Piratage ou "prendre la main" sur mon pc

Résolu
missitalienne Messages postés 8 Statut Membre -  
 france21 -
Bonjour, j'ai donné mon pc en réparation à une personne que je connais peu et depuis il y a des trucs bizzares qui se passent dessus :
Déconnexion automatique de msn
Double clic et mauvais contrôle de la souris
Fermeture intempestive de Lecteur Windows Média
Changement de paramètres dans msn principalement

Alors soit je suis devenu "folle" soit cette personne à introduit un logiciel ou à un contrôle sur mon pc.

Merci de votre aide !!!
Configuration: Windows XP
Internet Explorer 6.0

25 réponses

  • 1
  • 2
  1. moK´s@ Messages postés 4410 Statut Membre 89
     
    salut,

    * Télécharge combofix.exe (par sUBs) sur ton Bureau.

    http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe

    * Double clique combofix.exe.
    * Tape sur la touche 1 (Yes) pour démarrer le scan.
    * Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

    NOTE : Le rapport se trouve également ici : C:\Combofix.txt
    0
    1. missitalienne Messages postés 8 Statut Membre
       
      ComboFix 07-08-17.2 - "Administrateur" 2007-08-18 12:19:47.2 - NTFSx86
      Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.88 [GMT 2:00]


      ((((((((((((((((((((((((( Files Created from 2007-07-18 to 2007-08-18 )))))))))))))))))))))))))))))))


      2007-08-18 12:09 51,200 --a------ C:\WINDOWS\nircmd.exe
      2007-08-18 11:53 <REP> d-------- C:\WINDOWS\system32\Panda Software
      2007-08-18 11:53 <REP> d-------- C:\WINDOWS\LastGood
      2007-08-17 21:59 <REP> d-------- C:\WINDOWS\system32\NtmsData
      2007-08-17 20:51 <REP> d--h----- C:\WINDOWS\system32\GroupPolicy
      2007-08-12 13:10 19,793 --a------ C:\WINDOWS\cc_20070812_1310.reg


      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

      2007-08-16 19:26 --------- d-------- C:\Program Files\Fichiers communs\AOL
      2007-08-12 23:03 --------- d-------- C:\Program Files\AOL 9.0
      2007-08-12 16:04 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\AdobeUM
      2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe
      2007-07-28 00:02 94416 --a--c--- C:\WINDOWS\system32\drivers\aswmon2.sys
      2007-07-28 00:02 92848 --a--c--- C:\WINDOWS\system32\drivers\aswmon.sys
      2007-07-28 00:00 23152 --a--c--- C:\WINDOWS\system32\drivers\aswRdr.sys
      2007-07-27 23:59 42912 --a--c--- C:\WINDOWS\system32\drivers\aswTdi.sys
      2007-07-27 23:58 26624 --a--c--- C:\WINDOWS\system32\drivers\aavmker4.sys
      2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AVASTSS.scr
      2007-06-21 12:01 103720 --a------ C:\WINDOWS\system32\AOLDial.dll


      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


      *Note* empty entries & legit default entries are not shown

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF4DA5D4-805B-9066-3918-A21B9B156B2A}]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "SoundMan"="soundman.exe" [2002-03-22 19:48 C:\WINDOWS\soundman.exe]
      "HostManager"="C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe" [2006-11-17 15:16]

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2005-06-14 18:05]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^AOL 9.0 Icône AOL.lnk]
      path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\AOL 9.0 Icône AOL.lnk
      backup=C:\WINDOWS\pss\AOL 9.0 Icône AOL.lnkCommon Startup

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^AOL Compagnon.lnk]
      path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\AOL Compagnon.lnk
      backup=C:\WINDOWS\pss\AOL Compagnon.lnkCommon Startup

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
      C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
      "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapFax]
      C:\Program Files\Classic PhoneTools\CapFax.EXE

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
      C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
      "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odebit Multimedia V3]
      C:\Program Files\Odebit Multimédia\V3\Odebit.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odebit Multimedia V3 - Services]
      C:\Program Files\Odebit Multimédia\V3\Odebit.exe /info

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
      "C:\Program Files\QuickTime\qttask.exe" -atboottime

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
      C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]
      "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
      C:\Program Files\Winamp\winampa.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
      "TapiSrv"=3 (0x3)
      "BthServ"=2 (0x2)
      "avast! Web Scanner"=3 (0x3)
      "avast! Mail Scanner"=3 (0x3)
      "avast! Antivirus"=2 (0x2)

