W98 et protection antispyware - Page 2

Résolu
Précédent
  • 1
  • 2
phil39 Messages postés 66 Statut Membre
 
Re,

Voisi le log produit:

"Silent Runners.vbs", revision 46, https://www.silentrunners.org/
Operating System: Windows 98
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NBJ" = ""C:\PROGRAM FILES\AHEAD\NERO BACKITUP\NBJ.EXE"" ["Ahead Software AG"]
"Update Service" = "C:\PROGRA~1\FICHIE~1\TEKNUM~1\UPDATE.EXE /startup" ["Teknum Systems AS"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ScanRegistry" = "C:\WINDOWS\scanregw.exe /autorun" [MS]
"TaskMonitor" = "C:\WINDOWS\taskmon.exe" [MS]
"SystemTray" = "SysTray.Exe" [MS]
"LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
"AtiPTA" = "Atiptaxx.exe" ["ATI Technologies, Inc."]
"HydarVisionDesktopManager" = "desk98.exe" ["ATI Technologies Inc."]
"C-Media Mixer" = "C:\WINDOWS\NewMixer.exe /startup" ["C-Media Electronic Inc. (www.cmedia.com.tw)"]
"Regx10EXE" = "C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe" ["ATI Technologies Inc."]
"WheelMouse" = "C:\Program Files\Dual Wheel Mouse\4DMAIN.EXE -startup" [null data]
"StillImageMonitor" = "C:\WINDOWS\SYSTEM\STIMON.EXE" [MS]
"Demon" = "C:\PROGRA~1\MESSAG~1\demon.exe" ["France Telecom"]
"Tweak UI" = "RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" [MS]
"RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."]
"BDMCon" = ""C:\Program Files\Softwin\BitDefender9\bdmcon.exe"" ["SOFTWIN S.R.L."]
"BitDefender Virus Shield" = ""C:\Program Files\Softwin\BitDefender9\vsserv.exe"" ["SOFTWIN S.R.L."]
"BDOESRV" = ""C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"" ["SOFTWIN SRL"]
"BitDefender Live Service" = ""C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe"" ["SOFTWIN S.R.L."]
"BDNewsAgent" = ""C:\PROGRAM FILES\SOFTWIN\BITDEFENDER9\bdnagent.exe"" ["SOFTWIN S.R.L"]
"WinPatrol" = "C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\winpatrol.exe" ["BillP Studios"]
"CaISSDT" = ""C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"" ["Computer Associates International, Inc."]
"eTrustPPAP" = ""C:\PROGRAM FILES\CA\ETRUST INTERNET SECURITY SUITE\ETRUST PESTPATROL ANTI-SPYWARE\PPACTIVEDETECTION.EXE"" ["Computer Associates"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
"LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
"BitDefender Communicator" = ""C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\\xcommsvr.exe"" ["Softwin"]
"BitDefender Scan Server" = ""C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\\bdss.exe"" [null data]
"BitDefender Live! Init" = ""C:\Program Files\Softwin\BitDefender9\bdinit.exe"" [null data]

