Extensions *;
Exclude Extensions
Scan Emails Yes
Scan Archives Yes
Scan Packed Yes
Scan Files Yes
Scan Boot Yes
Scanned File Status
C:\Documents and Settings\moi\Local Settings\Temp\ssqbn.exe Infected with: Dropped:Trojan.Downloader.Small.AZX
C:\Documents and Settings\moi\Local Settings\Temp\ssqbn.exe Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temp\ssqbn.exe Deleted
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Infected with: Trojan.Downloader.VB.QB
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Deleted
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o) Update failed
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Infected with: Trojan.Downloader.Small.AJC
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Deleted
C:\Documents and Settings\moi\Local Settings\Temp\VSL13.exe=>(NSIS o) Update failed
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\ssqbn[1].exe Infected with: Dropped:Trojan.Downloader.Small.AZX
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\ssqbn[1].exe Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\ssqbn[1].exe Deleted
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0003 Infected with: Trojan.Downloader.VB.QB
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0003 Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0003 Deleted
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o) Update failed
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0004 Infected with: Trojan.Downloader.Small.AJC
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0004 Disinfection failed
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o)=>zlib_nsis0004 Deleted
C:\Documents and Settings\moi\Local Settings\Temporary Internet Files\Content.IE5\KL4TEV0P\VSL13[1].exe=>(NSIS o) Update failed
C:\Program Files\ErrorGuard\setupactive.exe Detected with: Application.ErrorGuard.A
C:\Program Files\ErrorGuard\setupactive.exe Disinfection failed
C:\Program Files\ErrorGuard\setupactive.exe Deleted
C:\Program Files\Montorgueil\GangBangDemolition\GangBangDemolition.exe Infected with: Trojan.Dialer.MQ
C:\Program Files\Montorgueil\GangBangDemolition\GangBangDemolition.exe Disinfection failed
C:\Program Files\Montorgueil\GangBangDemolition\GangBangDemolition.exe Deleted
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089982.sys Infected with: Trojan.Ntrootkit.47
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089982.sys Disinfection failed
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089982.sys Deleted
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089983.exe Detected with: Application.ErrorGuard.A
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089983.exe Disinfection failed
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089983.exe Deleted
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089984.exe Infected with: Trojan.Dialer.MQ
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089984.exe Disinfection failed
C:\System Volume Information\_restore{890A0FB0-DA75-42A1-AD09-2DAA7B57F78A}\RP505\A0089984.exe Deleted
C:\VSL.dl_ Infected with: Trojan.Downloader.VB.QB
C:\VSL.dl_ Disinfection failed
C:\VSL.dl_ Deleted
C:\WINDOWS\system32\ssqbn.exe Infected with: Dropped:Trojan.Downloader.Small.AZX
C:\WINDOWS\system32\ssqbn.exe Disinfection failed
C:\WINDOWS\system32\ssqbn.exe Deleted
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Infected with: Trojan.Downloader.VB.QB
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Disinfection failed
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0003 Deleted
C:\WINDOWS\system32\VSL13.exe=>(NSIS o) Update failed
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Infected with: Trojan.Downloader.Small.AJC
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Disinfection failed
C:\WINDOWS\system32\VSL13.exe=>(NSIS o)=>zlib_nsis0004 Deleted