      R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS
      R3 alcan5ln;SpeedTouch(tm) USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys
      S3 AN983;Carte Fast Ethernet 10/100 Mbps ADMtek AN983/AN985/ADM951X;C:\WINDOWS\system32\DRIVERS\AN983.sys
      S3 Aox402Camera;SE402 Video Camera (WDM);C:\WINDOWS\system32\DRIVERS\se402vc.sys
      S3 driverhardwarev2;driverhardwarev2;\??\C:\Program Files\HardwareDetection\driverhardwarev2.sys
      S3 MR97310_USB_DUAL_CAMERA;XDC-Series;C:\WINDOWS\system32\DRIVERS\mr97310c.sys
      S3 SE402RefCameraStill;SE402 Still Camera (WDM);C:\WINDOWS\system32\DRIVERS\se402sc.sys

      *Newly Created Service* - CATCHME
      *Newly Created Service* - RKPAVPROC

      Contents of the 'Scheduled Tasks' folder
      2007-08-18 09:24:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE

      **************************************************************************

      catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2007-08-18 12:20:26
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************

      Completion time: 2007-08-18 12:21:06
      C:\ComboFix-quarantined-files.txt ... 2007-08-18 12:20
      C:\ComboFix2.txt ... 2007-08-18 12:11

      --- E O F ---
      0
  2. missitalienne Messages postés 8 Statut Membre
     
    Fichier joint téléchargé et installer, analyse faite mais comment savoir le résultat ?
    Plein de chiffre incompréhensible et langage anglais un peu technique !
    Merci de me dire si je peux savoir le résultat de l'analyse faite.
    Merci à nouveau de votre aide.
    Slts.
    0
  3. moK´s@ Messages postés 4410 Statut Membre 89
     
    peux tu mettre un hijack this stp :

    * Télécharge HijackThis et poste le rapport stp

    http://pchelpbordeaux.free.fr/logiciels.html
    Tutorial
    http://pchelpbordeaux.free.fr/tuto.html
    Démo en image
    http://pageperso.aol.fr/balltrap34/demohijack.htm

    @+
    0
  4. missitalienne Messages postés 8 Statut Membre
     
    Boomscud
    Boomscud
    1A23-0025-8030-1583-4629-7773

    Windows XP 5.1
    IA32
    WinAspi: File 'Wnaspi32.dll': Ver=4.71 (0002), size=45056 bytes, created 17/07/2002 12:20:56
    ahead WinASPI: File 'C:\Program Files\Ahead\nero\Wnaspi32.dll': Ver=2.0.1.68, size=160016 bytes, created 22/07/2004 17:33:44
    Nero version: 6.3.1.20
    Recorder: < Image Recorder> Version: Not available - HA -1 TA 0 - 6.3.1.20
    Adapter driver: <Virtual Device> HA -1
    Drive buffer :
    CD-ROM: <CD-R/RW CW079D CD-R/RW >Version: 11SJ - HA 1 TA 1 - 6.3.1.20
    Adapter driver: <atapi> HA 1

    === Scsi-Device-Map ===
    DiskPeripheral : ExcelStor Technology J240 atapi Port 0 ID 0 DMA: On
    DiskPeripheral : ST38410A atapi Port 0 ID 1 DMA: On
    CdRomPeripheral : IDE DVD-ROM 16X atapi Port 1 ID 0 DMA: On
    CdRomPeripheral : CD-R/RW CW079D CD-R/RW atapi Port 1 ID 1 DMA: On

    === CDRom-Device-Map ===
    IDE DVD-ROM 16X D: CDRom0
    CD-R/RW CW079D CD-R/RW E: CDRom1
    =======================

    AutoRun : 1
    Excluded drive IDs:
    WriteBufferSize: 57671680 (0) Byte
    ShowDrvBufStat : 0
    BUFE : 0
    Physical memory : 383MB (392688kB)
    Free physical memory: 115MB (118480kB)
    Memory in use : 69 %
    Uncached PFiles: 0x0
    Use Static Write Speed Table: 0
    Use Inquiry : 1
    Global Bus Type: default (0)
    Check supported media : Disabled (0)

    27.4.2007
    CD EXTRA
    10:29:32 #1 Text 0 File Isodoc.cpp, Line 6065
    Iso document burn settings
    ------------------------------------------
    Determine maximum speed : FALSE
    Simulate : FALSE
    Write : TRUE
    Finalize CD : TRUE
    Multisession : FALSE
    Burning mode : TAO
    Mode : 2 / XA
    ISO Level : 1 (Max. of 11 = 8 + 3 char)
    Character set : ISO 9660
    Joliet : TRUE
    Allow pathdepth more than 8 directories : TRUE
    Allow more than 255 characters in path : TRUE
    Write ISO9660 ;1 file extensions : TRUE

