W98 et protection antispyware - Page 2

Résolu
Précédent
  • 1
  • 2
  1. phil39 Messages postés 66 Statut Membre
     
    Re,

    Voisi le log produit:

    "Silent Runners.vbs", revision 46, https://www.silentrunners.org/
    Operating System: Windows 98
    Output limited to non-default values, except where indicated by "{++}"

    Startup items buried in registry:
    ---------------------------------

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "NBJ" = ""C:\PROGRAM FILES\AHEAD\NERO BACKITUP\NBJ.EXE"" ["Ahead Software AG"]
    "Update Service" = "C:\PROGRA~1\FICHIE~1\TEKNUM~1\UPDATE.EXE /startup" ["Teknum Systems AS"]

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "ScanRegistry" = "C:\WINDOWS\scanregw.exe /autorun" [MS]
    "TaskMonitor" = "C:\WINDOWS\taskmon.exe" [MS]
    "SystemTray" = "SysTray.Exe" [MS]
    "LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
    "AtiPTA" = "Atiptaxx.exe" ["ATI Technologies, Inc."]
    "HydarVisionDesktopManager" = "desk98.exe" ["ATI Technologies Inc."]
    "C-Media Mixer" = "C:\WINDOWS\NewMixer.exe /startup" ["C-Media Electronic Inc. (www.cmedia.com.tw)"]
    "Regx10EXE" = "C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe" ["ATI Technologies Inc."]
    "WheelMouse" = "C:\Program Files\Dual Wheel Mouse\4DMAIN.EXE -startup" [null data]
    "StillImageMonitor" = "C:\WINDOWS\SYSTEM\STIMON.EXE" [MS]
    "Demon" = "C:\PROGRA~1\MESSAG~1\demon.exe" ["France Telecom"]
    "Tweak UI" = "RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" [MS]
    "RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."]
    "BDMCon" = ""C:\Program Files\Softwin\BitDefender9\bdmcon.exe"" ["SOFTWIN S.R.L."]
    "BitDefender Virus Shield" = ""C:\Program Files\Softwin\BitDefender9\vsserv.exe"" ["SOFTWIN S.R.L."]
    "BDOESRV" = ""C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"" ["SOFTWIN SRL"]
    "BitDefender Live Service" = ""C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe"" ["SOFTWIN S.R.L."]
    "BDNewsAgent" = ""C:\PROGRAM FILES\SOFTWIN\BITDEFENDER9\bdnagent.exe"" ["SOFTWIN S.R.L"]
    "WinPatrol" = "C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\winpatrol.exe" ["BillP Studios"]
    "CaISSDT" = ""C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"" ["Computer Associates International, Inc."]
    "eTrustPPAP" = ""C:\PROGRAM FILES\CA\ETRUST INTERNET SECURITY SUITE\ETRUST PESTPATROL ANTI-SPYWARE\PPACTIVEDETECTION.EXE"" ["Computer Associates"]

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
    "LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
    "BitDefender Communicator" = ""C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\\xcommsvr.exe"" ["Softwin"]
    "BitDefender Scan Server" = ""C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\\bdss.exe"" [null data]
    "BitDefender Live! Init" = ""C:\Program Files\Softwin\BitDefender9\bdinit.exe"" [null data]

