Virus lenteur

SF -
^^Marie^^ Messages postés 41884 Date d'inscription Statut Membre Dernière intervention - 15 nov. 2006 à 08:43

bonjour
j'ai un ordi sous XP pro qui était en réseau avec un portable sous XP. Le portable a commencé a aller mal: lenteur sur Explorer et même pour ouvrir de simples applications. Sous explorer, parfois à la place d'une page demandée qu'il ne trouve pas, il met une page de cul avec en haut un cours message qui dit que l'adresse que j'ai tapée est mal écrite ou n'existe pas. Maintenant ces symptomes commencent sur mon PC aussi. Le portable lui est d'une extreme lenteur, on ne peut quasiment plus aller sur internet, et parfois même il reste bloqué au démarrage (bureau, mais on ne peut rien faire). Aïe, Aïe... Est-ce que quelqu'un peut m'aider s'il vous plait??
Amandine

Afficher la suite

38 réponses

Résumé de la discussion

Problème rencontré sous Windows XP sur deux postes en réseau : des ralentissements et des redirections lors de la navigation, avec des messages indiquant une adresse mal écrite ou inexistante, liés à un malware. Plusieurs outils de détection et de nettoyage ont été évoqués: Silent Runner et Fixwareout pour analyser les éléments de démarrage et le registre, ainsi que HijackThis pour identifier les entrées suspectes. Des discussions portent aussi sur la sécurité et le remplacement de Norton, avec la suggestion d'évaluer Avast et ZoneAlarm comme alternatives, selon l'état des rapports et des analyses de l'infection. En pratique, l'interprétation des rapports dépend du contexte et des chemins d'infection; certains éléments peuvent être légitimes et demandent vérification croisée avec les éditeurs logiciels.

Réponse 1 / 38
^^Marie^^ Messages postés 41884 Date d'inscription Statut Membre Dernière intervention 3 280

Salut

Commençons par la case départ ::

Va sur le lien, suis la procédure et colle les rapports ici :

virus methode preliminaire de desinfection version fr

A++
0
1. sf
  
  bon, et voilà pour le portable:
  
  EWIDO:
  ---------------------------------------------------------
  ewido anti-spyware - Scan Report
  ---------------------------------------------------------
  
  + Created at: 17:46:51 08/10/2006
  
  + Scan result:
  
  C:\Program Files\HQ Codec -> Adware.Generic : Cleaned.
  [1256] VM_003E0000 -> Downloader.Agent.uj : Error during cleaning.
  [1732] VM_003A0000 -> Downloader.Agent.uj : Error during cleaning.
  [1940] VM_008C0000 -> Downloader.Agent.uj : Error during cleaning.
  [2256] VM_003C0000 -> Downloader.Agent.uj : Error during cleaning.
  [2472] VM_003B0000 -> Downloader.Agent.uj : Error during cleaning.
  [2484] VM_00930000 -> Downloader.Agent.uj : Error during cleaning.
  [2616] VM_00860000 -> Downloader.Agent.uj : Error during cleaning.
  [2632] VM_01CA0000 -> Downloader.Agent.uj : Error during cleaning.
  [2660] VM_008A0000 -> Downloader.Agent.uj : Error during cleaning.
  [2728] VM_008A0000 -> Downloader.Agent.uj : Error during cleaning.
  [2756] VM_00390000 -> Downloader.Agent.uj : Error during cleaning.
  [2832] VM_008D0000 -> Downloader.Agent.uj : Error during cleaning.
  [2928] VM_00880000 -> Downloader.Agent.uj : Error during cleaning.
  [2968] VM_009D0000 -> Downloader.Agent.uj : Error during cleaning.
  [3304] VM_009B0000 -> Downloader.Agent.uj : Error during cleaning.
  [3340] VM_003A0000 -> Downloader.Agent.uj : Error during cleaning.
  [3420] VM_003B0000 -> Downloader.Agent.uj : Error during cleaning.
  [636] VM_00930000 -> Downloader.Agent.uj : Error during cleaning.
  [876] VM_00D60000 -> Downloader.Agent.uj : Error during cleaning.
  [908] VM_00EF0000 -> Downloader.Agent.uj : Error during cleaning.
  [944] VM_003B0000 -> Downloader.Agent.uj : Error during cleaning.
  C:\Documents and Settings\auchan\Cookies\auchan@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@cz3.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@cz4.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@cz6.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@com[1].txt -> TrackingCookie.Com : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@c.goclick[2].txt -> TrackingCookie.Goclick : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@data2.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@ad.text.tbn[2].txt -> TrackingCookie.Texttbnru : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@free.wegcash[2].txt -> TrackingCookie.Wegcash : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@yadro[2].txt -> TrackingCookie.Yadro : Cleaned.
  C:\Documents and Settings\auchan\Cookies\auchan@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
  
  ::Report end
  
  le scan en ligne:
  
  BitDefender Online Scanner
  Scan report generated at: Sun, Oct 08, 2006 - 18:42:01
  Scan path: C:\;D:\;E:\;
  
  Statistics
  
  Time
  00:50:55
  
  Files
  271563
  
  Folders
  4018
  
  Boot Sectors
  4
  
  Archives
  7829
  
  Packed Files
  23968
  
  Results
  
  Identified Viruses
  1
  
  Infected Files
  19
  
  Suspect Files
  0
  
  Warnings
  0
  
  Disinfected
  0
  
  Deleted Files
  19
  
  Engines Info
  
  Virus Definitions
  474418
  
  Engine build
  AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)
  
  Scan plugins
  13
  
  Archive plugins
  38
  
  Unpack plugins
  6
  
  E-mail plugins
  6
  
  System plugins
  1
  
  Scan Settings
  
  First Action
  Disinfect
  
  Second Action
  Delete
  
  Heuristics
  Yes
  
  Enable Warnings
  Yes
  
  Scanned Extensions
  *;
  
  Exclude Extensions
  
  Scan Emails
  Yes
  
  Scan Archives
  Yes
  
  Scan Packed
  Yes
  
  Scan Files
  Yes
  
  Scan Boot
  Yes
  
  Scanned File
  Status
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP23\A0006414.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP23\A0006414.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP23\A0006414.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP24\A0006438.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP24\A0006438.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP24\A0006438.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006467.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006467.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006467.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006490.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006490.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006490.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP26\A0006518.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP26\A0006518.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP26\A0006518.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP27\A0006562.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP27\A0006562.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP27\A0006562.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP28\A0006583.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP28\A0006583.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP28\A0006583.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP30\A0006653.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP30\A0006653.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP30\A0006653.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP31\A0006686.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP31\A0006686.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP31\A0006686.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006789.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006789.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006789.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006811.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006811.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006811.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006830.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006830.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006830.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP35\A0006870.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP35\A0006870.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP35\A0006870.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP36\A0007262.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP36\A0007262.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP36\A0007262.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007281.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007281.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007281.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007309.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007309.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007309.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007326.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007326.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007326.exe
  Deleted
  
  C:\WINDOWS\system32\dmrss.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\WINDOWS\system32\dmrss.exe
  Disinfection failed
  
  C:\WINDOWS\system32\dmrss.exe
  Deleted
  
  C:\WINDOWS\system32\dmsls.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\WINDOWS\system32\dmsls.exe
  Disinfection failed
  
  C:\WINDOWS\system32\dmsls.exe
  Deleted
  
  Et enfin le hijackthis:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 18:51:29, on 08/10/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
  C:\Program Files\HP\QuickPlay\QPService.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\Program Files\HP\TVPlay\TVPService.exe
  C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
  C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Skype\Phone\Skype.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
  C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\ewido anti-spyware 4.0\guard.exe
  C:\Program Files\ewido anti-spyware 4.0\ewido.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\notepad.exe
  C:\DOCUME~1\auchan\LOCALS~1\Temp\Répertoire temporaire 2 pour hijackthis.zip\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www8.hp.com/fr/fr/home.html
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
  O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
  O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  O4 - HKLM\..\Run: [TVPService] "C:\Program Files\HP\TVPlay\TVPService.exe"
  O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
  O4 - HKLM\..\Run: [RoxAssistant] C:\Program Files\Common Files\Roxio Shared\Upgrade\RoxAssist.exe /s
  O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
  O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
  O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{194D9444-2726-4B3E-AD66-8E635B046872}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CCS\Services\Tcpip\..\{B61A98A5-9117-4D86-84E1-62735542A402}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CCS\Services\Tcpip\..\{BEEC8F8B-3DD3-451D-B13E-A9D5525C2B3C}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CCS\Services\Tcpip\..\{CA10988F-94C8-4D8B-9826-CBD5F28B487F}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.92
  O17 - HKLM\System\CS1\Services\Tcpip\..\{194D9444-2726-4B3E-AD66-8E635B046872}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.92
  O17 - HKLM\System\CS2\Services\Tcpip\..\{194D9444-2726-4B3E-AD66-8E635B046872}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.92
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
  O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: Service Norton Protection Center (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  
  Bon, ben ça fait pas mal de trucs... Est-ce que c'est grave docteur??
  Merci encore (je me sens vraiment soulagée depuis que tu m'as répondu...)
  a+
  Amandine
  