HKLM\Software\Microsoft\Active Setup\Installed Components\
MotownRecPerUser\(Default) = "Installation de Windows - Multimédia"
\StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownRecPerUser_remove 64 C:\WINDOWS\INF\motown.inf" [MS]
PerUser_CDPlayer_Inis\(Default) = "Installation de Windows - Lecteur CD"
\StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CDPlayer_Inis_remove 64 C:\WINDOWS\INF\mmopt.inf" [MS]
OlsAolPerUser\(Default) = "Installation de Windows - AOL"
\StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsAolPerUserRemove 64 C:\WINDOWS\INF\ols.inf" [MS]
OlsFTPerUser\(Default) = "Installation de Windows - France Telecom"
\StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsFTPerUserRemove 64 C:\WINDOWS\INF\ols.inf" [MS]
OlsCompuservePerUser\(Default) = "Installation de Windows - CompuServe"
\StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsCompuservePerUserRemove 64 C:\WINDOWS\INF\ols.inf" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX" ["("]
{4A368E80-174F-4872-96B5-0B27DDD11DB2}\(Default) = "SpywareGuard Download Protection"
-> {HKLM...CLSID} = "SpywareGuardDLBLOCK.CBrowserHelper"
\InProcServer32\(Default) = "C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL" [null data]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL" ["Safer Networking Limited"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{D0FAC080-AE1A-11ce-8016-CE90976DC901}" = "Aperçu rapide Picture Publisher"
-> {HKLM...CLSID} = "Picture Publisher File Viewer"
\InProcServer32\(Default) = "ppiv30.dll" [null data]
"{2E9D3540-211C-11d0-A5F2-00A0248C37BE}" = "Nero Shell Extension Property Sheet"
-> {HKLM...CLSID} = "Nero Shell Extension Property Sheet"
\InProcServer32\(Default) = "C:\Program Files\Ahead\nero\neroshx.dll" ["Ahead Software AG"]
"{81559C35-8464-49F7-BB0E-07A383BEF910}" = (no title provided)
-> {HKLM...CLSID} = "SpywareGuard.Handler"
\InProcServer32\(Default) = "C:\PROGRAM FILES\SPYWAREGUARD\SPYWAREGUARD.DLL" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{81559C35-8464-49F7-BB0E-07A383BEF910}" = (no title provided)
-> {HKLM...CLSID} = "SpywareGuard.Handler"
\InProcServer32\(Default) = "C:\PROGRAM FILES\SPYWAREGUARD\SPYWAREGUARD.DLL" [null data]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{7A5117B0-B594-4DA8-829D-D15BF11996F2}\(Default) = "awxDTools - ColumnHandler"
-> {HKLM...CLSID} = "awxDTColumnHandler Class"
\InProcServer32\(Default) = "C:\PROGRAM FILES\D-TOOLS\ARNIWORX\AWXDTOOLS\AWXDTOOLS.DLL" ["arniWORX"]
{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"
\InProcServer32\(Default) = "C:\PROGRAM FILES\FICHIERS COMMUNS\AHEAD\LIB\NERODIGITALEXT.DLL" ["Nero AG"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}"
-> {HKLM...CLSID} = "PowerArchiver Shell Extensions"
\InProcServer32\(Default) = "C:\Program Files\PowerArchiver\PASHLEXT.DLL" ["eFront Media, Inc."]
SharedMenuHandler\(Default) = "{916F1ADF-2F02-46C2-B7D2-310468390750}"
-> {HKLM...CLSID} = "Shared Shell Menu Handler"
\InProcServer32\(Default) = "ssmenu.dll" ["Teknum Systems AS"]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
SharedMenuHandler\(Default) = "{916F1ADF-2F02-46C2-B7D2-310468390750}"
-> {HKLM...CLSID} = "Shared Shell Menu Handler"
\InProcServer32\(Default) = "ssmenu.dll" ["Teknum Systems AS"]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}"
-> {HKLM...CLSID} = "PowerArchiver Shell Extensions"
\InProcServer32\(Default) = "C:\Program Files\PowerArchiver\PASHLEXT.DLL" ["eFront Media, Inc."]
a2FreeContMenu\(Default) = "{A155339D-CCCD-4714-85EB-3754B804C9DF}"
-> {HKLM...CLSID} = "a-squared Free Context Menu"
\InProcServer32\(Default) = "C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL" ["Emsi Software GmbH"]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is enabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Startup items in "Startup" & "All Users...Startup" folders:
-----------------------------------------------------------

C:\WINDOWS\Menu Démarrer\Programmes\Démarrage
"EPSON Contrôleur en arrière plan" -> shortcut to: "C:\ESM2\STMS.exe" ["SEIKO EPSON CORPORATION"]

Enabled Scheduled Tasks:
------------------------

"XoftSpySE" -> launches: "C:\PROGRAM FILES\XOFTSPYSE\XoftSpy.exe -t" ["ParetoLogic"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "C:\WINDOWS\SYSTEM\rnr20.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
C:\WINDOWS\SYSTEM\mswsosp.dll [MS], 1
C:\WINDOWS\SYSTEM\msafd.dll [MS], 2 - 4
C:\WINDOWS\SYSTEM\rsvpsp.dll [MS], 5 - 6