    HKLM\Software\Microsoft\Active Setup\Installed Components\
    MotownRecPerUser\(Default) = "Installation de Windows - Multimédia"
    \StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownRecPerUser_remove 64 C:\WINDOWS\INF\motown.inf" [MS]
    PerUser_CDPlayer_Inis\(Default) = "Installation de Windows - Lecteur CD"
    \StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CDPlayer_Inis_remove 64 C:\WINDOWS\INF\mmopt.inf" [MS]
    OlsAolPerUser\(Default) = "Installation de Windows - AOL"
    \StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsAolPerUserRemove 64 C:\WINDOWS\INF\ols.inf" [MS]
    OlsFTPerUser\(Default) = "Installation de Windows - France Telecom"
    \StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsFTPerUserRemove 64 C:\WINDOWS\INF\ols.inf" [MS]
    OlsCompuservePerUser\(Default) = "Installation de Windows - CompuServe"
    \StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsCompuservePerUserRemove 64 C:\WINDOWS\INF\ols.inf" [MS]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
    -> {HKLM...CLSID} = "AcroIEHlprObj Class"
    \InProcServer32\(Default) = "C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX" ["("]
    {4A368E80-174F-4872-96B5-0B27DDD11DB2}\(Default) = "SpywareGuard Download Protection"
    -> {HKLM...CLSID} = "SpywareGuardDLBLOCK.CBrowserHelper"
    \InProcServer32\(Default) = "C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL" [null data]
    {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
    -> {HKLM...CLSID} = "SSVHelper Class"
    \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]
    {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
    -> {HKLM...CLSID} = (no title provided)
    \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL" ["Safer Networking Limited"]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
    "{D0FAC080-AE1A-11ce-8016-CE90976DC901}" = "Aperçu rapide Picture Publisher"
    -> {HKLM...CLSID} = "Picture Publisher File Viewer"
    \InProcServer32\(Default) = "ppiv30.dll" [null data]
    "{2E9D3540-211C-11d0-A5F2-00A0248C37BE}" = "Nero Shell Extension Property Sheet"
    -> {HKLM...CLSID} = "Nero Shell Extension Property Sheet"
    \InProcServer32\(Default) = "C:\Program Files\Ahead\nero\neroshx.dll" ["Ahead Software AG"]
    "{81559C35-8464-49F7-BB0E-07A383BEF910}" = (no title provided)
    -> {HKLM...CLSID} = "SpywareGuard.Handler"
    \InProcServer32\(Default) = "C:\PROGRAM FILES\SPYWAREGUARD\SPYWAREGUARD.DLL" [null data]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
    INFECTION WARNING! "{81559C35-8464-49F7-BB0E-07A383BEF910}" = (no title provided)
    -> {HKLM...CLSID} = "SpywareGuard.Handler"
    \InProcServer32\(Default) = "C:\PROGRAM FILES\SPYWAREGUARD\SPYWAREGUARD.DLL" [null data]

    HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
    {7A5117B0-B594-4DA8-829D-D15BF11996F2}\(Default) = "awxDTools - ColumnHandler"
    -> {HKLM...CLSID} = "awxDTColumnHandler Class"
    \InProcServer32\(Default) = "C:\PROGRAM FILES\D-TOOLS\ARNIWORX\AWXDTOOLS\AWXDTOOLS.DLL" ["arniWORX"]
    {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
    -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"
    \InProcServer32\(Default) = "C:\PROGRAM FILES\FICHIERS COMMUNS\AHEAD\LIB\NERODIGITALEXT.DLL" ["Nero AG"]

    HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
    PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}"
    -> {HKLM...CLSID} = "PowerArchiver Shell Extensions"
    \InProcServer32\(Default) = "C:\Program Files\PowerArchiver\PASHLEXT.DLL" ["eFront Media, Inc."]
    SharedMenuHandler\(Default) = "{916F1ADF-2F02-46C2-B7D2-310468390750}"
    -> {HKLM...CLSID} = "Shared Shell Menu Handler"
    \InProcServer32\(Default) = "ssmenu.dll" ["Teknum Systems AS"]

    HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
    SharedMenuHandler\(Default) = "{916F1ADF-2F02-46C2-B7D2-310468390750}"
    -> {HKLM...CLSID} = "Shared Shell Menu Handler"
    \InProcServer32\(Default) = "ssmenu.dll" ["Teknum Systems AS"]

    HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
    PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}"
    -> {HKLM...CLSID} = "PowerArchiver Shell Extensions"
    \InProcServer32\(Default) = "C:\Program Files\PowerArchiver\PASHLEXT.DLL" ["eFront Media, Inc."]
    a2FreeContMenu\(Default) = "{A155339D-CCCD-4714-85EB-3754B804C9DF}"
    -> {HKLM...CLSID} = "a-squared Free Context Menu"
    \InProcServer32\(Default) = "C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL" ["Emsi Software GmbH"]

    Active Desktop and Wallpaper:
    -----------------------------

    Active Desktop is enabled at this entry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

    Startup items in "Startup" & "All Users...Startup" folders:
    -----------------------------------------------------------

    C:\WINDOWS\Menu Démarrer\Programmes\Démarrage
    "EPSON Contrôleur en arrière plan" -> shortcut to: "C:\ESM2\STMS.exe" ["SEIKO EPSON CORPORATION"]