  0
Réponse 2 / 38
SF

MERCI!! de m'avoir répondu aussi vite!
Alors voilà pour le PC:

EWIDO:
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 16:15:27 08/10/2006

+ Scan result:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\HTASSstp -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\WTLBAstp -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
C:\Documents and Settings\amandine\Cookies\amandine@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.186:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.238:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@microsofteup.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@sfr.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.284:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.285:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@rotator.adjuggler[2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@ads18.bpath[1].txt -> TrackingCookie.Bpath : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@ads23.bpath[1].txt -> TrackingCookie.Bpath : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@cz3.clickzs[1].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@cz4.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@cz6.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@cz7.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@cz8.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@c.enhance[1].txt -> TrackingCookie.Enhance : Cleaned.
:mozilla.36:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Estat : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@c.goclick[2].txt -> TrackingCookie.Goclick : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@komtrack[2].txt -> TrackingCookie.Komtrack : Cleaned.
:mozilla.292:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@sales.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.109:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@data1.perf.overture[2].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@data4.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@ads.planetactive[1].txt -> TrackingCookie.Planetactive : Cleaned.
:mozilla.264:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.300:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.301:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.302:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.303:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.304:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.54:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.55:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.56:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.57:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.58:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.59:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.389:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.390:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.507:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.508:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.509:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.510:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.511:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Web-stat : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@web-stat[2].txt -> TrackingCookie.Web-stat : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@webstat[3].txt -> TrackingCookie.Web-stat : Cleaned.
:mozilla.502:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
:mozilla.503:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
:mozilla.504:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@weborama[1].txt -> TrackingCookie.Weborama : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@free.wegcash[1].txt -> TrackingCookie.Wegcash : Cleaned.
:mozilla.947:C:\Documents and Settings\amandine\Application Data\Mozilla\Firefox\Profiles\iflo2eb0.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
C:\Documents and Settings\amandine\Cookies\amandine@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
D:\programmes\commonVB\Tools\DEPENDS.EXE -> Worm.VB.ao : Cleaned with backup (quarantined).

::Report end

puis le Scan en ligne:Scan Info
Scanned Files
375992

Infected Files
0

Virus Detected
No virus found.

et enfin le hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 17:52:10, on 08/10/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\PreSonus\1394AudioDriver_FIREBox\FIREBOX Control.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
D:\programmes\creative zen microphoto\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
D:\programmes\adobe\Photoshop CS\Photoshop.exe
C:\Program Files\Scribus 1.3.3.3\Scribus.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\notepad.exe
D:\téléchargements internet\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe
O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [FIREBOX] C:\Program Files\PreSonus\1394AudioDriver_FIREBox\FIREBOX Control.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Creative Detector] "D:\programmes\creative zen microphoto\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - D:\programmes\WinHTTrack\WinHTTrackIEBar.dll (file missing)
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - D:\programmes\WinHTTrack\WinHTTrackIEBar.dll (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt4_x.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/278ac79543f901417918/netzip/RdxIE601_fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - a1540.g.akamai.net
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A9BA9DC-1A83-43F3-BF2D-D66CA71FD86D}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{695FA71A-7F6E-4FBB-9183-7C22CCC1632D}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{859AA0D9-CA2E-4C89-A2DC-565A10417551}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{9EE0F008-0935-45C1-BFFD-BEBEECDA9EB6}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{A84BE591-D149-48E7-B964-C400CF56C0E5}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{DCA47F2A-65FB-4306-956F-046F169DEFB6}: NameServer = 85.255.114.87,85.255.112.19
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Par magie, le portable fonctionne un peu aujourd'hui, et j'ai lancé tout ça là bas aussi. Je rapporte ça dès que je peux.
Merci mille fois!!

AMandine
0
Réponse 3 / 38
^^Marie^^ Messages postés 41884 Date d'inscription Statut Membre Dernière intervention 3 280

Salut,

Pour ton portable, d'abord lui ensuite le pc....sinon on va se mélanger les pinceaux

télécharges smitfraudfix :

En image :
http://siri.urz.free.fr/Fix/SmitfraudFix.php

tu le décompresses tu doubles cliques sur smitfraudfix.cmd et tu choisi l option 1
cela vas générer un rapport.
Si tu vois des lignes avec PRESENT! Continue la manip qui suit.

Redémarres le PC en mode sans échec : tu tapotes sur la touche F8 de ton clavier (ou F5 ) et tu choisis le mode sans échec)

- Ouvre le dossier "SmitfraudFix" et double clic sur "Smitfraudfix.cmd", choisit l’option 2 et tu réponds oui à tout.

Copie/colle le rapport sur le forum stp.

A+
0
1. sf
  
  salut,
  j'ai fait smitfraudfix sur le portable, et il n'y a pas de lignes avec "PRESENT!" (enfin je ne crois pas...) voilà le rapport:
  SmitFraudFix v2.107
  
  Rapport fait à 20:24:29,93, 10/10/2006
  Executé à partir de C:\Documents and Settings\auchan\Mes documents\SmitfraudFix\SmitfraudFix
  OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
  Fix executé en mode normal
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\auchan
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\auchan\Application Data
  
  »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\auchan\Favoris
  
  »»»»»»»»»»»»»»»»»»»»»»»» Bureau
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
  
  »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
  
  »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
  "Source"="http://image.radio-france.fr/chaines/france-culture/img/tmpl/tmpl_logo.gif"
  "SubscribedURL"="http://image.radio-france.fr/chaines/france-culture/img/tmpl/tmpl_logo.gif"
  "FriendlyName"=""
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
  "Source"="About:Home"
  "SubscribedURL"="About:Home"
  "FriendlyName"="Ma page d'accueil"
  
  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  "AppInit_DLLs"=""
  
  »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32
  
  »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» Fin
  
  bon... Qu'est-ce que tu en penses?
  merci encore
  a+
  Amandine
  
  0
Réponse 4 / 38
^^Marie^^ Messages postés 41884 Date d'inscription Statut Membre Dernière intervention 3 280

Ok,

Refais moi un Hitjackthis de ton PORTABLE
Et Bitdefender aussi

Merci
0
1. sf
  
  bon alors voilà pour le portable toujours:
  
  BitDefender Online Scanner
  
  Scan report generated at: Tue, Oct 10, 2006 - 21:33:54
  
  Scan path: C:\;D:\;E:\;
  
  Statistics
  
  Time
  00:46:32
  
  Files
  274749
  
  Folders
  4032
  
  Boot Sectors
  4
  
  Archives
  7847
  
  Packed Files
  24231
  
  Results
  
  Identified Viruses
  2
  
  Infected Files
  28
  
  Suspect Files
  0
  
  Warnings
  0
  
  Disinfected
  0
  
  Deleted Files
  28
  
  Engines Info
  
  Virus Definitions
  473951
  
  Engine build
  AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)
  
  Scan plugins
  13
  
  Archive plugins
  38
  
  Unpack plugins
  6
  
  E-mail plugins
  6
  
  System plugins
  1
  
  Scan Settings
  
  First Action
  Disinfect
  
  Second Action
  Delete
  
  Heuristics
  Yes
  
  Enable Warnings
  Yes
  
  Scanned Extensions
  *;
  