C:\WINDOWS\system32\VSL13.exe=>(NSIS o) Update failed
Logfile of HijackThis v1.99.1
Scan saved at 00:19:37, on 03/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1407D8CB-9712-4D5D-9C19-03EE3D48C129} - \
O2 - BHO: (no name) - {1FBA6AA2-729E-47A3-B957-EA6786F97A32} - \
O2 - BHO: (no name) - {21AAD024-0208-462D-A63F-30860388C36A} - \
O2 - BHO: (no name) - {273E429A-34FE-45FD-8BE2-64C8003F8B8E} - \
O2 - BHO: (no name) - {284BE451-71F0-4851-877A-D72F2E63DEEA} - \
O2 - BHO: (no name) - {31344728-FE2E-4440-B6B3-86728C0D4513} - \
O2 - BHO: (no name) - {37901E3F-2512-423C-8A4D-56E9EA04BCC8} - \
O2 - BHO: (no name) - {429A1DC5-C814-49C5-A7D1-5CC35B35C111} - \
O2 - BHO: (no name) - {42A3BD9D-D89F-42C2-BBD9-41D6CFA9D6C5} - \
O2 - BHO: (no name) - {447AB3D8-9C5E-405F-9455-5925DF530C3B} - \
O2 - BHO: (no name) - {470DA321-52DB-4192-A9AB-97995DE3326F} - \
O2 - BHO: (no name) - {5E10950D-2820-4B0B-9C53-69BAD8126D52} - \
O2 - BHO: (no name) - {6737193E-EEB6-460B-8E1F-99D392E77F1F} - \
O2 - BHO: (no name) - {69018F1D-3771-4D2D-9FE8-3064B08DDE54} - \
O2 - BHO: (no name) - {71362384-0741-4A55-BFB3-324629A118AC} - \
O2 - BHO: (no name) - {7296880E-3223-4E49-8DD5-BDC81A0E4F44} - \
O2 - BHO: (no name) - {72CDA4A9-15C6-4099-99FD-7D2C67040655} - \
O2 - BHO: (no name) - {7733B1F6-B03A-429E-A87F-735A486911F8} - \
O2 - BHO: (no name) - {7A0BA8B0-D5E8-425D-9132-ACC4375912C4} - \
O2 - BHO: (no name) - {7C02E251-6AB9-4C31-9595-FB2A8B679C8D} - \
O2 - BHO: (no name) - {85D9EBAE-0F21-4148-BC0A-CC799400E15E} - \
O2 - BHO: (no name) - {86E4D8A3-BFDC-4D17-B662-BA37F0ACCE6C} - \
O2 - BHO: (no name) - {8FBFEB97-5CB9-465F-ADFF-9922B625D789} - \
O2 - BHO: (no name) - {93ABA520-0A6F-421F-89D1-5C1B76863100} - \
O2 - BHO: (no name) - {998737F5-7B43-4A78-958E-4394FA157D28} - \
O2 - BHO: (no name) - {9B3166FE-0926-49A0-9E4C-0D87A452B165} - \
O2 - BHO: (no name) - {9B4D8E82-36C0-462D-BADE-23DE722756DB} - \
O2 - BHO: (no name) - {AE1DA048-7270-44AB-8BB8-1D738E4A48B4} - \
O2 - BHO: (no name) - {AF38D289-92FE-4704-9D6E-2F986BF334BF} - \
O2 - BHO: (no name) - {B824FD8F-D7D7-48C0-BAD1-DA45AADDD263} - \
O2 - BHO: (no name) - {B8A98BB0-F5B9-478F-9622-8993F3591BC1} - \
O2 - BHO: (no name) - {C22A2B13-7419-46B0-84ED-87C5052E19D1} - \
O2 - BHO: (no name) - {C60017BB-66CE-4403-A5D0-03A6FE294CAB} - \
O2 - BHO: (no name) - {C7A60D9E-4C8D-4861-8190-A7B658871C11} - \
O2 - BHO: (no name) - {CEACAA7E-1F12-4B8F-9515-7ACD0C63CD64} - \
O2 - BHO: (no name) - {D5DE22D6-37DD-43CF-B0A2-6AF9DB427371} - \
O2 - BHO: (no name) - {DD823717-85B2-4A48-BCEE-A06B106E8884} - \
O2 - BHO: (no name) - {EC1325C7-CB30-4066-BE24-83C327A17DB5} - \
O2 - BHO: (no name) - {EC81249D-D211-4ECC-A60C-CBF2C89BB5C4} - \
O2 - BHO: (no name) - {ECAD5DAC-6C9A-448B-9507-DBDE79397A5B} - \
O2 - BHO: (no name) - {F0972675-83E8-4759-9014-BE3BC6ACF543} - \
O2 - BHO: (no name) - {F293A737-766F-4B5B-AC22-C283EF689E15} - \
O2 - BHO: (no name) - {F5572073-F6E8-4FC6-8DCC-01497C34E742} - \
O2 - BHO: (no name) - {F56C8605-282B-4700-BBF5-59FBB30D49FD} - \
O2 - BHO: (no name) - {F9E8FC25-1EE9-4AFB-9BE3-71A068B468AE} - \
O2 - BHO: (no name) - {FAB9BF49-B551-8B58-0AB9-C60DD71ED535} - C:\WINDOWS\nhln.dll (file missing)
O2 - BHO: (no name) - {FFBF4A74-BF3C-4723-BCD1-531D66010AB2} - \
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [wallp2.exe] C:\WINDOWS\system32\wallp2.exe
O4 - HKCU\..\Run: [VSL13.exe] C:\WINDOWS\system32\VSL13.exe
O4 - HKCU\..\Run: [1201.exe] C:\Documents and Settings\moi\Application Data\System Restore\1201.exe
O4 - HKCU\..\Run: [ssqbn.exe] C:\WINDOWS\system32\ssqbn.exe
O4 - Global Startup: Logitech SetPoint.lnk = D:\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {4AD73894-A895-4FC2-B233-299867E08753} (Cadwkzctl Object) - http://apps.deskwizz.com/ax/adwerkz.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_s...