    Enabled Scheduled Tasks:
    ------------------------

    "XoftSpySE" -> launches: "C:\PROGRAM FILES\XOFTSPYSE\XoftSpy.exe -t" ["ParetoLogic"]

    Winsock2 Service Provider DLLs:
    -------------------------------

    Namespace Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
    000000000001\LibraryPath = "C:\WINDOWS\SYSTEM\rnr20.dll" [MS]

    Transport Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
    00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
    C:\WINDOWS\SYSTEM\mswsosp.dll [MS], 1
    C:\WINDOWS\SYSTEM\msafd.dll [MS], 2 - 4
    C:\WINDOWS\SYSTEM\rsvpsp.dll [MS], 5 - 6

    Toolbars, Explorer Bars, Extensions:
    ------------------------------------

    Toolbars

    HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
    "{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}"
    -> {HKLM...CLSID} = "Copernic Agent"
    \InProcServer32\(Default) = "C:\PROGRA~1\COPERN~1\COPERN~1.DLL" ["Copernic Technologies Inc."]

    HKLM\Software\Microsoft\Internet Explorer\Toolbar\
    "{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}" = (no title provided)
    -> {HKLM...CLSID} = "Copernic Agent"
    \InProcServer32\(Default) = "C:\PROGRA~1\COPERN~1\COPERN~1.DLL" ["Copernic Technologies Inc."]

    Explorer Bars

    HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
    {FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\(Default) = (no title provided)
    -> {HKLM...CLSID} = "Real.com"
    \InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\Shdocvw.dll" [MS]
    {6F480F82-C3A6-4D35-96F7-B297AD49FBE8}\(Default) = (no title provided)
    -> {HKLM...CLSID} = "Résultats de Copernic Agent"
    \InProcServer32\(Default) = "C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENTEXT.DLL" ["Copernic Technologies Inc."]
    {F2E259E8-0FC8-438C-A6E0-342DD80FA53E}\(Default) = (no title provided)
    -> {HKLM...CLSID} = "Copernic Agent"
    \InProcServer32\(Default) = "C:\PROGRA~1\COPERN~1\COPERN~1.DLL" ["Copernic Technologies Inc."]

    Extensions (Tools menu items, main toolbar menu buttons)

    HKLM\Software\Microsoft\Internet Explorer\Extensions\
    {44226DFF-747E-4EDC-B30C-78752E50CD0C}\
    "ButtonText" = "ATI TV"

    {CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
    "ButtonText" = "Real.com"

    {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084}\
    "MenuText" = "Démarrer Copernic Agent"
    "Exec" = "C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENT.EXE" ["Copernic Technologies Inc."]

    {688DC797-DC11-46A7-9F1B-445F4F58CE6E}\
    "ButtonText" = "Copernic Agent"
    "Exec" = "C:\PROGRAM FILES\COPERNIC AGENT\COPERNICAGENT.EXE" ["Copernic Technologies Inc."]

    {76DD9E77-F06C-4471-AB6C-CF03C5C6B5B0}\
    "ButtonText" = "AmusantVIP"
    "Exec" = "C:\WINDOWS\SYSTEM\AmusantVIP" [file not found]

    {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
    "MenuText" = "Console Java (Sun)"
    "CLSIDExtension" = "{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}"
    -> {HKLM...CLSID} = "Java Plug-in"
    \InProcServer32\(Default) = "C:\PROGRAM FILES\JAVA\JRE1.5.0_07\BIN\SSV.DLL" ["Sun Microsystems, Inc."]

    {85D1F590-48F4-11D9-9669-0800200C9A66}\
    "MenuText" = "Uninstall BitDefender Online Scanner v8"
    "Exec" = "%windir%\bdoscandel.exe" [null data]

    Miscellaneous IE Hijack Points
    ------------------------------

    HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data)
    The Internet Explorer version cannot be found!

    C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
    The contents of IERESET.INF cannot be reliably checked!