    10:29:32 #2 CDADOC -1 File Cdadoc.cpp, Line 1508
    Audio item log info:
    Audio document burn settings:
    =============================
    Burn mode: TAO,
    CD Text: Off,
    Cache disk or network files: Yes,
    Cache small files: Yes,
    Cache files smaller than 65536 bytes.
    Audio Multisession: No
    List of audio tracks:
    =====================
    Track 01: Length: 04:11.18, Pause frames: 150, Filters: 0, Name: '01. aimer est plus fort que d'être aimé.mp3'.
    Track 02: Length: 05:06.44, Pause frames: 150, Filters: 0, Name: '02. tous les cris les SOS.mp3'.
    Track 03: Length: 04:21.69, Pause frames: 150, Filters: 0, Name: '03. l'aziza.mp3'.
    Track 04: Length: 03:36.10, Pause frames: 150, Filters: 0, Name: '04. le blues est blanc.mp3'.
    Track 05: Length: 04:24.48, Pause frames: 150, Filters: 0, Name: '05. sauver l'amour.mp3'.
    Track 06: Length: 04:45.29, Pause frames: 150, Filters: 0, Name: '06. petite Angèle.mp3'.
    Track 07: Length: 04:58.51, Pause frames: 150, Filters: 0, Name: '07. petit homme mort au combat.mp3'.
    Track 08: Length: 04:34.68, Pause frames: 150, Filters: 0, Name: '08. ne parle pas de malheur.mp3'.
    Track 09: Length: 05:52.27, Pause frames: 150, Filters: 0, Name: '09. un enfant assis attend la pluie.mp3'.
    Track 10: Length: 03:46.38, Pause frames: 150, Filters: 0, Name: '01. les oiseaux (1ère partie).mp3'.
    Track 11: Length: 03:32.41, Pause frames: 150, Filters: 0, Name: '02. les oiseaux (2ème partie).mp3'.
    Track 12: Length: 03:20.58, Pause frames: 150, Filters: 0, Name: '03. France.mp3'.
    Track 13: Length: 03:05.03, Pause frames: 150, Filters: 0, Name: '04. c'est un voyou.mp3'.
    Track 14: Length: 05:27.15, Pause frames: 150, Filters: 0, Name: '05. Lucie.mp3'.
    Track 15: Length: 03:54.70, Pause frames: 150, Filters: 0, Name: '06. le chanteur.mp3'.
    Track 16: Length: 03:29.00, Pause frames: 150, Filters: 0, Name: '07. si je suis fou.mp3'.
    Track 17: Length: 04:48.09, Pause frames: 150, Filters: 0, Name: '08. oiseau de nuit.mp3'.
    Track 18: Length: 03:48.01, Pause frames: 150, Filters: 0, Name: '09. le pied par terre.mp3'.
    Total size: 77:39.74

    10:29:32 #3 Phase 73 File dlgbrnst.cpp, Line 1855
    Preparing items

    10:29:32 #4 Text 0 File Reader.cpp, Line 126
    Reader running

    10:29:32 #5 Text 0 File AudioCompilationImpl.cpp, Line 817
    DRM: StartDrmRecording(RealRec:0, ImageRec:1, Copies:1)
    DRM: Beginning burn process.

    10:29:32 #6 ISO9660GEN -11 File geniso.cpp, Line 3899
    First writeable address = 0 (0x00000000)

    10:29:32 #7 Text 0 File Burncd.cpp, Line 3173
    Turn on Track-at-once, using CD-R/RW media

    10:29:32 #8 Text 0 File DlgWaitCD.cpp, Line 247
    Last possible write address on media: 2147483646 (477218:37.21)
    Last address to be written: 361348 ( 80:19.73)

    10:29:32 #9 Text 0 File DlgWaitCD.cpp, Line 259
    Write in overburning mode: NO (enabled: CD)

    10:29:32 #10 Text 0 File DlgWaitCD.cpp, Line 2162
    Recorder: Image Recorder;
    CD type reading failed
    ATIP Data: ?

