PC lent - rapport hijackthis

PC lent & rapport hijack this

J'ai un souci avec un spyware certainement. Avast ne détecte rien ni spy doctor. Le pc est super lent, impossible d'aller sur internet explorer. Et message windows : system alert ! Bref pas cool du tout...

Ci-joint le rapport hijack this pour ceux qui savent...

D'avance merci à celui ou celle qui pourra m'aider

Logfile of HijackThis v1.99.1
Scan saved at 18:28:39, on 19/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
E:\AdobeR.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\CLMENT~1\LOCALS~1\Temp\Rar$EX00.984\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.neuf.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {E12BFF69-38A7-406e-A8EF-2738107A7831} - C:\DOCUME~1\CLMENT~1\LOCALS~1\Temp\juan.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

*************************************************************************************
Logfile of HijackThis v1.99.1

Genre

Votre version semble être actuelle.

Platform: Windows XP SP2 (WinNT 5.01.2600)

Genre

Analyzerdetails
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Genre

Votre version semble être actuelle.
Visitor's assessment Analyzerdetails
C:\WINDOWS\System32\smss.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\system32\winlogon.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\system32\services.exe

Genre

Safe
Safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\system32\lsass.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\system32\Ati2evxx.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\system32\svchost.exe

Genre

Safe
Safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\System32\svchost.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\system32\Ati2evxx.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\system32\spoolsv.exe

Genre

Safe
Safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\Explorer.EXE

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\Program Files\Analog Devices\Core\smax4pnp.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

Genre

Very safe
Very safe

Soundkartentreiber
Visitor's assessment Analyzerdetails
C:\Program Files\Winamp\winampa.exe

Genre

Safe
Safe

Visitor's assessment Analyzerdetails
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\system32\ctfmon.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\Program Files\Alwil Software\Avast4\ashServ.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\system32\svchost.exe

Genre

Safe
Safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\Program Files\eMule\emule.exe

Genre

Safe
Safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\Program Files\MSN Messenger\usnsvc.exe

Genre

Very safe
Very safe

This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
C:\WINDOWS\system32\wuauclt.exe

Genre

Neutral
Neutral

Windows Update AutoUpdate Client
Visitor's assessment Analyzerdetails
C:\WINDOWS\system32\msiexec.exe

Genre

Very safe
Very safe

Visitor's assessment Analyzerdetails
E:\AdobeR.exe

Genre

Fuzzy Algorithmcheck (1.23 / 5.00), Nasty
Visitor's assessment Analyzerdetails
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe

Genre

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\adobe\acrobat.*\reader\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. Adobe Acrobat Reader related
Visitor's assessment Analyzerdetails
C:\Program Files\WinRAR\WinRAR.exe

Genre

Very safe
Very safe

WinRar Packer
Visitor's assessment Analyzerdetails
C:\DOCUME~1\CLMENT~1\LOCALS~1\Temp\Rar$EX00.984\HijackThis.exe

Genre

Souvenez-vous que Hijackthis doit être exécuté dans son propre dossier. C'est seulement s'il est exécuté dans un dossier réservé, qu'il créera des sauvegardes! Tool, mit dem sie dieses Logfile erzeugt haben. Das Programm sollte so angelegt sein ! C:\Programme\HijackThis\HijackThis.exe
Visitor's assessment Analyzerdetails
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC

Genre

Ce site a été identifié comme étant non dangereux
Visitor's assessment Analyzerdetails
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr

Genre

Safe
Safe
Ce site a été identifié comme étant non dangereux
Visitor's assessment Analyzerdetails
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.neuf.fr

Genre

Ce site a été identifié comme étant non dangereux
Visitor's assessment Analyzerdetails
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

Genre

Safe
Safe
Ce site a été identifié comme étant non dangereux
Visitor's assessment Analyzerdetails
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

Genre

Safe
Safe
Ce site a été identifié comme étant non dangereux
Visitor's assessment Analyzerdetails
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp

Genre

Safe
Safe
Ce site a été identifié comme étant non dangereux
Visitor's assessment Analyzerdetails
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC

Genre

Ce site a été identifié comme étant non dangereux
Visitor's assessment Analyzerdetails
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

Genre

Very safe
Very safe
Ce site a été identifié comme étant non dangereux
Visitor's assessment Analyzerdetails
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

Genre

Very safe
Very safe
AcroIEhelper.ocx, AcroIEhelper.dll - Adobe Acrobat reader, http://www.adobe.com/products/acrobat/re adstep2.html
Visitor's assessment Analyzerdetails
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Genre

Safe
Safe

Inscription superflue (car sans effet) qui peut donc être effacée ! This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

Genre

Neutral
Neutral
WindowsLiveLogin.dll - Microsoft Windows_Live, https://support.microsoft.com/en-us/windows/windows-essentials-2707b879-5004-4349-c4a4-e5900945f2a9
Visitor's assessment Analyzerdetails
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

Genre

MSN Toolbar Helper
Visitor's assessment Analyzerdetails
O2 - BHO: (no name) - {E12BFF69-38A7-406e-A8EF-2738107A7831} - C:\DOCUME~1\CLMENT~1\LOCALS~1\Temp\juan.dll

Genre

Effacer à tout prix ! [random filename] - Downloader, detected by Kaspersky, https://www.kaspersky.fr/ antivirus as Trojan.Win32.BHO.bd - a VirtuMonde/Vundo, http://www.symantec.com/security_respons e/writeup.jsp?docid=2004-112111-3912-99 adware component.
Visitor's assessment Analyzerdetails
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

Genre

Msntb.dll - MSN Toolbar, https://www.bing.com/?toHttps=1&redig=C5A5F4D5ECA345F689A948C005FF88A7
Visitor's assessment Analyzerdetails
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe

Genre

Safe
Safe
This entry was classified from our visitors as good.
Visitor's assessment Analyzerdetails
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

Genre

Neutral
Neutral
SoundMax integrated sound. Required if you have custom settings for your sound, such as effects and environments
Visitor's assessment Analyzerdetails
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

Genre

Very safe
Very safe
System Tray icon for SoundMax integrated sound. Sound properties can be accessed through the Start Menu or Control Panel
Short analysis
La mise en oeuvre de ces conseils est à vos propres risques et périls !

© 2004 - 2007 Mathias Mattner | Contact

bottomleft