    Added lines (compared with English-language version):
    [Strings]: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    [Strings]: SAFESITE_VALUE="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2fintl%2ffr%2f%3f"
    [Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

    Missing lines (compared with English-language version):
    [Strings]: 3 lines

    HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
    "{BE89472C-B803-4D1D-9A9A-0A63660E0FE3}" = (no title provided)
    -> {HKLM...CLSID} = (no title provided)
    \InProcServer32\(Default) = "C:\PROGRA~1\COPERN~1\COPERN~1.DLL" ["Copernic Technologies Inc."]

    Print Monitors:
    ---------------

    HKLM\System\CurrentControlSet\Control\Print\Monitors\
    EPSON BiD Monitor1\Driver = "EBPMON.DLL" ["SEIKO EPSON CORPORATION"]

    ----------
    + This report excludes default entries except where indicated.
    + To see *everywhere* the script checks and *everything* it finds,
    launch it from a command prompt or a shortcut with the -all parameter.
    + To search all directories of local fixed drives for DESKTOP.INI
    DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
    use the -supp parameter or answer "No" at the first message box.
    ---------- (total run time: 10 seconds, including 5 seconds for message boxes)

    Bonne interprétation

    Bonne nuit et à demain

    A+
    0
  2. Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
     
    salut

    tu l as supprimé?

    a+
    0
  3. phil39 Messages postés 66 Statut Membre
     
    Salut régis,

    Le fichier est supprimer ,mais dois-je nettoyer la clé de registe IE que je t'ai envoyé et la ligne correspondante dans Win.ini ?

    Merci
    A+
    0
  4. Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
     
    Salut

    Comme je ne veux pas prendre de risque, relance pest petrol et donne moi le rapport.

    a+
    0
  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. phil39 Messages postés 66 Statut Membre
     
    Salut regis,

    Avec un peu de retard voici le log de Pest patrol

    13/08/2006-12:14:39 , Détecté(s) , 123Mania , Adware , Key "hkey_current_user \software\microsoft\windows\currentversion\wintrust\trust providers\software publishing\trust database\0" value "goicfboogidikkejccmclpieicihhlpo mmhkbp" data "futurpago , 0
    13/08/2006-12:15:52 , Détecté(s) , 123Mania , Adware , Key "hkey_current_user \software\matrix_html" , -1
    13/08/2006-12:16:06 , Détecté(s) , 123Mania , Adware , Key "hkey_local_machine \software\microsoft\internet explorer\extensions\{76dd9e77-f06c-4471-ab6c-cf03c5c6b5b0}" value "clsid" data "{1fba04ee-3024-11d2-8f1f-0000f87abd16}" , -1
    13/08/2006-12:16:07 , Détecté(s) , 123Mania , Adware , Key "hkey_local_machine \software\microsoft\internet explorer\extensions\{76dd9e77-f06c-4471-ab6c-cf03c5c6b5b0}" value "default visible" data "yes" , -1
    13/08/2006-12:23:14 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\danish.lng" , 371008318
    13/08/2006-12:23:14 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\czech.lng" , 1713654524
    13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\finnish.lng" , 2039672743
    13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\turkish.lng" , 1766265515
    13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\slovak.lng" , -1712153495
    13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\italiano.lng" , -1740154950
    13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\dutch.lng" , 435198673
    13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\swedish.lng" , 1017818961
    13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\chinese.lng" , -668833289
    13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\magyar.lng" , -2066825464
    13/08/2006-12:23:15 , Détecté(s) , Advanced Archive Password Recovery , Password Cracker , File "C:\Program Files\ARCHPR\slovenian.lng" , -210617504
    13/08/2006-12:23:16 , Détecté(s) , ARCHPR , Password Cracker , File "C:\Program Files\ARCHPR\file_id.diz" , -739333178
    13/08/2006-12:23:16 , Détecté(s) , Remote KeyLogger 1.0.1.0 , Key Logger , File "C:\Program Files\ARCHPR\license.txt" , -816131938
    13/08/2006-12:23:16 , Détecté(s) , ARCHPR , Password Cracker , File "C:\Program Files\ARCHPR\order.frm" , -1550335179
    13/08/2006-12:23:16 , Détecté(s) , ARCHPR , Password Cracker , File "C:\Program Files\ARCHPR\order.txt" , 1968415292
    ***Fin de rapport***

    Merci

    A+
    0
  7. Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
     
    Ok

    tu peux relancer spybot?