  Exclude Extensions
  
  Scan Emails
  Yes
  
  Scan Archives
  Yes
  
  Scan Packed
  Yes
  
  Scan Files
  Yes
  
  Scan Boot
  Yes
  
  Scanned File
  Status
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP23\A0006385.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP23\A0006385.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP23\A0006385.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP24\A0006427.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP24\A0006427.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP24\A0006427.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006456.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006456.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006456.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006479.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006479.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP25\A0006479.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP26\A0006507.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP26\A0006507.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP26\A0006507.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP27\A0006551.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP27\A0006551.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP27\A0006551.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP28\A0006570.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP28\A0006570.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP28\A0006570.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP29\A0006603.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP29\A0006603.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP29\A0006603.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP30\A0006643.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP30\A0006643.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP30\A0006643.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP31\A0006675.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP31\A0006675.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP31\A0006675.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP32\A0006746.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP32\A0006746.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP32\A0006746.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP32\A0006756.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP32\A0006756.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP32\A0006756.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006767.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006767.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006767.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006773.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006773.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006773.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006779.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006779.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006779.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006800.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006800.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006800.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006819.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006819.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP34\A0006819.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP35\A0006859.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP35\A0006859.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP35\A0006859.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP36\A0007249.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP36\A0007249.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP36\A0007249.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007271.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007271.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007271.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007291.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007291.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007291.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007299.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007299.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007299.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007315.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007315.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP37\A0007315.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP39\A0007467.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP39\A0007467.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP39\A0007467.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP39\A0007468.exe
  Infected with: MemScan:Trojan.Agent.QB
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP39\A0007468.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP39\A0007468.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP39\A0007484.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP39\A0007484.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP39\A0007484.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP40\A0007517.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP40\A0007517.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP40\A0007517.exe
  Deleted
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP40\A0007531.exe
  Infected with: MemScan:Trojan.Downloader.Mohbpork.A
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP40\A0007531.exe
  Disinfection failed
  
  C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP40\A0007531.exe
  Deleted
  
  Et puis pour hijackthis:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 00:19:12, on 11/10/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  C:\Program Files\ewido anti-spyware 4.0\guard.exe
  C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
  C:\Program Files\HP\QuickPlay\QPService.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\Program Files\HP\TVPlay\TVPService.exe
  C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
  C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Skype\Phone\Skype.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  C:\WINDOWS\System32\alg.exe
  C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\NOTEPAD.EXE
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\DOCUME~1\auchan\LOCALS~1\Temp\Répertoire temporaire 4 pour hijackthis.zip\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www8.hp.com/fr/fr/home.html
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
  O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
  O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  O4 - HKLM\..\Run: [TVPService] "C:\Program Files\HP\TVPlay\TVPService.exe"
  O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
  O4 - HKLM\..\Run: [RoxAssistant] C:\Program Files\Common Files\Roxio Shared\Upgrade\RoxAssist.exe /s
  O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
  O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{194D9444-2726-4B3E-AD66-8E635B046872}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CCS\Services\Tcpip\..\{B61A98A5-9117-4D86-84E1-62735542A402}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CCS\Services\Tcpip\..\{BEEC8F8B-3DD3-451D-B13E-A9D5525C2B3C}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CCS\Services\Tcpip\..\{CA10988F-94C8-4D8B-9826-CBD5F28B487F}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.92
  O17 - HKLM\System\CS1\Services\Tcpip\..\{194D9444-2726-4B3E-AD66-8E635B046872}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.92
  O17 - HKLM\System\CS2\Services\Tcpip\..\{194D9444-2726-4B3E-AD66-8E635B046872}: NameServer = 85.255.116.162,85.255.112.92
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.92
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
  O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: Service Norton Protection Center (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  
  Alors??
  merci!!
  a+
  
  0
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Réponse 5 / 38
^^Marie^^ Messages postés 41884 Date d'inscription Statut Membre Dernière intervention 3 280

Bonjour,

Fait ce qui suit, y'a encore des lignes, je vais demander des informations

Méthode à suivre dans l'ordre...
----------------------------------------------------------------------------
Télécharger ces logiciels (sauf si tu les as)
A utiliser plus tard

A - ad-aware version 1.06
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/adwseflash.zip

B - spybot version 1.4
(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo d utilisation
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

C - Ccleaner : ( nettoyeur de registre, cookies+temps+tempos+prefetch+historique+etc..)
Télécharge ici :
https://www.ccleaner.com/ccleaner/download
Tutorial ici:
https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

D - Ewido
https://www.malekal.com/tutorial-et-guide-ewido-v4/
----------------------------------------------------------------------------
¤Affiche tous les fichiers et dossiers :
Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage

Coche « afficher les fichiers et dossiers cachés »

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

Décoche « masquer les extensions dont le type est connu »
Puis fais «Ok» pour valider les changements.

Et appliquer !
=================================
Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"

O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [TVPService] "C:\Program Files\HP\TVPlay\TVPService.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{194D9444-2726-4B3E-AD66-8E635B046872}: NameServer = 85.255.116.162,85.255.112.92
O17 - HKLM\System\CCS\Services\Tcpip\..\{B61A98A5-9117-4D86-84E1-62735542A402}: NameServer = 85.255.116.162,85.255.112.92
O17 - HKLM\System\CCS\Services\Tcpip\..\{BEEC8F8B-3DD3-451D-B13E-A9D5525C2B3C}: NameServer = 85.255.116.162,85.255.112.92
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA10988F-94C8-4D8B-9826-CBD5F28B487F}: NameServer = 85.255.116.162,85.255.112.92
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.92
O17 - HKLM\System\CS1\Services\Tcpip\..\{194D9444-2726-4B3E-AD66-8E635B046872}: NameServer = 85.255.116.162,85.255.112.92
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.162 85.255.112.92
O17 - HKLM\System\CS2\Services\Tcpip\..\{194D9444-2726-4B3E-AD66-8E635B046872}: NameServer = 85.255.116.162,85.255.112.92
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.162

Télécharge ceci pour récupérer ta connexion : au cas où ::

http://babin.nelly.free.fr/WinsockFix.zip

============ ============================
¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
¤Vide tes fichiers temps et temporary internet file:

Maintenant tu lances
A/ Ad-Aware supprime quarantaine
B/ Spybot Supprime quarantaine
C/ Ccleaner Ewido Copier/coller le rapport
D/
----------------------------------------------------------------------------
¤ Vide ta Corbeille.
----------------------------------------------------------------------------
¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.

Tiens nous au courant

A+
0
1. sf
  
  salut
  
  j'ai fait mes devoirs du soir, et voilà les résultats:
  Ewido:
  
  ---------------------------------------------------------
  ewido anti-spyware - Scan Report
  ---------------------------------------------------------
  
  + Created at: 23:13:18 11/10/2006
  
  + Scan result:
  
  [204] VM_00D60000 -> Downloader.Agent.uj : Error during cleaning.
  [228] VM_00BF0000 -> Downloader.Agent.uj : Error during cleaning.
  [864] VM_009D0000 -> Downloader.Agent.uj : Error during cleaning.
  
  ::Report end
  
  et Hijackthis:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 23:17:06, on 11/10/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  C:\Program Files\ewido anti-spyware 4.0\guard.exe
  C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\DOCUME~1\auchan\LOCALS~1\Temp\Répertoire temporaire 1 pour hijackthis.zip\HijackThis.exe
  C:\WINDOWS\system32\wuauclt.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www8.hp.com/fr/fr/home.html
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
  O4 - HKLM\..\Run: [RoxAssistant] C:\Program Files\Common Files\Roxio Shared\Upgrade\RoxAssist.exe /s
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
  O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: Service Norton Protection Center (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  
  merci
  a+
  
  0
2. afideg Messages postés 10466 Date d'inscription Statut Contributeur sécurité Dernière intervention 602
  
  up
  ;)
  
  0
Réponse 6 / 38
Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 349

salut

Telecharge ceci
https://www.silentrunners.org/Silent%20Runners.vbs
Execute le,atends quelques minutes, il va creer ensuite un dossier juste a coté de silent runner sous format texte, copie/colle ce qu il te donnera

A+
0
1. sf
  
  salut!
  
  alors voilà le résultat:
  
  "Silent Runners.vbs", revision 49, https://www.silentrunners.org/
  Operating System: Windows XP SP2
  Output limited to non-default values, except where indicated by "{++}"
  