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} (VirginMega DownloadManager) - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/bridge-c32.cab?e53dccdf6f5f50cca42c1ef49...
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/cab/14/en/SysWebTelecomInt.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - C:\Program Files\FileZilla Server\FileZilla Server.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
voilà, j'espère que cela va vous servir et m'aider à faire le "ménage" sur mon ordi
merci d'avance pour vos réponses
Configuration: windows xp
25 réponses
- 1
- 2
Suivant
-
Salut
Evite les sites X, t as vu ce que ca ramene.
Relance ewido et supprime tout ce qu il trouve
a+ -
merci de tes conseils, mais que dois-je faire avec ce qui se trouve dans Hijackthis? quant à l'utilisateur de certains sites, je lui transmettrais
-
Salut
Avec HijackThis rien pour l instant.
D'abord tu dois nettoyer avec ewido toutes ces infections detectes.
Ensuite, seulement apres ewido on fera ce qu il faut avec HijackThis.
Oui les sites X sont vraiment pas bon et il faudra qu il nettoie en profondeur du coup.
a+ -
Avec ewido?
Si oui, remet un HijackThis
a+ -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
Salut
Justement on est la pour t aider a y comprendre, alors poses tes questions au besoin !
Oui tu peux tout supprimer ce qu ewido te detecte, tu clik sur delete.
Pour Hijack this, NON !!!!! Demande moi.
a+-
-
Logfile of HijackThis v1.99.1
Scan saved at 17:55:17, on 04/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {088D5EB4-62B5-4690-84FF-5B9A9BA01115} - \
O2 - BHO: (no name) - {09DC6946-ED02-4583-B3C0-459CC64B1308} - \
O2 - BHO: (no name) - {1407D8CB-9712-4D5D-9C19-03EE3D48C129} - \
O2 - BHO: (no name) - {1DD6692D-C399-4096-BDA5-969D1F9C3960} - \
O2 - BHO: (no name) - {1FBA6AA2-729E-47A3-B957-EA6786F97A32} - \
O2 - BHO: (no name) - {21AAD024-0208-462D-A63F-30860388C36A} - \
O2 - BHO: (no name) - {273E429A-34FE-45FD-8BE2-64C8003F8B8E} - \
O2 - BHO: (no name) - {284BE451-71F0-4851-877A-D72F2E63DEEA} - \
O2 - BHO: (no name) - {31344728-FE2E-4440-B6B3-86728C0D4513} - \
O2 - BHO: (no name) - {37901E3F-2512-423C-8A4D-56E9EA04BCC8} - \
O2 - BHO: (no name) - {429A1DC5-C814-49C5-A7D1-5CC35B35C111} - \
O2 - BHO: (no name) - {42A3BD9D-D89F-42C2-BBD9-41D6CFA9D6C5} - \
O2 - BHO: (no name) - {447AB3D8-9C5E-405F-9455-5925DF530C3B} - \
O2 - BHO: (no name) - {470DA321-52DB-4192-A9AB-97995DE3326F} - \
O2 - BHO: (no name) - {5E10950D-2820-4B0B-9C53-69BAD8126D52} - \
O2 - BHO: (no name) - {6737193E-EEB6-460B-8E1F-99D392E77F1F} - \
O2 - BHO: (no name) - {69018F1D-3771-4D2D-9FE8-3064B08DDE54} - \
O2 - BHO: (no name) - {71362384-0741-4A55-BFB3-324629A118AC} - \