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}"
-> {HKLM...CLSID} = "Copernic Agent"
\InProcServer32\(Default) = "C:\PROGRA~1\COPERN~1\COPERN~1.DLL" ["Copernic Technologies Inc."]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}" = (no title provided)
-> {HKLM...CLSID} = "Copernic Agent"
\InProcServer32\(Default) = "C:\PROGRA~1\COPERN~1\COPERN~1.DLL" ["Copernic Technologies Inc."]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Real.com"
\InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\Shdocvw.dll" [MS]
{6F480F82-C3A6-4D35-96F7-B297AD49FBE8}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Résultats de Copernic Agent"
\InProcServer32\(Default) = "C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENTEXT.DLL" ["Copernic Technologies Inc."]
{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Copernic Agent"
\InProcServer32\(Default) = "C:\PROGRA~1\COPERN~1\COPERN~1.DLL" ["Copernic Technologies Inc."]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{44226DFF-747E-4EDC-B30C-78752E50CD0C}\
"ButtonText" = "ATI TV"

{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
"ButtonText" = "Real.com"

{193B17B0-7C9F-4D5B-AEAB-8D3605EFC084}\
"MenuText" = "Démarrer Copernic Agent"
"Exec" = "C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENT.EXE" ["Copernic Technologies Inc."]

{688DC797-DC11-46A7-9F1B-445F4F58CE6E}\
"ButtonText" = "Copernic Agent"
"Exec" = "C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENT.EXE" ["Copernic Technologies Inc."]

{76DD9E77-F06C-4471-AB6C-CF03C5C6B5B0}\
"ButtonText" = "AmusantVIP"
"Exec" = "C:\WINDOWS\SYSTEM\AmusantVIP" [file not found]

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Console Java (Sun)"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}"
-> {HKLM...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\PROGRAM FILES\JAVA\JRE1.5.0_07\BIN\SSV.DLL" ["Sun Microsystems, Inc."]

{85D1F590-48F4-11D9-9669-0800200C9A66}\
"MenuText" = "Uninstall BitDefender Online Scanner v8"
"Exec" = "%windir%\bdoscandel.exe" [null data]

Miscellaneous IE Hijack Points
------------------------------

HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data)
The Internet Explorer version cannot be found!

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
The contents of IERESET.INF cannot be reliably checked!

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
[Strings]: SAFESITE_VALUE="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2fintl%2ffr%2f%3f"
[Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

Missing lines (compared with English-language version):
[Strings]: 3 lines

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
"{BE89472C-B803-4D1D-9A9A-0A63660E0FE3}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\COPERN~1\COPERN~1.DLL" ["Copernic Technologies Inc."]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
EPSON BiD Monitor1\Driver = "EBPMON.DLL" ["SEIKO EPSON CORPORATION"]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 10 seconds, including 5 seconds for message boxes)

Bonne interprétation

Bonne nuit et à demain

A+
0
Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
 
salut

tu l as supprimé?

a+
0
phil39 Messages postés 66 Statut Membre
 
Salut régis,

Le fichier est supprimer ,mais dois-je nettoyer la clé de registe IE que je t'ai envoyé et la ligne correspondante dans Win.ini ?

Merci
A+
0
Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
 
Salut

Comme je ne veux pas prendre de risque, relance pest petrol et donne moi le rapport.

a+
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
phil39 Messages postés 66 Statut Membre
 