  Startup items buried in registry:
  ---------------------------------
  
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
  "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
  "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
  "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe" ["Google Inc."]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
  "ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]
  "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
  "HP Software Update" = "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."]
  "SynTPEnh" = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."]
  "ccApp" = ""c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
  "eabconfg.cpl" = "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start" ["Hewlett-Packard "]
  "RecGuard" = "C:\Windows\SMINST\RecGuard.exe" [empty string]
  "hpWirelessAssistant" = "C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" ["Hewlett-Packard Development Company, L.P."]
  "RoxioEngineUtility" = ""C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"" ["Roxio"]
  "RoxAssistant" = "C:\Program Files\Common Files\Roxio Shared\Upgrade\RoxAssist.exe /s" [file not found]
  "dmpfd.exe" = "C:\WINDOWS\system32\dmpfd.exe" [file not found]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
  {02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Yahoo! Toolbar Helper"
  \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "AcroIEHlprObj Class"
  \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
  {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
  \InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
  \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
  {A8F38D8D-E480-4D52-B7A2-731BB6995FDD}\(Default) = "NAV Helper"
  -> {HKLM...CLSID} = "CNavExtBho Class"
  \InProcServer32\(Default) = "c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
  {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Google Toolbar Helper"
  \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
  "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
  -> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"
  \InProcServer32\(Default) = "deskpan.dll" [file not found]
  "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
  \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
  "{2F603045-309F-11CF-9774-0020AFD0CFF6}" = "Synaptics Control Panel"
  -> {HKLM...CLSID} = (no title provided)
  \InProcServer32\(Default) = "C:\Program Files\Synaptics\SynTP\SynTPCpl.dll" ["Synaptics, Inc."]
  "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
  -> {HKLM...CLSID} = "Portable Media Devices Menu"
  \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
  "{7F67036B-66F1-411A-AD85-759FB9C5B0DB}" = "ShellViewRTF"
  -> {HKLM...CLSID} = "ShellViewRTF"
  \InProcServer32\(Default) = "C:\WINDOWS\system32\ShellvRTF.dll" ["XSS"]
  "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Outlook File Icon Extension"
  \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
  "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {HKLM...CLSID} = (no title provided)
  \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
  "{5464D816-CF16-4784-B9F3-75C0DB52B499}" = "Yahoo! Mail"
  -> {HKLM...CLSID} = "YMailShellExt Class"
  \InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
  "{5E44E225-A408-11CF-B581-008029601108}" = "Roxio DragToDisc Shell Extension"
  -> {HKLM...CLSID} = "Roxio DragToDisc Shell Extension"
  \InProcServer32\(Default) = "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll" ["Roxio"]
  "{A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC}" = "My Media"
  -> {HKLM...CLSID} = "Multimédia"
  \InProcServer32\(Default) = "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll" ["Roxio, Inc."]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
  <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
  -> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
  \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]
  
  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
  <<!>> "System" = "csvvj.exe" [null data]
  
  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
  <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
  
  HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
  ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
  \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
  Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}"
  -> {HKLM...CLSID} = "IEContextMenu Class"
  \InProcServer32\(Default) = "c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
  Yahoo! Mail\(Default) = "{5464D816-CF16-4784-B9F3-75C0DB52B499}"
  -> {HKLM...CLSID} = "YMailShellExt Class"
  \InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
  
  HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
  ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
  \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
  
  HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
  Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}"
  -> {HKLM...CLSID} = "IEContextMenu Class"
  \InProcServer32\(Default) = "c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
  
  Group Policies {policy setting}:
  --------------------------------
  
  Note: detected settings may not have any effect.
  
  HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\
  
  "DisableRegistryTools" = (REG_DWORD) hex:0x00000000
  {Prevent access to registry editing tools}
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\
  
  "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
  {Shutdown: Allow system to be shut down without having to log on}
  
  "undockwithoutlogon" = (REG_DWORD) hex:0x00000001
  {Devices: Allow undock without having to log on}
  
  Active Desktop and Wallpaper:
  -----------------------------
  
  Active Desktop may be disabled at this entry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
  
  Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
  HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
  "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"
  
  Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
  HKCU\Control Panel\Desktop\
  "Wallpaper" = "C:\Documents and Settings\auchan\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"
  
  Enabled Screen Saver:
  ---------------------
  
  HKCU\Control Panel\Desktop\
  "SCRNSAVE.EXE" = "C:\WINDOWS\system32\ssmypics.scr" [MS]
  
  Startup items in "auchan" & "All Users" startup folders:
  --------------------------------------------------------
  
  C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
  "Démarrage rapide de HP Photosmart Premier" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -s" [null data]
  "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
  
  Enabled Scheduled Tasks:
  ------------------------
  
  "HPpromotions journeysoftware" -> launches: "C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe /N "journeysoftware" -r" ["hp"]
  "Norton AntiVirus - Effectuer une analyse complète du système - auchan" -> launches: "c:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe /TASK:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]
  
  Winsock2 Service Provider DLLs:
  -------------------------------
  
  Namespace Service Providers
  
  HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
  000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
  000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
  000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
  
  Transport Service Providers
  
  HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
  0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
  %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
  %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
  
  Toolbars, Explorer Bars, Extensions:
  ------------------------------------
  
  Toolbars
  
  HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
  "{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
  -> {HKLM...CLSID} = "&Google"
  \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
  
  HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
  "{C4069E3A-68F1-403E-B40E-20066696354B}"
  -> {HKLM...CLSID} = "Norton AntiVirus"
  \InProcServer32\(Default) = "c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
  "{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
  -> {HKLM...CLSID} = "&Google"
  \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
  "{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
  -> {HKLM...CLSID} = "Yahoo! Toolbar"
  \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
  
  HKLM\Software\Microsoft\Internet Explorer\Toolbar\
  "{C4069E3A-68F1-403E-B40E-20066696354B}" = "Norton AntiVirus"
  -> {HKLM...CLSID} = "Norton AntiVirus"
  \InProcServer32\(Default) = "c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
  "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
  -> {HKLM...CLSID} = "Yahoo! Toolbar"
  \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
  "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
  -> {HKLM...CLSID} = "&Google"
  \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
  
  Explorer Bars
  
  HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\
  {4528BBE0-4E08-11D5-AD55-00010333D0AD}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "&Yahoo! Messenger"
  \InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll" ["Yahoo! Inc."]
  
  HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
  {4528BBE0-4E08-11D5-AD55-00010333D0AD}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "&Yahoo! Messenger"
  \InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll" ["Yahoo! Inc."]
  
  Extensions (Tools menu items, main toolbar menu buttons)
  
  HKLM\Software\Microsoft\Internet Explorer\Extensions\
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
  "MenuText" = "Console Java (Sun)"
  "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
  -> {HKCU...CLSID} = "Java Plug-in"
  \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
  -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
  \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]
  
  {4528BBE0-4E08-11D5-AD55-00010333D0AD}\
  "ButtonText" = "Messenger"
  "MenuText" = "Yahoo! Messenger"
  "CLSIDExtension" = "{4C171D40-8277-11D5-AD55-00010333D0AD}"
  -> {HKLM...CLSID} = (no title provided)
  \InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll" ["Yahoo! Inc."]
  