O2 - BHO: (no name) - {7296880E-3223-4E49-8DD5-BDC81A0E4F44} - \
O2 - BHO: (no name) - {72CDA4A9-15C6-4099-99FD-7D2C67040655} - \
O2 - BHO: (no name) - {7733B1F6-B03A-429E-A87F-735A486911F8} - \
O2 - BHO: (no name) - {7A0BA8B0-D5E8-425D-9132-ACC4375912C4} - \
O2 - BHO: (no name) - {7C02E251-6AB9-4C31-9595-FB2A8B679C8D} - \
O2 - BHO: (no name) - {85D9EBAE-0F21-4148-BC0A-CC799400E15E} - \
O2 - BHO: (no name) - {86E4D8A3-BFDC-4D17-B662-BA37F0ACCE6C} - \
O2 - BHO: (no name) - {8FBFEB97-5CB9-465F-ADFF-9922B625D789} - \
O2 - BHO: (no name) - {93ABA520-0A6F-421F-89D1-5C1B76863100} - \
O2 - BHO: (no name) - {998737F5-7B43-4A78-958E-4394FA157D28} - \
O2 - BHO: (no name) - {9B3166FE-0926-49A0-9E4C-0D87A452B165} - \
O2 - BHO: (no name) - {9B4D8E82-36C0-462D-BADE-23DE722756DB} - \
O2 - BHO: (no name) - {AE1DA048-7270-44AB-8BB8-1D738E4A48B4} - \
O2 - BHO: (no name) - {AF38D289-92FE-4704-9D6E-2F986BF334BF} - \
O2 - BHO: (no name) - {B824FD8F-D7D7-48C0-BAD1-DA45AADDD263} - \
O2 - BHO: (no name) - {B8A98BB0-F5B9-478F-9622-8993F3591BC1} - \
O2 - BHO: (no name) - {C22A2B13-7419-46B0-84ED-87C5052E19D1} - \
O2 - BHO: (no name) - {C60017BB-66CE-4403-A5D0-03A6FE294CAB} - \
O2 - BHO: (no name) - {C7A60D9E-4C8D-4861-8190-A7B658871C11} - \
O2 - BHO: (no name) - {CEACAA7E-1F12-4B8F-9515-7ACD0C63CD64} - \
O2 - BHO: (no name) - {D5DE22D6-37DD-43CF-B0A2-6AF9DB427371} - \
O2 - BHO: (no name) - {DD823717-85B2-4A48-BCEE-A06B106E8884} - \
O2 - BHO: (no name) - {EC1325C7-CB30-4066-BE24-83C327A17DB5} - \
O2 - BHO: (no name) - {EC81249D-D211-4ECC-A60C-CBF2C89BB5C4} - \
O2 - BHO: (no name) - {ECAD5DAC-6C9A-448B-9507-DBDE79397A5B} - \
O2 - BHO: (no name) - {F0972675-83E8-4759-9014-BE3BC6ACF543} - \
O2 - BHO: (no name) - {F293A737-766F-4B5B-AC22-C283EF689E15} - \
O2 - BHO: (no name) - {F5572073-F6E8-4FC6-8DCC-01497C34E742} - \
O2 - BHO: (no name) - {F56C8605-282B-4700-BBF5-59FBB30D49FD} - \
O2 - BHO: (no name) - {F9E8FC25-1EE9-4AFB-9BE3-71A068B468AE} - \
O2 - BHO: (no name) - {FAB9BF49-B551-8B58-0AB9-C60DD71ED535} - C:\WINDOWS\nhln.dll (file missing)
O2 - BHO: (no name) - {FFBF4A74-BF3C-4723-BCD1-531D66010AB2} - \
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [wallp2.exe] C:\WINDOWS\system32\wallp2.exe
O4 - HKCU\..\Run: [VSL13.exe] C:\WINDOWS\system32\VSL13.exe
O4 - HKCU\..\Run: [1201.exe] C:\Documents and Settings\moi\Application Data\System Restore\1201.exe
O4 - HKCU\..\Run: [ssqbn.exe] C:\WINDOWS\system32\ssqbn.exe
O4 - Global Startup: Logitech SetPoint.lnk = D:\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {4AD73894-A895-4FC2-B233-299867E08753} (Cadwkzctl Object) - http://apps.deskwizz.com/ax/adwerkz.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_s...