    a+
    0
  8. phil39 Messages postés 66 Statut Membre
     
    Salut régis,

    Avec un peu de retard voici le log Spybot

    Matrix: Réglages (Valeur du registre, nothing done)
    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\goicfboogidikkejccmclpieicihhlpo ejfebp

    Matrix: Réglages (Valeur du registre, nothing done)
    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\ppcimdnnnjbeahepfabjipfginloedkg cfcaak

    Matrix: Réglages (Valeur du registre, nothing done)
    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\ppcimdnnnjbeahepfabjipfginloedkg enodaj

    Alexa Related: Lien (Remplacer le fichier, nothing done)
    C:\WINDOWS\Web\RELATED.HTM

    PopUp Notes: Réglages utilisateur (Clé du registre, nothing done)
    HKEY_USERS\.DEFAULT\Software\Winston

    Teknum Updater: Common file (global) (Fichier, nothing done)
    C:\Program Files\Fichiers communs\Teknum Systems\update.exe

    Teknum Updater: Common file (global) (Fichier, nothing done)
    C:\Program Files\Fichiers communs\Teknum Systems\update.dat

    ValueClick: Cookie traceur (Internet Explorer: USER) (Cookie, nothing done)

    Avenue A, Inc.: Cookie traceur (Internet Explorer: USER) (Cookie, nothing done)

    DoubleClick: Cookie traceur (Internet Explorer: USER) (Cookie, nothing done)

    MediaPlex: Cookie traceur (Internet Explorer: USER) (Cookie, nothing done)

    WebTrends live: Cookie traceur (Internet Explorer: USER) (Cookie, nothing done)

    Log: Activity: ModemDet.txt (Sauver le fichier, nothing done)
    C:\WINDOWS\ModemDet.txt

    Log: Shutdown: System\wbem\logs\mofcomp.log (Sauver le fichier, nothing done)
    C:\WINDOWS\System\wbem\logs\mofcomp.log

    Log: Shutdown: System\wbem\logs\wbemcore.log (Sauver le fichier, nothing done)
    C:\WINDOWS\System\wbem\logs\wbemcore.log

    Log: Shutdown: System\wbem\logs\wbemess.log (Sauver le fichier, nothing done)
    C:\WINDOWS\System\wbem\logs\wbemess.log

    Log: Shutdown: System\wbem\logs\winmgmt.log (Sauver le fichier, nothing done)
    C:\WINDOWS\System\wbem\logs\winmgmt.log

    Cookie: Cookie (54) (Cookie, nothing done)

    Cache: Cache (200) (Cache, nothing done)

    --- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

    2006-08-05 unins000.exe (51.41.0.0)
    2005-05-31 blindman.exe (1.0.0.1)
    2005-05-31 SpybotSD.exe (1.4.0.3)
    2005-05-31 TeaTimer.exe (1.4.0.2)
    2005-05-31 Update.exe (1.4.0.0)
    2006-02-06 advcheck.dll (1.0.2.0)
    2005-05-31 aports.dll (2.1.0.0)
    2005-05-31 borlndmm.dll (7.0.4.453)
    2005-05-31 delphimm.dll (7.0.4.453)
    2005-05-31 SDHelper.dll (1.4.0.0)
    2006-02-20 Tools.dll (2.0.0.2)
    2005-05-31 UnzDll.dll (1.73.1.1)
    2005-05-31 ZipDll.dll (1.73.2.0)
    2006-08-04 Includes\Cookies.sbi (*)
    2006-08-04 Includes\Dialer.sbi (*)
    2006-08-04 Includes\Hijackers.sbi (*)
    2006-08-04 Includes\Malware.sbi (*)
    2006-08-04 Includes\Keyloggers.sbi (*)
    2006-08-04 Includes\Revision.sbi (*)
    2006-08-04 Includes\Security.sbi (*)
    2006-08-04 Includes\Spybots.sbi (*)
    2006-08-04 Includes\Trojans.sbi (*)
    2005-02-17 Includes\Tracks.uti
    2006-08-04 Includes\PUPS.sbi (*)

    Merci pour tes recherches

    A+
    0
  9. Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
     
    Ok

    supprimes ce qu il trouve et relance spybot

    a+
    0
  10. phil39 Messages postés 66 Statut Membre
     
    Salut Régis,

    J'ai un doute sur les lignes à supprimer ,je te fait parvenir les log spybot et adaware avec un supplément d'info sur les lignes qui me paraissent bonne car correspondantes à des programmes que j'utilise.