  {85D1F590-48F4-11D9-9669-0800200C9A66}\
  "MenuText" = "Uninstall BitDefender Online Scanner v8"
  "Exec" = "%windir%\bdoscandel.exe" [null data]
  
  {FB5F1910-F110-11D2-BB9E-00C04F795683}\
  "ButtonText" = "Messenger"
  "MenuText" = "Windows Messenger"
  "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
  
  Miscellaneous IE Hijack Points
  ------------------------------
  
  C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
  
  Added lines (compared with English-language version):
  [Strings]: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
  [Strings]: SAFESITE_VALUE="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2fintl%2ffr%2f%3f"
  
  Missing lines (compared with English-language version):
  [Strings]: 2 lines
  
  HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
  <<H>> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = "*Z" (unwritable string)
  -> {HKLM...CLSID} = "Yahoo! Toolbar"
  \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
  
  Running Services (Display Name, Service Name, Path {Service DLL}):
  ------------------------------------------------------------------
  
  Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
  CyberLink Background Capture Service (CBCS HP TVPlay), TVPCapSvc, ""C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe"" [empty string]
  CyberLink Media Library Service(HP TVPlay), CyberLink Media Library Service(HP TVPlay), ""C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe"" ["Cyberlink"]
  CyberLink Task Scheduler (CTS HP TVPlay), TVPSched, ""C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe"" [empty string]
  ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
  hpqwmiex, hpqwmiex, "C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe" ["Hewlett-Packard Development Company, L.P."]
  HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]}
  LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
  Planificateur LiveUpdate automatique, Planificateur LiveUpdate automatique, ""C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"" ["Symantec Corporation"]
  Pml Driver HPZ12, Pml Driver HPZ12, "C:\WINDOWS\system32\HPZipm12.exe" ["HP"]
  Service Norton AntiVirus Auto-Protect, navapsvc, ""c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]
  Service Norton Protection Center, NSCService, "C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE" ["Symantec Corporation"]
  Symantec Core LC, Symantec Core LC, ""C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe"" ["Symantec Corporation"]
  Symantec Event Manager, ccEvtMgr, ""c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
  Symantec Network Drivers Service, SNDSrvc, ""c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"]
  Symantec Network Proxy, ccProxy, ""c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"]
  Symantec Settings Manager, ccSetMgr, ""c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
  Symantec SPBBCSvc, SPBBCSvc, ""c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe"" ["Symantec Corporation"]
  Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
  
  Print Monitors:
  ---------------
  
  HKLM\System\CurrentControlSet\Control\Print\Monitors\
  hpzlnt12\Driver = "hpzlnt12.dll" ["HP"]
  
  ----------
  <<!>>: Suspicious data at a malware launch point.
  <<H>>: Suspicious data at a browser hijack point.
  
  + This report excludes default entries except where indicated.
  + To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
  + To search all directories of local fixed drives for DESKTOP.INI
  DLL launch points, use the -supp parameter or answer "No" at the
  first message box and "Yes" at the second message box.
  ---------- (total run time: 47 seconds, including 18 seconds for message boxes)
  
  Alors, c'est grave? ;) merci...
  a+
  
  0
Réponse 7 / 38
Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 349

Salut

Grave, non pas forcement....

On va tester un truc, sinon on le supprimera manuellement.

Télécharge le FixWareout d'un de ces deux sites sur le bureau:
http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe

Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal.

Quand ton système aura redémarré, suis les invites des messages.

Au final, poste le contenu de C:\fixwareout\report.txt avec un nouveau rapport HijackThis.

A+
0
1. sf
  
  salut!
  voilà ce que ça donne:
  
  Fixwareout ver 1.003
  Last edited 8/11/2006
  Post this report in the forums please
  
  Reg Entries that were deleted
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}80B0D5C6018B-BD6B-DE24-DBD8-827FC662{
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}29852FAA0681-7399-CD94-D998-E67D8C15{
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DD8A25EBE198-404A-5AC4-ABF4-CB8340B6{
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5949DBD4227E-F9BA-1914-430B-BCDC09D9{
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\dfpmd
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\1trap
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\2trap
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\0mdm
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\1mdm
  ...
  
  Microsoft (R) Windows Script Host Version 5.6
  Random Runs removed from HKLM
  "dmpfd.exe"=-
  ...
  
  PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
  
  »»»»» Searching by size/names...
  
  »»»»»
  Search five digit cs, dm and jb files.
  This WILL/CAN also list Legit Files, Submit them at Virustotal
  C:\WINDOWS\SYSTEM32\CSHGK.EXE 51 774 2006-09-19
  
  Other suspects.
  Directory of C:\WINDOWS\system32
  
  »»»»» Misc files.
  
  »»»»» Checking for older varients covered by the Rem3 tool.
  
  et pour le hijackthis:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 11:37:04, on 14/10/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  C:\Program Files\ewido anti-spyware 4.0\guard.exe
  C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\DOCUME~1\auchan\LOCALS~1\Temp\Répertoire temporaire 2 pour hijackthis.zip\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www8.hp.com/fr/fr/home.html
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
  O4 - HKLM\..\Run: [RoxAssistant] C:\Program Files\Common Files\Roxio Shared\Upgrade\RoxAssist.exe /s
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
  O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: Service Norton Protection Center (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  
  ... merci.
  a+
  
  0
Réponse 8 / 38
^^Marie^^ Messages postés 41884 Date d'inscription Statut Membre Dernière intervention 3 280

up
0
Réponse 9 / 38
Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 349

salut

peux tu remettre un rapport silent runner?

Merci
a+
0
1. sf
  
  salut,
  
  le voilà:
  
  "Silent Runners.vbs", revision 49, https://www.silentrunners.org/
  Operating System: Windows XP SP2
  Output limited to non-default values, except where indicated by "{++}"
  
  Startup items buried in registry:
  ---------------------------------
  
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
  "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
  "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
  "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe" ["Google Inc."]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
  "ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]
  "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
  "HP Software Update" = "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."]
  "SynTPEnh" = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."]
  "ccApp" = ""c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
  "eabconfg.cpl" = "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start" ["Hewlett-Packard "]
  "RecGuard" = "C:\Windows\SMINST\RecGuard.exe" [empty string]
  "hpWirelessAssistant" = "C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" ["Hewlett-Packard Development Company, L.P."]
  "RoxioEngineUtility" = ""C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"" ["Roxio"]
  "RoxAssistant" = "C:\Program Files\Common Files\Roxio Shared\Upgrade\RoxAssist.exe /s" [file not found]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
  {02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Yahoo! Toolbar Helper"
  \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "AcroIEHlprObj Class"
  \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
  {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
  \InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
  \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
  {A8F38D8D-E480-4D52-B7A2-731BB6995FDD}\(Default) = "NAV Helper"
  -> {HKLM...CLSID} = "CNavExtBho Class"
  \InProcServer32\(Default) = "c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
  {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Google Toolbar Helper"
  \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
  "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
  -> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"
  \InProcServer32\(Default) = "deskpan.dll" [file not found]
  "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
  \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
  
  merci, a+
  
  0
Réponse 10 / 38
Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 349

salut

le rapport n est pas entier,tu peux attendre quelques minutes avant de le copier coller stp

merci
0
1. sf
  
  excuse, c'est tellement du chinois pour moi que je n'avais même pas vu. Voilà la totale:
  
  "Silent Runners.vbs", revision 49, https://www.silentrunners.org/
  Operating System: Windows XP SP2
  Output limited to non-default values, except where indicated by "{++}"
  
  Startup items buried in registry:
  ---------------------------------
  
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
  "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
  "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
  "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe" ["Google Inc."]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
  "ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]
  "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
  "HP Software Update" = "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."]
  "SynTPEnh" = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."]
  "ccApp" = ""c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
  "eabconfg.cpl" = "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start" ["Hewlett-Packard "]
  "RecGuard" = "C:\Windows\SMINST\RecGuard.exe" [empty string]
  "hpWirelessAssistant" = "C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" ["Hewlett-Packard Development Company, L.P."]
  "RoxioEngineUtility" = ""C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"" ["Roxio"]
  "RoxAssistant" = "C:\Program Files\Common Files\Roxio Shared\Upgrade\RoxAssist.exe /s" [file not found]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
  {02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Yahoo! Toolbar Helper"
  \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "AcroIEHlprObj Class"
  \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
  {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
  \InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
  \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
  {A8F38D8D-E480-4D52-B7A2-731BB6995FDD}\(Default) = "NAV Helper"
  -> {HKLM...CLSID} = "CNavExtBho Class"
  \InProcServer32\(Default) = "c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
  {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Google Toolbar Helper"
  \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
  "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
  -> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"
  \InProcServer32\(Default) = "deskpan.dll" [file not found]
  "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
  \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
  "{2F603045-309F-11CF-9774-0020AFD0CFF6}" = "Synaptics Control Panel"
  -> {HKLM...CLSID} = (no title provided)
  \InProcServer32\(Default) = "C:\Program Files\Synaptics\SynTP\SynTPCpl.dll" ["Synaptics, Inc."]
  "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
  -> {HKLM...CLSID} = "Portable Media Devices Menu"
  \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
  "{7F67036B-66F1-411A-AD85-759FB9C5B0DB}" = "ShellViewRTF"
  -> {HKLM...CLSID} = "ShellViewRTF"
  \InProcServer32\(Default) = "C:\WINDOWS\system32\ShellvRTF.dll" ["XSS"]
  "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Outlook File Icon Extension"
  \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
  "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {HKLM...CLSID} = (no title provided)
  \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
  "{5464D816-CF16-4784-B9F3-75C0DB52B499}" = "Yahoo! Mail"
  -> {HKLM...CLSID} = "YMailShellExt Class"
  \InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
  "{5E44E225-A408-11CF-B581-008029601108}" = "Roxio DragToDisc Shell Extension"
  -> {HKLM...CLSID} = "Roxio DragToDisc Shell Extension"
  \InProcServer32\(Default) = "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll" ["Roxio"]
  "{A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC}" = "My Media"
  -> {HKLM...CLSID} = "Multimédia"
  \InProcServer32\(Default) = "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll" ["Roxio, Inc."]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
  <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
  -> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
  \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]
  