    10:29:32 #11 Text 0 File DlgWaitCD.cpp, Line 420
    >>> Protocol of DlgWaitCD activities: <<<
    =========================================

    10:29:32 #12 Text 0 File ThreadedTransferInterface.cpp, Line 813
    Setup items (after recorder preparation)
    0: TRM_AUDIO_NOPRE (01. aimer est plus fort que d'être aimé.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 18843 (18843) = #18843/4:11.18
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 18843 blocks [ Image Recorder ]
    1: TRM_AUDIO_NOPRE (02. tous les cris les SOS.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 22994 (22994) = #22994/5:6.44
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 22994 blocks [ Image Recorder ]
    2: TRM_AUDIO_NOPRE (03. l'aziza.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 19644 (19644) = #19644/4:21.69
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 19644 blocks [ Image Recorder ]
    3: TRM_AUDIO_NOPRE (04. le blues est blanc.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 16210 (16210) = #16210/3:36.10
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 16210 blocks [ Image Recorder ]
    4: TRM_AUDIO_NOPRE (05. sauver l'amour.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 19848 (19848) = #19848/4:24.48
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 19848 blocks [ Image Recorder ]
    5: TRM_AUDIO_NOPRE (06. petite Angèle.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 21404 (21404) = #21404/4:45.29
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 21404 blocks [ Image Recorder ]
    6: TRM_AUDIO_NOPRE (07. petit homme mort au combat.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 22401 (22401) = #22401/4:58.51
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 22401 blocks [ Image Recorder ]
    7: TRM_AUDIO_NOPRE (08. ne parle pas de malheur.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 20618 (20618) = #20618/4:34.68
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 20618 blocks [ Image Recorder ]
    8: TRM_AUDIO_NOPRE (09. un enfant assis attend la pluie.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 26427 (26427) = #26427/5:52.27
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 26427 blocks [ Image Recorder ]
    9: TRM_AUDIO_NOPRE (01. les oiseaux (1ère partie).mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 16988 (16988) = #16988/3:46.38
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 16988 blocks [ Image Recorder ]
    10: TRM_AUDIO_NOPRE (02. les oiseaux (2ème partie).mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 15941 (15941) = #15941/3:32.41
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15941 blocks [ Image Recorder ]
    11: TRM_AUDIO_NOPRE (03. France.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 15058 (15058) = #15058/3:20.58
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15058 blocks [ Image Recorder ]
    12: TRM_AUDIO_NOPRE (04. c'est un voyou.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 13878 (13878) = #13878/3:5.3
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 13878 blocks [ Image Recorder ]
    13: TRM_AUDIO_NOPRE (05. Lucie.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 24540 (24540) = #24540/5:27.15
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 24540 blocks [ Image Recorder ]
    14: TRM_AUDIO_NOPRE (06. le chanteur.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 17620 (17620) = #17620/3:54.70
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 17620 blocks [ Image Recorder ]
    15: TRM_AUDIO_NOPRE (07. si je suis fou.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 15675 (15675) = #15675/3:29.0
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15675 blocks [ Image Recorder ]
    16: TRM_AUDIO_NOPRE (08. oiseau de nuit.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 21609 (21609) = #21609/4:48.9
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 21609 blocks [ Image Recorder ]
    17: TRM_AUDIO_NOPRE (09. le pied par terre.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 17101 (17101) = #17101/3:48.1
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 17101 blocks [ Image Recorder ]
    --------------------------------------------------------------
    18: TRM_DATA_MODE2_FORM1_NOSUB (CTransferItem)
    2 indices, index0 (150) not provided
    original disc pos #0 + 600 (600) = #600/0:8.0
    relocatable, disc pos for caching/writing not required/required, no patch infos
    -> TRM_DATA_MODE2_FORM1_NOSUB, 2048, config 0, wanted index0 0 blocks, length 600 blocks [ Image Recorder ]
    --------------------------------------------------------------

    10:29:36 #13 Phase 40 File dlgbrnst.cpp, Line 1855
    Aborted by user

    10:29:36 #14 Text 0 File AudioCompilationImpl.cpp, Line 828
    DRM: DRM burn session terminated.

    10:29:36 #15 Text 0 File AudioCompilationImpl.cpp, Line 857
    DRM: Closing entire DRM handling. Bye.

    Existing drivers:
    File 'Drivers\CDRALW2K.SYS': Ver=8.0.0.212 , size=2560 bytes, created 05/10/2006 04:42:42
    File 'Drivers\ASPI32.SYS': Ver=4.71 (0002), size=16877 bytes, created 17/07/2002 11:53:02
    File 'Drivers\PXHELP20.SYS': Ver=3.00.41a, size=36560 bytes, created 27/09/2006 23:53:22 (Prassi/Veritas driver for win 2K)
    File 'Drivers\atapi.sys': Ver=?.?.?.?, size=95360 bytes, created 03/08/2004 23:59:44 (Adapter driver for src)

    Registry Keys:
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\AllocateCDROMs : 0 (Security Option)