Salut regis,

Avec un peu de retard voici le log de Pest patrol

13/08/2006-12:14:39 , Détecté(s) , 123Mania , Adware , Key "hkey_current_user \software\microsoft\windows\currentversion\wintrust\trust providers\software publishing\trust database\0" value "goicfboogidikkejccmclpieicihhlpo mmhkbp" data "futurpago , 0
13/08/2006-12:15:52 , Détecté(s) , 123Mania , Adware , Key "hkey_current_user \software\matrix_html" , -1
13/08/2006-12:16:06 , Détecté(s) , 123Mania , Adware , Key "hkey_local_machine \software\microsoft\internet explorer\extensions\{76dd9e77-f06c-4471-ab6c-cf03c5c6b5b0}" value "clsid" data "{1fba04ee-3024-11d2-8f1f-0000f87abd16}" , -1
13/08/2006-12:16:07 , Détecté(s) , 123Mania , Adware , Key "hkey_local_machine \software\microsoft\internet explorer\extensions\{76dd9e77-f06c-4471-ab6c-cf03c5c6b5b0}" value "default visible" data "yes" , -1
13/08/2006-12:23:14 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\danish.lng" , 371008318
13/08/2006-12:23:14 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\czech.lng" , 1713654524
13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\finnish.lng" , 2039672743
13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\turkish.lng" , 1766265515
13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\slovak.lng" , -1712153495
13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\italiano.lng" , -1740154950
13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\dutch.lng" , 435198673
13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\swedish.lng" , 1017818961
13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\chinese.lng" , -668833289
13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\magyar.lng" , -2066825464
13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\slovenian.lng" , -210617504
13/08/2006-12:23:16 , Détecté(s) , ARCHPR , Password Cracker , File "C:\Program Files\ARCHPR\file_id.diz" , -739333178
13/08/2006-12:23:16 , Détecté(s) , Remote KeyLogger 1.0.1.0 , Key Logger , File "C:\Program Files\ARCHPR\license.txt" , -816131938
13/08/2006-12:23:16 , Détecté(s) , ARCHPR , Password Cracker , File "C:\Program Files\ARCHPR\order.frm" , -1550335179
13/08/2006-12:23:16 , Détecté(s) , ARCHPR , Password Cracker , File "C:\Program Files\ARCHPR\order.txt" , 1968415292
***Fin de rapport***

Merci

A+
0
Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
 
Ok

tu peux relancer spybot?

a+
0
phil39 Messages postés 66 Statut Membre
 
Salut régis,

Avec un peu de retard voici le log Spybot

Matrix: Réglages (Valeur du registre, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\goicfboogidikkejccmclpieicihhlpo ejfebp

Matrix: Réglages (Valeur du registre, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\ppcimdnnnjbeahepfabjipfginloedkg cfcaak

Matrix: Réglages (Valeur du registre, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\ppcimdnnnjbeahepfabjipfginloedkg enodaj

Alexa Related: Lien (Remplacer le fichier, nothing done)
C:\WINDOWS\Web\RELATED.HTM

PopUp Notes: Réglages utilisateur (Clé du registre, nothing done)
HKEY_USERS\.DEFAULT\Software\Winston

Teknum Updater: Common file (global) (Fichier, nothing done)
C:\Program Files\Fichiers communs\Teknum Systems\update.exe

Teknum Updater: Common file (global) (Fichier, nothing done)
C:\Program Files\Fichiers communs\Teknum Systems\update.dat

ValueClick: Cookie traceur (Internet Explorer: USER) (Cookie, nothing done)

Avenue A, Inc.: Cookie traceur (Internet Explorer: USER) (Cookie, nothing done)

DoubleClick: Cookie traceur (Internet Explorer: USER) (Cookie, nothing done)

MediaPlex: Cookie traceur (Internet Explorer: USER) (Cookie, nothing done)

WebTrends live: Cookie traceur (Internet Explorer: USER) (Cookie, nothing done)

Log: Activity: ModemDet.txt (Sauver le fichier, nothing done)
C:\WINDOWS\ModemDet.txt

Log: Shutdown: System\wbem\logs\mofcomp.log (Sauver le fichier, nothing done)
C:\WINDOWS\System\wbem\logs\mofcomp.log

Log: Shutdown: System\wbem\logs\wbemcore.log (Sauver le fichier, nothing done)
C:\WINDOWS\System\wbem\logs\wbemcore.log

Log: Shutdown: System\wbem\logs\wbemess.log (Sauver le fichier, nothing done)
C:\WINDOWS\System\wbem\logs\wbemess.log

Log: Shutdown: System\wbem\logs\winmgmt.log (Sauver le fichier, nothing done)
C:\WINDOWS\System\wbem\logs\winmgmt.log

Cookie: Cookie (54) (Cookie, nothing done)

Cache: Cache (200) (Cache, nothing done)