  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
  "System" = (value not set)
  
  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
  <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
  
  HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
  ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
  \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
  Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}"
  -> {HKLM...CLSID} = "IEContextMenu Class"
  \InProcServer32\(Default) = "c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
  Yahoo! Mail\(Default) = "{5464D816-CF16-4784-B9F3-75C0DB52B499}"
  -> {HKLM...CLSID} = "YMailShellExt Class"
  \InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
  
  HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
  ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
  \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
  
  HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
  Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}"
  -> {HKLM...CLSID} = "IEContextMenu Class"
  \InProcServer32\(Default) = "c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
  
  Group Policies {policy setting}:
  --------------------------------
  
  Note: detected settings may not have any effect.
  
  HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\
  
  "DisableRegistryTools" = (REG_DWORD) hex:0x00000000
  {Prevent access to registry editing tools}
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\
  
  "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
  {Shutdown: Allow system to be shut down without having to log on}
  
  "undockwithoutlogon" = (REG_DWORD) hex:0x00000001
  {Devices: Allow undock without having to log on}
  
  Active Desktop and Wallpaper:
  -----------------------------
  
  Active Desktop may be disabled at this entry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
  
  Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
  HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
  "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"
  
  Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
  HKCU\Control Panel\Desktop\
  "Wallpaper" = "C:\Documents and Settings\auchan\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"
  
  Enabled Screen Saver:
  ---------------------
  
  HKCU\Control Panel\Desktop\
  "SCRNSAVE.EXE" = "C:\WINDOWS\system32\ssmypics.scr" [MS]
  
  Startup items in "auchan" & "All Users" startup folders:
  --------------------------------------------------------
  
  C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
  "Démarrage rapide de HP Photosmart Premier" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -s" [null data]
  "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
  
  Enabled Scheduled Tasks:
  ------------------------
  
  "HPpromotions journeysoftware" -> launches: "C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe /N "journeysoftware" -r" ["hp"]
  "Norton AntiVirus - Effectuer une analyse complète du système - auchan" -> launches: "c:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe /TASK:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]
  
  Winsock2 Service Provider DLLs:
  -------------------------------
  
  Namespace Service Providers
  
  HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
  000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
  000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
  000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
  
  Transport Service Providers
  
  HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
  0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
  %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
  %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
  
  Toolbars, Explorer Bars, Extensions:
  ------------------------------------
  
  Toolbars
  
  HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
  "{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
  -> {HKLM...CLSID} = "&Google"
  \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
  
  HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
  "{C4069E3A-68F1-403E-B40E-20066696354B}"
  -> {HKLM...CLSID} = "Norton AntiVirus"
  \InProcServer32\(Default) = "c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
  "{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
  -> {HKLM...CLSID} = "&Google"
  \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
  "{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
  -> {HKLM...CLSID} = "Yahoo! Toolbar"
  \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
  
  HKLM\Software\Microsoft\Internet Explorer\Toolbar\
  "{C4069E3A-68F1-403E-B40E-20066696354B}" = "Norton AntiVirus"
  -> {HKLM...CLSID} = "Norton AntiVirus"
  \InProcServer32\(Default) = "c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
  "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
  -> {HKLM...CLSID} = "Yahoo! Toolbar"
  \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
  "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
  -> {HKLM...CLSID} = "&Google"
  \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
  
  Explorer Bars
  
  HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\
  {4528BBE0-4E08-11D5-AD55-00010333D0AD}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "&Yahoo! Messenger"
  \InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll" ["Yahoo! Inc."]
  
  HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
  {4528BBE0-4E08-11D5-AD55-00010333D0AD}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "&Yahoo! Messenger"
  \InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll" ["Yahoo! Inc."]
  
  Extensions (Tools menu items, main toolbar menu buttons)
  
  HKLM\Software\Microsoft\Internet Explorer\Extensions\
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
  "MenuText" = "Console Java (Sun)"
  "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
  -> {HKCU...CLSID} = "Java Plug-in"
  \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
  -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
  \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]
  
  {4528BBE0-4E08-11D5-AD55-00010333D0AD}\
  "ButtonText" = "Messenger"
  "MenuText" = "Yahoo! Messenger"
  "CLSIDExtension" = "{4C171D40-8277-11D5-AD55-00010333D0AD}"
  -> {HKLM...CLSID} = (no title provided)
  \InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll" ["Yahoo! Inc."]
  
  {85D1F590-48F4-11D9-9669-0800200C9A66}\
  "MenuText" = "Uninstall BitDefender Online Scanner v8"
  "Exec" = "%windir%\bdoscandel.exe" [null data]
  
  {FB5F1910-F110-11D2-BB9E-00C04F795683}\
  "ButtonText" = "Messenger"
  "MenuText" = "Windows Messenger"
  "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
  
  Miscellaneous IE Hijack Points
  ------------------------------
  
  C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
  
  Added lines (compared with English-language version):
  [Strings]: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
  [Strings]: SAFESITE_VALUE="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2fintl%2ffr%2f%3f"
  
  Missing lines (compared with English-language version):
  [Strings]: 2 lines
  
  HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
  <<H>> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = "*Z" (unwritable string)
  -> {HKLM...CLSID} = "Yahoo! Toolbar"
  \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
  
  Running Services (Display Name, Service Name, Path {Service DLL}):
  ------------------------------------------------------------------
  
  Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
  CyberLink Background Capture Service (CBCS HP TVPlay), TVPCapSvc, ""C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe"" [empty string]
  CyberLink Media Library Service(HP TVPlay), CyberLink Media Library Service(HP TVPlay), ""C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe"" ["Cyberlink"]
  CyberLink Task Scheduler (CTS HP TVPlay), TVPSched, ""C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe"" [empty string]
  ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
  hpqwmiex, hpqwmiex, "C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe" ["Hewlett-Packard Development Company, L.P."]
  HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]}
  LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
  Planificateur LiveUpdate automatique, Planificateur LiveUpdate automatique, ""C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"" ["Symantec Corporation"]
  Pml Driver HPZ12, Pml Driver HPZ12, "C:\WINDOWS\system32\HPZipm12.exe" ["HP"]
  Service Norton AntiVirus Auto-Protect, navapsvc, ""c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]
  Service Norton Protection Center, NSCService, "C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE" ["Symantec Corporation"]
  Symantec Core LC, Symantec Core LC, ""C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe"" ["Symantec Corporation"]
  Symantec Event Manager, ccEvtMgr, ""c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
  Symantec Network Drivers Service, SNDSrvc, ""c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"]
  Symantec Network Proxy, ccProxy, ""c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"]
  Symantec Settings Manager, ccSetMgr, ""c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
  Symantec SPBBCSvc, SPBBCSvc, ""c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe"" ["Symantec Corporation"]
  Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
  
  Print Monitors:
  ---------------
  
  HKLM\System\CurrentControlSet\Control\Print\Monitors\
  hpzlnt12\Driver = "hpzlnt12.dll" ["HP"]
  
  ----------
  <<!>>: Suspicious data at a malware launch point.
  <<H>>: Suspicious data at a browser hijack point.
  