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} (VirginMega DownloadManager) - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/bridge-c32.cab?e53dccdf6f5f50cca42c1ef49...
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/cab/14/en/SysWebTelecomInt.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - C:\Program Files\FileZilla Server\FileZilla Server.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
-
-
Ok, j aimerais un nouveau Hijack this car apres la suppression des malwares par ewido, le log a du changer.
a+ -
Bonjour,
Méthode à suivre dans l'ordre...
----------------------------------------------------------------------------
¤Télécharge ces logiciels mais que tu n‘utilises pas tout de suite:
1/
Spybot S&D 1.4
https://www.safer-networking.org/
Démo d’utilisation (merci à Balltrap34 pour cette réalisation).
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
2/
Ad-Aware SE 1.06
https://www.adaware.com/
-Une aide:
http://usa.lucretius-ada.com/zcvisitor/8782d344-4821-11ea-83ce-0a2cdf2c6be7?campaignid=0d1dff40-82d7-11e9-9533-0a157bfa6bfc
- installe le patch français, tu pourras le trouver ici:
http://download.lavasoft.de.edgesuite.net/public/pllangs.exe
et une petite vidéo d'utilisation ici:(merci à Moe31 pour cette réalisation).
http://pageperso.aol.fr/balltrap34/adawrevid.asf
3/ Ewido:
http://perso.orange.fr/entraide-hijackthis/Ewido/
Installation puis mises à jour.
4/ Ccleaner :
https://www.pcastuces.com/logitheque/ccleaner.htm
----------------------------------------------------------------------------
¤Affiche tous les fichiers et dossiers :
Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage
Coche « afficher les fichiers et dossiers cachés »
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Décoche « masquer les extensions dont le type est connu »
Puis fais «Ok» pour valider les changements.
Et appliquer !
----------------------------------------------------------------------------
¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :
O2 - BHO: (no name) - {088D5EB4-62B5-4690-84FF-5B9A9BA01115} - \
O2 - BHO: (no name) - {09DC6946-ED02-4583-B3C0-459CC64B1308} - \
O2 - BHO: (no name) - {1407D8CB-9712-4D5D-9C19-03EE3D48C129} - \
O2 - BHO: (no name) - {1DD6692D-C399-4096-BDA5-969D1F9C3960} - \
O2 - BHO: (no name) - {1FBA6AA2-729E-47A3-B957-EA6786F97A32} - \
O2 - BHO: (no name) - {21AAD024-0208-462D-A63F-30860388C36A} - \
O2 - BHO: (no name) - {273E429A-34FE-45FD-8BE2-64C8003F8B8E} - \
O2 - BHO: (no name) - {284BE451-71F0-4851-877A-D72F2E63DEEA} - \
O2 - BHO: (no name) - {31344728-FE2E-4440-B6B3-86728C0D4513} - \
O2 - BHO: (no name) - {37901E3F-2512-423C-8A4D-56E9EA04BCC8} - \
O2 - BHO: (no name) - {429A1DC5-C814-49C5-A7D1-5CC35B35C111} - \
O2 - BHO: (no name) - {42A3BD9D-D89F-42C2-BBD9-41D6CFA9D6C5} - \
O2 - BHO: (no name) - {447AB3D8-9C5E-405F-9455-5925DF530C3B} - \
O2 - BHO: (no name) - {470DA321-52DB-4192-A9AB-97995DE3326F} - \
O2 - BHO: (no name) - {5E10950D-2820-4B0B-9C53-69BAD8126D52} - \
O2 - BHO: (no name) - {6737193E-EEB6-460B-8E1F-99D392E77F1F} - \
O2 - BHO: (no name) - {69018F1D-3771-4D2D-9FE8-3064B08DDE54} - \
O2 - BHO: (no name) - {71362384-0741-4A55-BFB3-324629A118AC} - \
O2 - BHO: (no name) - {7296880E-3223-4E49-8DD5-BDC81A0E4F44} - \