--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2006-08-05 unins000.exe (51.41.0.0)
2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-05-31 Update.exe (1.4.0.0)
2006-02-06 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2006-02-20 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2006-08-04 Includes\Cookies.sbi (*)
2006-08-04 Includes\Dialer.sbi (*)
2006-08-04 Includes\Hijackers.sbi (*)
2006-08-04 Includes\Malware.sbi (*)
2006-08-04 Includes\Keyloggers.sbi (*)
2006-08-04 Includes\Revision.sbi (*)
2006-08-04 Includes\Security.sbi (*)
2006-08-04 Includes\Spybots.sbi (*)
2006-08-04 Includes\Trojans.sbi (*)
2005-02-17 Includes\Tracks.uti
2006-08-04 Includes\PUPS.sbi (*)

Merci pour tes recherches

A+
0
Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
 
Ok

supprimes ce qu il trouve et relance spybot

a+
0
phil39 Messages postés 66 Statut Membre
 
Salut Régis,

J'ai un doute sur les lignes à supprimer ,je te fait parvenir les log spybot et adaware avec un supplément d'info sur les lignes qui me paraissent bonne car correspondantes à des programmes que j'utilise.

De plus je te confirme que Bitdefender v9 fait planter asquared sous W98 depuis la version 2 ,un rapport automatique est partie chez les programmeurs.
De même bitdefender fait planter W98 lors de certaines mise à jour , un rapport automatique est partie chez les programmeurs aussi j'espère un élément de réponse de leur part !.

Log Spybot

Matrix: Réglages (Valeur du registre, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\goicfboogidikkejccmclpieicihhlpo ejfebp

Matrix: Réglages (Valeur du registre, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\ppcimdnnnjbeahepfabjipfginloedkg cfcaak

Matrix: Réglages (Valeur du registre, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\ppcimdnnnjbeahepfabjipfginloedkg enodaj

les lignes ci-dessus apartiennent à wintrust mais je ne sais pas ce que c'est.

Alexa Related: Lien (Remplacer le fichier, nothing done)
C:\WINDOWS\Web\RELATED.HTM

PopUp Notes: Réglages utilisateur (Clé du registre, nothing done)
HKEY_USERS\.DEFAULT\Software\Winston

Ces deux là appartienne à windows ?

Teknum Updater: Common file (global) (Fichier, nothing done)
C:\Program Files\Fichiers communs\Teknum Systems\update.exe

Teknum Updater: Common file (global) (Fichier, nothing done)
C:\Program Files\Fichiers communs\Teknum Systems\update.dat

Voici ce qui se trouve dans un fichier txt du répertoire ci-dessus

This folder contains files shared by different programs
installed on your machine.

CAUTION!
========
If you delete any of files in this folder, your computer
or one of your programs may no longer work correctly.


Log adavare
Examen de la base de registre lancé
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Windows Objet reconnu!
Type : Donnée de registre
Donnée :
Entrée de registre : HKEY_USERS
Object : .DEFAULT\Software\Microsoft\MediaPlayer\Player\Settings
Valeur : Client ID
Donnée :

Windows Objet reconnu!
Type : Donnée de registre
Donnée :
Entrée de registre : HKEY_CURRENT_USER
Object : Software\Microsoft\MediaPlayer\Player\Settings
Valeur : Client ID
Donnée :

Ci dessus deux fichiers media player

Résultat de l'examen de la base de registre:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nouveaux objets: 2
Objets trouvés jusqu'ici: 2

Examen complet de la base de registre lancé
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Teknum Updater Objet reconnu!
Type : Valeur de registre
Donnée : c:\progra~1\fichie~1\teknum~1\update.exe
Entrée de registre : HKEY_CURRENT_USER
Object : Software\Microsoft\Windows\CurrentVersion\Run
Valeur : Update Service

Résultat de l'examen profond de la base de registre:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nouveaux objets: 1
Objets trouvés jusqu'ici: 3

Examen et vérification profonds de fichiers (C:)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Teknum Updater Objet reconnu!
Type : Fichier
Donnée : tsuninst.exe
Object : C:\Program Files\Fichiers communs\Teknum Systems\
FileSize : 24 KB
FileVersion : 5.5.1.34
ProductVersion : 1.0
Copyright : 1997, Teknum Systems AS
CompanyName : Teknum Systems
ProductName : Teknum Systems Uninstaller
Created on : 20/08/2005 08:14:04
Last accessed : 16/08/2006 22:00:00
Last modified : 20/08/2005 08:14:06