  + This report excludes default entries except where indicated.
  + To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
  + To search all directories of local fixed drives for DESKTOP.INI
  DLL launch points, use the -supp parameter or answer "No" at the
  first message box and "Yes" at the second message box.
  ---------- (total run time: 52 seconds, including 18 seconds for message boxes)
  
  merci
  a+
  
  0
2. sf
  
  re-salut
  bon, j'espère que le scan précédent ne vous donne pas la nausée?...
  à part faire revenir mon cas dans la première page, je voulais aussi vous demander si j'ai intérêt à passer à Avast + Zonealarm dont j'ai entendu parler ici, à la place du Norton antivirus que j'ai pour l'instant?
  merci encore pour votre aide.
  a+
  
  0
  1. afideg Messages postés 10466 Date d'inscription Statut Contributeur sécurité Dernière intervention 602 > sf
    
    Bonsoir,
    Attends de régler d'abord les problèmes.
    Tu es entre de bonnes mains.
    Patiente, et pose à nouveau la question plus tard.
    C'est INUTILE de penser à ça maintenant.
    Bonne chance.
    
    0
Réponse 11 / 38
Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 349

Salut

Peux tu remettre un Hijack this stp.
Pour ta question, oui il serait preferable de changer mais nous verrons cela apres le rapport que je te demande, ;-)

Merci
A+
0
1. sf
  
  voilà le hijackthis:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 19:19:05, on 17/10/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  C:\Program Files\ewido anti-spyware 4.0\guard.exe
  C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  C:\WINDOWS\System32\svchost.exe
  C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\DOCUME~1\auchan\LOCALS~1\Temp\Répertoire temporaire 3 pour hijackthis.zip\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www8.hp.com/fr/fr/home.html
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
  O4 - HKLM\..\Run: [RoxAssistant] C:\Program Files\Common Files\Roxio Shared\Upgrade\RoxAssist.exe /s
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
  O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: Service Norton Protection Center (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  
  OK je patiente pour le reste...
  merci a+
  
  0
Réponse 12 / 38
^^Marie^^ Messages postés 41884 Date d'inscription Statut Membre Dernière intervention 3 280

Salut

Passe un coup de smitfraud
Stp
Merci

Télécharge ceci: (merci a S!RI pour ce programme).
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
TUTO :: http://siri.urz.free.fr/Fix/SmitfraudFix.php

Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.
----------------------------------------------------------------------------
Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
Relance le programme Smitfraud,
Cette fois choisit l’option 2, répond oui a tous ;
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

========================================
Refais un Hitjackthis

A++
0
1. sf
  
  salut
  je n'ai pas bien compris si tu voulais le premier rapport (option 1 de smitfraudfix). Dans le doute le voici:
  SmitFraudFix v2.107
  
  Rapport fait à 19:08:02,92, 18/10/2006
  Executé à partir de C:\Documents and Settings\auchan\Mes documents\SmitfraudFix\SmitfraudFix
  OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
  Fix executé en mode normal
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\auchan
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\auchan\Application Data
  
  »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\auchan\Favoris
  
  »»»»»»»»»»»»»»»»»»»»»»»» Bureau
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
  
  »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
  
  »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
  "Source"="http://image.radio-france.fr/chaines/france-culture/img/tmpl/tmpl_logo.gif"
  "SubscribedURL"="http://image.radio-france.fr/chaines/france-culture/img/tmpl/tmpl_logo.gif"
  "FriendlyName"=""
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
  "Source"="About:Home"
  "SubscribedURL"="About:Home"
  "FriendlyName"="Ma page d'accueil"
  
  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  "AppInit_DLLs"=""
  
  »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32
  
  »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» Fin
  
  puis le 2e:
  
  SmitFraudFix v2.107
  
  Rapport fait à 19:13:28,10, 18/10/2006
  Executé à partir de C:\Documents and Settings\auchan\Mes documents\SmitfraudFix\SmitfraudFix
  OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
  Fix executé en mode sans echec
  
  »»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
  
  »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
  
  GenericRenosFix by S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
  
  »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
  
  »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
  
  Nettoyage terminé.
  
  »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
  !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» Fin
  
  et enfin le hijackthis:
  Logfile of HijackThis v1.99.1
  Scan saved at 19:17:56, on 18/10/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  C:\Program Files\ewido anti-spyware 4.0\guard.exe
  C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\WINDOWS\System32\svchost.exe
  C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
  C:\WINDOWS\system32\wuauclt.exe
  C:\DOCUME~1\auchan\LOCALS~1\Temp\Répertoire temporaire 4 pour hijackthis.zip\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www8.hp.com/fr/fr/home.html
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
  O4 - HKLM\..\Run: [RoxAssistant] C:\Program Files\Common Files\Roxio Shared\Upgrade\RoxAssist.exe /s
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
  O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: Service Norton Protection Center (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  
  voilà pour cette fois. bon courage...
  a+
  
  0
  1. afideg Messages postés 10466 Date d'inscription Statut Contributeur sécurité Dernière intervention 602 > sf
    
    Salut sf
    Bonsoir Marie et Régis59,
    
    sf, déplace HJT ( = HijackThis ) dans C:\Program Files par exemple.
    
    POURQUOI?
    
    Le problème consiste à avoir un dossier dédié à HijackThis;
    car lors de l'utilisation il créera un dossier backup permettant de revenir en arrière en cas d'erreur.
    L'emplacement de ce dossier importe peu à l'exclusion des dossiers temporaires qui sont vidés pratiquement systématiquement lors d'une procédure de nettoyage.
    Ce nettoyage effacerait donc les backups; ce qui empêcherait tout retour en arrière.
    
    Bon vent.
    
    0
  2. sf > afideg Messages postés 10466 Date d'inscription Statut Contributeur sécurité Dernière intervention
    
    salut tout le monde
    c'est fait, même s'il me semble qu'il était déjà dans un dossier non temporaire (?). Bon, en tous cas il est dans program files maintenant.
    merci, a+
    
    0
Réponse 13 / 38
Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 349

Salut

remet un nouvel hijack this pour controle stp

a+
0
1. sf
  
  salut!
  non, je n'avais pas abandonné (juste quelques jours au vert)
  alors voilà pour le hijackthis:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 19:12:28, on 23/10/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  C:\Program Files\ewido anti-spyware 4.0\guard.exe
  C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\Program Files\Sibelius Software\Sibelius 2\Sibelius.exe
  C:\Program Files\Fichiers communs\Roxio Shared\Project Selector\Projselector.exe
  C:\PROGRA~1\ROXIO\EASYCD~1\AUDIOC~1\Rxplayer.exe
  C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
  C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
  C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaDB.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
  C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
  C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
  C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
  C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
  C:\Program Files\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www8.hp.com/fr/fr/home.html
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
  O4 - HKLM\..\Run: [RoxAssistant] C:\Program Files\Common Files\Roxio Shared\Upgrade\RoxAssist.exe /s
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
  O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: Service Norton Protection Center (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
  O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
  
  alors, où on en est??
  merci, a+
  
  0
Réponse 14 / 38
Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 349

salut

ou en sont tes soucis?

a+
0
1. sf
  
  salut
  en fait ça a l'air d'aller mieux pour le portable, qui n'est plus spécialement lent. Et plus de pages internet bizarres... Donc on est sauvé?
  Il y a quand même l'abonnement Norton antivirus qui expire dans une dizaine de jours, et je n'ai plus trop envie de reprendre avec ça. Est-ce que vous avez des conseils éclairés à me fournir sur le sujet?
  Je pense que le PC (non portable) ne doit pas aller trop mal. Est-ce que quelqu'un a jeté un oeil (ou peut le faire??) sur les tests du tout début de cette conversation?
  vraiment MERCI.
  a+
  Amandine
  
  0
Réponse 15 / 38
Lyonnais92 Messages postés 25708 Statut Contributeur sécurité 1 537

Bonsoir Sf, salut Régis,

Le Pc est aussi infecté. Il vaudrait mieux ne pas les mettre en réseau.

Tu télécharges Spybot (je crois que tu l'as déjà) et ad aware (téléchargement en haut et à gauche de cette page).

Tu les mets à jour, mais tu ne les lances pas.