O2 - BHO: (no name) - {72CDA4A9-15C6-4099-99FD-7D2C67040655} - \
O2 - BHO: (no name) - {7733B1F6-B03A-429E-A87F-735A486911F8} - \
O2 - BHO: (no name) - {7A0BA8B0-D5E8-425D-9132-ACC4375912C4} - \
O2 - BHO: (no name) - {7C02E251-6AB9-4C31-9595-FB2A8B679C8D} - \
O2 - BHO: (no name) - {85D9EBAE-0F21-4148-BC0A-CC799400E15E} - \
O2 - BHO: (no name) - {86E4D8A3-BFDC-4D17-B662-BA37F0ACCE6C} - \
O2 - BHO: (no name) - {8FBFEB97-5CB9-465F-ADFF-9922B625D789} - \
O2 - BHO: (no name) - {93ABA520-0A6F-421F-89D1-5C1B76863100} - \
O2 - BHO: (no name) - {998737F5-7B43-4A78-958E-4394FA157D28} - \
O2 - BHO: (no name) - {9B3166FE-0926-49A0-9E4C-0D87A452B165} - \
O2 - BHO: (no name) - {9B4D8E82-36C0-462D-BADE-23DE722756DB} - \
O2 - BHO: (no name) - {AE1DA048-7270-44AB-8BB8-1D738E4A48B4} - \
O2 - BHO: (no name) - {AF38D289-92FE-4704-9D6E-2F986BF334BF} - \
O2 - BHO: (no name) - {B824FD8F-D7D7-48C0-BAD1-DA45AADDD263} - \
O2 - BHO: (no name) - {B8A98BB0-F5B9-478F-9622-8993F3591BC1} - \
O2 - BHO: (no name) - {C22A2B13-7419-46B0-84ED-87C5052E19D1} - \
O2 - BHO: (no name) - {C60017BB-66CE-4403-A5D0-03A6FE294CAB} - \
O2 - BHO: (no name) - {C7A60D9E-4C8D-4861-8190-A7B658871C11} - \
O2 - BHO: (no name) - {CEACAA7E-1F12-4B8F-9515-7ACD0C63CD64} - \
O2 - BHO: (no name) - {D5DE22D6-37DD-43CF-B0A2-6AF9DB427371} - \
O2 - BHO: (no name) - {DD823717-85B2-4A48-BCEE-A06B106E8884} - \
O2 - BHO: (no name) - {EC1325C7-CB30-4066-BE24-83C327A17DB5} - \
O2 - BHO: (no name) - {EC81249D-D211-4ECC-A60C-CBF2C89BB5C4} - \
O2 - BHO: (no name) - {ECAD5DAC-6C9A-448B-9507-DBDE79397A5B} - \
O2 - BHO: (no name) - {F0972675-83E8-4759-9014-BE3BC6ACF543} - \
O2 - BHO: (no name) - {F293A737-766F-4B5B-AC22-C283EF689E15} - \
O2 - BHO: (no name) - {F5572073-F6E8-4FC6-8DCC-01497C34E742} - \
O2 - BHO: (no name) - {F56C8605-282B-4700-BBF5-59FBB30D49FD} - \
O2 - BHO: (no name) - {F9E8FC25-1EE9-4AFB-9BE3-71A068B468AE} - \
O2 - BHO: (no name) - {FAB9BF49-B551-8B58-0AB9-C60DD71ED535} - C:\WINDOWS\nhln.dll (file missing)
O2 - BHO: (no name) - {FFBF4A74-BF3C-4723-BCD1-531D66010AB2} - \
O4 - HKCU\..\Run: [wallp2.exe] C:\WINDOWS\system32\wallp2.exe
O4 - HKCU\..\Run: [VSL13.exe] C:\WINDOWS\system32\VSL13.exe
O4 - HKCU\..\Run: [1201.exe] C:\Documents and Settings\moi\Application Data\System Restore\1201.exe
O4 - HKCU\..\Run: [ssqbn.exe] C:\WINDOWS\system32\ssqbn.exe
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {4AD73894-A895-4FC2-B233-299867E08753} (Cadwkzctl Object) - http://apps.deskwizz.com/ax/adwerkz.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/bridge-c32.cab?e53dccdf6f5f50cca42c1ef4 9...
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/cab/14/en/SysWebTelecomInt.cab
----------------------------------------------------------------------------
¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
¤Recherche et supprime ceci:
attention seulement les fichiers (si présents).
C:\WINDOWS\system32\wallp2.exe
C:\WINDOWS\system32\VSL13.exe
C:\Documents and Settings\moi\Application Data\System Restore\1201.exe
C:\WINDOWS\system32\ssqbn.exe
----------------------------------------------------------------------------
¤ Lancer et exécuter Ewido pour un scan complet et copier/coller le rapport en forum.