    De plus je te confirme que Bitdefender v9 fait planter asquared sous W98 depuis la version 2 ,un rapport automatique est partie chez les programmeurs.
    De même bitdefender fait planter W98 lors de certaines mise à jour , un rapport automatique est partie chez les programmeurs aussi j'espère un élément de réponse de leur part !.

    Log Spybot

    Matrix: Réglages (Valeur du registre, nothing done)
    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\goicfboogidikkejccmclpieicihhlpo ejfebp

    Matrix: Réglages (Valeur du registre, nothing done)
    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\ppcimdnnnjbeahepfabjipfginloedkg cfcaak

    Matrix: Réglages (Valeur du registre, nothing done)
    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\ppcimdnnnjbeahepfabjipfginloedkg enodaj

    les lignes ci-dessus apartiennent à wintrust mais je ne sais pas ce que c'est.

    Alexa Related: Lien (Remplacer le fichier, nothing done)
    C:\WINDOWS\Web\RELATED.HTM

    PopUp Notes: Réglages utilisateur (Clé du registre, nothing done)
    HKEY_USERS\.DEFAULT\Software\Winston

    Ces deux là appartienne à windows ?

    Teknum Updater: Common file (global) (Fichier, nothing done)
    C:\Program Files\Fichiers communs\Teknum Systems\update.exe

    Teknum Updater: Common file (global) (Fichier, nothing done)
    C:\Program Files\Fichiers communs\Teknum Systems\update.dat

    Voici ce qui se trouve dans un fichier txt du répertoire ci-dessus

    This folder contains files shared by different programs
    installed on your machine.

    CAUTION!
    ========
    If you delete any of files in this folder, your computer
    or one of your programs may no longer work correctly.


    Log adavare
    Examen de la base de registre lancé
    ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

    Windows Objet reconnu!
    Type : Donnée de registre
    Donnée :
    Entrée de registre : HKEY_USERS
    Object : .DEFAULT\Software\Microsoft\MediaPlayer\Player\Settings
    Valeur : Client ID
    Donnée :

    Windows Objet reconnu!
    Type : Donnée de registre
    Donnée :
    Entrée de registre : HKEY_CURRENT_USER
    Object : Software\Microsoft\MediaPlayer\Player\Settings
    Valeur : Client ID
    Donnée :

    Ci dessus deux fichiers media player

    Résultat de l'examen de la base de registre:
    ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
    Nouveaux objets: 2
    Objets trouvés jusqu'ici: 2

    Examen complet de la base de registre lancé
    ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

    Teknum Updater Objet reconnu!
    Type : Valeur de registre
    Donnée : c:\progra~1\fichie~1\teknum~1\update.exe
    Entrée de registre : HKEY_CURRENT_USER
    Object : Software\Microsoft\Windows\CurrentVersion\Run
    Valeur : Update Service

    Résultat de l'examen profond de la base de registre:
    ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
    Nouveaux objets: 1
    Objets trouvés jusqu'ici: 3

    Examen et vérification profonds de fichiers (C:)
    ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

    Teknum Updater Objet reconnu!
    Type : Fichier
    Donnée : tsuninst.exe
    Object : C:\Program Files\Fichiers communs\Teknum Systems\
    FileSize : 24 KB
    FileVersion : 5.5.1.34
    ProductVersion : 1.0
    Copyright : 1997, Teknum Systems AS
    CompanyName : Teknum Systems
    ProductName : Teknum Systems Uninstaller
    Created on : 20/08/2005 08:14:04
    Last accessed : 16/08/2006 22:00:00
    Last modified : 20/08/2005 08:14:06

    Teknum Updater Objet reconnu!
    Type : Fichier
    Donnée : update.exe
    Object : C:\Program Files\Fichiers communs\Teknum Systems\
    FileSize : 19 KB
    FileVersion : 5.5.0.85
    ProductVersion : 1.0.0.0
    Copyright : Teknum Systems AS
    CompanyName : Teknum Systems AS
    Created on : 20/08/2005 08:14:03
    Last accessed : 16/08/2006 22:00:00
    Last modified : 20/08/2005 08:14:04