¤Démarre en mode sans echec :
Pour cela, tu tapotes la touche F8 des le debut de l allumage du pc sans t arreter
Une fenetre va 'souvrir, tu te deplaces avec les fleches du clavier sur demarrer en mode sans echec puis tape entrée.
Une fois sur le bureau si il n y a pas toutes les couleurs et autres c est normal !
(Si F8 ne marche pas utilise la touche F5)
----------------------------------------------------------------------------
¤Désactive ta restauration systeme:
Clic droit sur poste de travail puis,
propriété, tu cliques sur onglet restauration système
tu coches la case désactiver la restauration et applique
----------------------------------------------------------------------------
¤Affiche tous les fichiers et dossiers :
Clique sur démarrer/panneau de configuration/option des dossiers/affichage

Cocher afficher les dossiers cacher

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

Décocher masquer les extensions dont le type est connu
Puis fais «Ok» pour valider les changements.

Et appliquer !
----------------------------------------------------------------------------
¤Vide tes fichiers temps et tempory internet file:
utilise ceci pour le faire (tu as telecharger avant)
3/http://pageperso.aol.fr/Balltrap34/CleanUp312.exe
----------------------------------------------------------------------------
¤Relance Hijack This, coche les cases devant ces lignes et ensuite clik sur fix:

O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe
O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe

----------------------------------------------------------------------------
¤Recherche et supprime ceci:
attention seulement les fichiers

C:\WINDOWS\System32\msmsgs.exe
C:\WINDOWS\System32\yaemu.exe

----------------------------------------------------------------------------
----------------------------------------------------------------------------

----------------------------------------------------------------------------
Passe adaware et vire tout ce qu il trouve
----------------------------------------------------------------------------
Passe spybot et vire tout ce qu il trouve
----------------------------------------------------------------------------
Tu vides ta poubelle et tu redemarres en mode normal et refais un Hijack en mode do a scan and save a log.

Tu postes le log en réponse et tu précises tes soucis.

@+
0
Réponse 16 / 38
Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 349

Salut Lyonnais,

Je doute que cela va suffir lol [...] Jte laisse faire lol

Sinon bha on est la et si tu as besoin, demande nous ! (meme si tu as deja posé la question, si on a oublié de repondre, demande sans problemes)

a+
0
Réponse 17 / 38
sf

salut tous les 2

alors, j'ai fait tout ce qui était demandé. Je n'ai pas trouvé les fichiers msmsgs.exe et yaemu.exe dans system32 pour les détruire.
Et voilà le hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 20:22:58, on 25/10/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\PreSonus\1394AudioDriver_FIREBox\FIREBOX Control.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\wuauclt.exe
D:\téléchargements internet\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [FIREBOX] C:\Program Files\PreSonus\1394AudioDriver_FIREBox\FIREBOX Control.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - D:\programmes\WinHTTrack\WinHTTrackIEBar.dll (file missing)
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - D:\programmes\WinHTTrack\WinHTTrackIEBar.dll (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt4_x.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/278ac79543f901417918/netzip/RdxIE601_fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030625/qtinstall.info.apple.com/abarth/fr/win/QuickTimeInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A9BA9DC-1A83-43F3-BF2D-D66CA71FD86D}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{695FA71A-7F6E-4FBB-9183-7C22CCC1632D}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{859AA0D9-CA2E-4C89-A2DC-565A10417551}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{9EE0F008-0935-45C1-BFFD-BEBEECDA9EB6}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{A84BE591-D149-48E7-B964-C400CF56C0E5}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{DCA47F2A-65FB-4306-956F-046F169DEFB6}: NameServer = 85.255.114.87,85.255.112.19
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Alors quoi de neuf?
Merci. Et si quelqu'un peut me dire si j'ai intérêt à passer à Avast et Zonealarm sur le portable, ça serait très sympa...
a+
0
Réponse 18 / 38
Lyonnais92 Messages postés 25708 Statut Contributeur sécurité 1 537

Bonsoir,

Déconnecte toi d'Internet.

Relance HijackThis en mode do a scan only.

Coche la case devant les lignes suivantes :
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - D:\programmes\WinHTTrack\WinHTTrackIEBar.dll (file missing)
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - D:\programmes\WinHTTrack\WinHTTrackIEBar.dll (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A9BA9DC-1A83-43F3-BF2D-D66CA71FD86D}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{695FA71A-7F6E-4FBB-9183-7C22CCC1632D}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{859AA0D9-CA2E-4C89-A2DC-565A10417551}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{9EE0F008-0935-45C1-BFFD-BEBEECDA9EB6}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{A84BE591-D149-48E7-B964-C400CF56C0E5}: NameServer = 85.255.114.87,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{DCA47F2A-65FB-4306-956F-046F169DEFB6}: NameServer = 85.255.114.87,85.255.112.19

Ensuite tu cliques sur fix checked.

Tu relances en mode "do a scan and save a log".
Tu postes ton log dans ta réponse.

Pour ta question, personnellement, je préfere Avast et Kerio pour une solution gratuite. Pour une solution payante, Kapersky serait une très bonne solution. Mais ce n'est pas la seule.

@+
0
Réponse 19 / 38
Lyonnais92 Messages postés 25708 Statut Contributeur sécurité 1 537

Re,

On continue comme cela :

Tu télécharges CwShredder ici (tu choisis la dernière version) :

https://www.google.com
Tu l'enregistres dans un dossier.

Tu te déconnectes du NET et tu l'exécutes. Tu acceptes la licence et tu cliques sur scan only. S'il trouve quelque chose, essaye de copier la liste dans un fichier. Ensuite, tu cliques sur back puis sur fix (réparer).

Tu relances un hijackThis en mode scan et log et tu post le rapport (un seul, le dernier).

@+
0
1. sf
  
  re-,
  
  le CWShredder n'a rien trouvé.
  Pour le hijackthis, voilà ce que ça donne:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 00:11:32, on 26/10/2006
  Platform: Windows XP (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 (6.00.2600.0000)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
  C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
  C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
  C:\Program Files\PreSonus\1394AudioDriver_FIREBox\FIREBOX Control.exe
  C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
  C:\WINDOWS\System32\RUNDLL32.EXE
  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
  C:\WINDOWS\System32\ctfmon.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  C:\WINDOWS\system32\ntvdm.exe
  C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
  C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
  C:\Program Files\ewido anti-spyware 4.0\guard.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  C:\WINDOWS\System32\nvsvc32.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\MsPMSPSv.exe
  C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\WINDOWS\system32\NOTEPAD.EXE
  D:\téléchargements internet\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
  O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
  O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
  O4 - HKLM\..\Run: [FIREBOX] C:\Program Files\PreSonus\1394AudioDriver_FIREBox\FIREBOX Control.exe
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
  O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
  O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
  O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
  O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt4_x.cab
  O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/278ac79543f901417918/netzip/RdxIE601_fr.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030625/qtinstall.info.apple.com/abarth/fr/win/QuickTimeInstaller.exe
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
  O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
  O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
  
  Pour la question de l'antivirus, est-ce que la solution payante est mieux que la gratuite?
  Est-ce qu'il y a des précautions particulières à prendre au moment où je vais changer d'antivirus?
  
  merci, a+
  
  0
Réponse 20 / 38
Lyonnais92 Messages postés 25708 Statut Contributeur sécurité 1 537

Re,

Je ne crois pas qu'il y ait de consensus sur la meilleure solution.

Ce forum propose systématiquement des solutions gratuites, plus rarement des solutions payantes. Il y a consensus sur 2 choses : il n'y a pas de risque zéro et les mises à jour régulières de l'OS et du navigateur, ainsi que des applications et des drivers couplées avec un comportement prudent (incluant des nettoyages réguliers) sont au moins aussi important que le choix entre les bons antivirus et parefeu (il en est de moins bons).

Pour la suite des opérations sur le fixe, plus tard (beaucoup plus tard).

@+

Pour les précautions, les antivirus ne coexistent pas. Il faut enlever l'ancien avant d'installer le nouveau. On est donc sans protection pendant cette période qu'il faut exécuter déconnecter du Net.

En conséquence, il faut avoir téléchargé et enregistré le nouvel antivirus et l'utilitaire de supression de Norton. Il vaut mieux aussi avoir imprimé les tutoriaux. Avoir 2 pc peut faciliter les choses (sans oublier qu'une clé USB ou un Cd-Rom peuvent autant véhiculer un virus que les disquettes d'autrefois).
0

Virus lenteur

38 réponses

Discussions similaires

Newsletters