----------------------------------------------------------------------------
¤ Passe Ad-Aware et supprime tout ce qu’il trouve + supprime les quarantaines…
----------------------------------------------------------------------------
¤ Passe Spybot et corrige tout ce qu’il trouve + vaccine + supprime les quarantaines…
-------------------------------------------------------------------------------------------
¤ Lance CCleaner.
Suppression des fichiers temporaires
Va dans la section "Options" situé dans la marge gauche. Va dans "Avancé" et décoche "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Retourne ensuite dans la section "Nettoyeur"
Fais bien attention de cocher toutes les cases dans la marge gauche (Internet Explorer/Windows Explorer/Système/Avancé)
• Clique sur Analyse
• Patiente le temps du scan, qui peut prendre un peu de temps si c'est la première fois.
• Une fois le scan terminé, clique sur Lancer le Nettoyage
Suppression des incohérence du registre
• Clique sur l'icône Erreurs situés dans la marge à gauche.
• Puis clique sur Analyser les erreurs
• Patiente pendant que CCleaner scan ton registre.
• Une fois le scan terminé, coche toutes les entrèes qu'il t'aura trouvée.
• Tu peux cliquer ensuite sur Corriger les erreurs.
Si tu n'est pas sur de ce que tu fais, tu peux choisir de sauvegarder les entrées cochées pour les restaurer ultérieurement
----------------------------------------------------------------------------
¤ Vide ta Corbeille.
----------------------------------------------------------------------------
¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.
Précise tes soucis s’il en reste....
Tiens-moi au courant
A+ -
ouille va y avoir du boulot; je ferais ceci durant le w.e. et te tiendrais au courant la semaine prochaine je vais recommander le site à une amie qui a qqes soucis avec son p.c.
bon w.e. et à+ pour les résultats -
Salut
Ca parait consequent mais c est facile tu verras ! (rapide aussi)
Pas de soucis, ton amie est la bienvenue
a+ -
Logfile of HijackThis v1.99.1
Scan saved at 16:54:32, on 05/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [MW1HelperStartUp] C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - Global Startup: Logitech SetPoint.lnk = D:\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_s...
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} (VirginMega DownloadManager) - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - C:\Program Files\FileZilla Server\FileZilla Server.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
---------------------------------------------------------
ewido anti-spyware - Scan-Bericht
---------------------------------------------------------
+ Erstellt um: 16:22:42 05/08/2006
+ Scan-Ergebnis:
Keine Bedrohung gefunden.
::Berichtende
hello
voilà, j'ai suivi à la lettre ton mode d'emploi et je crois que j'ai viré toutes mes "saloperies"
merci de ton aide et bravo -
Et bien, je vois que tu as réussi, BRAVO a toi !
Ou en sont tes soucis?
a+ -
Salut
donc si je comprend tu as une version piraté?
Et aussi windows te le dis au demarrage? Tu as telechargé quelque chose venant de Microsoft?
a+ -
-
Re
Pourtant tu as le SP2, donc les maj windows tu les a quelques part????
Ca te dit quelque chose Windows Genuine Avantage?
a+ -
hye
genuine, j'ai vu sur le net, très cher, mais si je peux continuer comme avant en sup. à chaque fois le message, cela m'est égal -
Non,ce n est pas pyant, c est surrement la mise a jour qui te cause ce soucis.
Toi ce que tu veux c est la supprimer? -
salut
en fait, je sais que j'ai une version "piratée", simplement je voudrais sup. le message qui s'affiche en allumant mon p.c. Si cela est possible, sinon, je ferais avec
bonne nuit -
Salut
Je peux te donner une maniere mais illégal lol
Ou sinon, dans ajout/supp de programme, tu as Windows Genuine Avantage?
a+ -
salut
essai ceci
http://www.icodia.com/affnews.php?id=MjAwNi8wNi8zMC8x
a+ -
bonjour
je voulais te remercier pour l'ensemble de tes conseils;pour moi qui ne suis guère experte, tout était clair, la preuve, je suis arrivée à nettoyer correctement mon p.c. si un jour j'ai à nouveau des pb, je sais à qui m'adresser. excellente journée et bon w.e.
- 1
- 2
Suivant