    Teknum Updater Objet reconnu!
    Type : Fichier
    Donnée : updsvc.exe
    Object : C:\Program Files\Fichiers communs\Teknum Systems\
    FileSize : 91 KB
    FileVersion : 5.5.0.149
    ProductVersion : 5.5
    Copyright : Teknum Systems AS
    CompanyName : Teknum Systems AS
    FileDescription : Shared Update Service
    OriginalFilename : updsvc.exe
    ProductName : Shared Update Service
    Created on : 20/08/2005 08:14:03
    Last accessed : 16/08/2006 22:00:00
    Last modified : 20/08/2005 08:14:04

    Teknum Updater Objet reconnu!
    Type : Fichier
    Donnée : tssetup.exe
    Object : C:\Program Files\Fichiers communs\Teknum Systems\
    FileSize : 230 KB
    FileVersion : 5.5.0.292
    ProductVersion : 1.0.0.0
    Copyright : 1994-2001, Teknum Systems AS
    CompanyName : Teknum Systems
    FileDescription : Shared Windows Setup Engine
    Created on : 20/08/2005 08:14:03
    Last accessed : 16/08/2006 22:00:00
    Last modified : 20/08/2005 08:14:04

    Teknum Updater Objet reconnu!
    Type : Fichier
    Donnée : sendmail.exe
    Object : C:\Program Files\Fichiers communs\Teknum Systems\
    FileSize : 15 KB
    FileVersion : 5.5.0.44
    ProductVersion : 1.0.0.0
    Copyright : Teknum Systems AS
    CompanyName : Teknum Systems AS
    Created on : 20/08/2005 08:14:03
    Last accessed : 16/08/2006 22:00:00
    Last modified : 20/08/2005 08:14:04

    Teknum Updater Objet reconnu!
    Type : Fichier
    Donnée : tshkdrag.dll
    Object : C:\Program Files\Fichiers communs\Teknum Systems\
    FileSize : 9 KB
    FileVersion : 5.0.0.22
    ProductVersion : 1.0.0.0
    Copyright : Teknum Systems AS
    CompanyName : Teknum Systems AS
    Created on : 20/08/2005 08:14:03
    Last accessed : 16/08/2006 22:00:00
    Last modified : 20/08/2005 08:14:04

    Teknum Updater Objet reconnu!
    Type : Fichier
    Donnée : errorlog.exe
    Object : C:\Program Files\Fichiers communs\Teknum Systems\
    FileSize : 34 KB
    FileVersion : 5.5.0.14
    ProductVersion : 1.0.0.0
    Copyright : Teknum Systems AS
    CompanyName : Teknum Systems AS
    Created on : 20/08/2005 08:14:03
    Last accessed : 16/08/2006 22:00:00
    Last modified : 20/08/2005 08:14:04

    Teknum Updater Objet reconnu!
    Type : Dossier
    Object : C:\Program Files\Fichiers communs\Teknum Systems

    tous les fichiers ci-dessus appartiennent au répertoire Teknum que Spybot à trouvé.

    Résultat de l'examen du disque pour C:\
    ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
    Nouveaux objets: 0
    Objets trouvés jusqu'ici: 11

    22:11:40 Examen effectué

    Résumé de cet examen
    ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
    Durée totale de l'examen:00:18:38:10
    Objets examinés:72393
    Objets identifiés:11
    Objets ignorés:0
    Nouveaux objets:11

    Que dois-je faire avec ces fichiers détectés ?

    merci pour ton aide

    A+
    0
  11. Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
     
    Salut

    Supprime tout ce qu il trouve

    a+
    0
  12. phil39 Messages postés 66 Statut Membre
     
    Salt regis59 ,

    Je me pose une question concernant Hijacthis.

    Loosque une sélection est faite sur les lignes qu'il trouve et que l'on clic sur Fix it , que fais il exactement ?

    Est ce qu'il supprime une entrée de la base de registre ou un programme .

    Ou tous simplement l'empèche de démarrer.

    Merci pour ton aide.

    A+
    0
  13. Regis59 Messages postés 21143 Date d'inscription   Statut Contributeur sécurité Dernière intervention   1 349
     
    asd?
    0
Précédent
  • 1
  • 2