Teknum Updater Objet reconnu!
Type : Fichier
Donnée : update.exe
Object : C:\Program Files\Fichiers communs\Teknum Systems\
FileSize : 19 KB
FileVersion : 5.5.0.85
ProductVersion : 1.0.0.0
Copyright : Teknum Systems AS
CompanyName : Teknum Systems AS
Created on : 20/08/2005 08:14:03
Last accessed : 16/08/2006 22:00:00
Last modified : 20/08/2005 08:14:04

Teknum Updater Objet reconnu!
Type : Fichier
Donnée : updsvc.exe
Object : C:\Program Files\Fichiers communs\Teknum Systems\
FileSize : 91 KB
FileVersion : 5.5.0.149
ProductVersion : 5.5
Copyright : Teknum Systems AS
CompanyName : Teknum Systems AS
FileDescription : Shared Update Service
OriginalFilename : updsvc.exe
ProductName : Shared Update Service
Created on : 20/08/2005 08:14:03
Last accessed : 16/08/2006 22:00:00
Last modified : 20/08/2005 08:14:04

Teknum Updater Objet reconnu!
Type : Fichier
Donnée : tssetup.exe
Object : C:\Program Files\Fichiers communs\Teknum Systems\
FileSize : 230 KB
FileVersion : 5.5.0.292
ProductVersion : 1.0.0.0
Copyright : 1994-2001, Teknum Systems AS
CompanyName : Teknum Systems
FileDescription : Shared Windows Setup Engine
Created on : 20/08/2005 08:14:03
Last accessed : 16/08/2006 22:00:00
Last modified : 20/08/2005 08:14:04

Teknum Updater Objet reconnu!
Type : Fichier
Donnée : sendmail.exe
Object : C:\Program Files\Fichiers communs\Teknum Systems\
FileSize : 15 KB
FileVersion : 5.5.0.44
ProductVersion : 1.0.0.0
Copyright : Teknum Systems AS
CompanyName : Teknum Systems AS
Created on : 20/08/2005 08:14:03
Last accessed : 16/08/2006 22:00:00
Last modified : 20/08/2005 08:14:04

Teknum Updater Objet reconnu!
Type : Fichier
Donnée : tshkdrag.dll
Object : C:\Program Files\Fichiers communs\Teknum Systems\
FileSize : 9 KB
FileVersion : 5.0.0.22
ProductVersion : 1.0.0.0
Copyright : Teknum Systems AS
CompanyName : Teknum Systems AS
Created on : 20/08/2005 08:14:03
Last accessed : 16/08/2006 22:00:00
Last modified : 20/08/2005 08:14:04

Teknum Updater Objet reconnu!
Type : Fichier
Donnée : errorlog.exe
Object : C:\Program Files\Fichiers communs\Teknum Systems\
FileSize : 34 KB
FileVersion : 5.5.0.14
ProductVersion : 1.0.0.0
Copyright : Teknum Systems AS
CompanyName : Teknum Systems AS
Created on : 20/08/2005 08:14:03
Last accessed : 16/08/2006 22:00:00
Last modified : 20/08/2005 08:14:04

Teknum Updater Objet reconnu!
Type : Dossier
Object : C:\Program Files\Fichiers communs\Teknum Systems

tous les fichiers ci-dessus appartiennent au répertoire Teknum que Spybot à trouvé.

Résultat de l'examen du disque pour C:\
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Nouveaux objets: 0
Objets trouvés jusqu'ici: 11

22:11:40 Examen effectué

Résumé de cet examen
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Durée totale de l'examen:00:18:38:10
Objets examinés:72393
Objets identifiés:11
Objets ignorés:0
Nouveaux objets:11

Que dois-je faire avec ces fichiers détectés ?

merci pour ton aide

A+
0
Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
 
Salut

Supprime tout ce qu il trouve

a+
0
phil39 Messages postés 66 Statut Membre
 
Salt regis59 ,

Je me pose une question concernant Hijacthis.

Loosque une sélection est faite sur les lignes qu'il trouve et que l'on clic sur Fix it , que fais il exactement ?

Est ce qu'il supprime une entrée de la base de registre ou un programme .

Ou tous simplement l'empèche de démarrer.

Merci pour ton aide.

A+
0
asda
 
asd
0
Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
 
asd?
0
Précédent
  • 1
  • 2