    Merci de votre aide
    0
  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. moK´s@ Messages postés 4410 Statut Membre 89
     
    je voulais voie un log hijack this...
    0
  7. missitalienne Messages postés 8 Statut Membre
     
    Boomscud
    Boomscud
    1A23-0025-8030-1583-4629-7773

    Windows XP 5.1
    IA32
    WinAspi: File 'Wnaspi32.dll': Ver=4.71 (0002), size=45056 bytes, created 17/07/2002 12:20:56
    ahead WinASPI: File 'C:\Program Files\Ahead\nero\Wnaspi32.dll': Ver=2.0.1.68, size=160016 bytes, created 22/07/2004 17:33:44
    Nero version: 6.3.1.20
    Recorder: < Image Recorder> Version: Not available - HA -1 TA 0 - 6.3.1.20
    Adapter driver: <Virtual Device> HA -1
    Drive buffer :
    CD-ROM: <CD-R/RW CW079D CD-R/RW >Version: 11SJ - HA 1 TA 1 - 6.3.1.20
    Adapter driver: <atapi> HA 1

    === Scsi-Device-Map ===
    DiskPeripheral : ExcelStor Technology J240 atapi Port 0 ID 0 DMA: On
    DiskPeripheral : ST38410A atapi Port 0 ID 1 DMA: On
    CdRomPeripheral : IDE DVD-ROM 16X atapi Port 1 ID 0 DMA: On
    CdRomPeripheral : CD-R/RW CW079D CD-R/RW atapi Port 1 ID 1 DMA: On

    === CDRom-Device-Map ===
    IDE DVD-ROM 16X D: CDRom0
    CD-R/RW CW079D CD-R/RW E: CDRom1
    =======================

    AutoRun : 1
    Excluded drive IDs:
    WriteBufferSize: 57671680 (0) Byte
    ShowDrvBufStat : 0
    BUFE : 0
    Physical memory : 383MB (392688kB)
    Free physical memory: 115MB (118480kB)
    Memory in use : 69 %
    Uncached PFiles: 0x0
    Use Static Write Speed Table: 0
    Use Inquiry : 1
    Global Bus Type: default (0)
    Check supported media : Disabled (0)

    27.4.2007
    CD EXTRA
    10:29:32 #1 Text 0 File Isodoc.cpp, Line 6065
    Iso document burn settings
    ------------------------------------------
    Determine maximum speed : FALSE
    Simulate : FALSE
    Write : TRUE
    Finalize CD : TRUE
    Multisession : FALSE
    Burning mode : TAO
    Mode : 2 / XA
    ISO Level : 1 (Max. of 11 = 8 + 3 char)
    Character set : ISO 9660
    Joliet : TRUE
    Allow pathdepth more than 8 directories : TRUE
    Allow more than 255 characters in path : TRUE
    Write ISO9660 ;1 file extensions : TRUE

    10:29:32 #2 CDADOC -1 File Cdadoc.cpp, Line 1508
    Audio item log info:
    Audio document burn settings:
    =============================
    Burn mode: TAO,
    CD Text: Off,
    Cache disk or network files: Yes,
    Cache small files: Yes,
    Cache files smaller than 65536 bytes.
    Audio Multisession: No
    List of audio tracks:
    =====================
    Track 01: Length: 04:11.18, Pause frames: 150, Filters: 0, Name: '01. aimer est plus fort que d'être aimé.mp3'.
    Track 02: Length: 05:06.44, Pause frames: 150, Filters: 0, Name: '02. tous les cris les SOS.mp3'.
    Track 03: Length: 04:21.69, Pause frames: 150, Filters: 0, Name: '03. l'aziza.mp3'.
    Track 04: Length: 03:36.10, Pause frames: 150, Filters: 0, Name: '04. le blues est blanc.mp3'.
    Track 05: Length: 04:24.48, Pause frames: 150, Filters: 0, Name: '05. sauver l'amour.mp3'.
    Track 06: Length: 04:45.29, Pause frames: 150, Filters: 0, Name: '06. petite Angèle.mp3'.
    Track 07: Length: 04:58.51, Pause frames: 150, Filters: 0, Name: '07. petit homme mort au combat.mp3'.
    Track 08: Length: 04:34.68, Pause frames: 150, Filters: 0, Name: '08. ne parle pas de malheur.mp3'.
    Track 09: Length: 05:52.27, Pause frames: 150, Filters: 0, Name: '09. un enfant assis attend la pluie.mp3'.
    Track 10: Length: 03:46.38, Pause frames: 150, Filters: 0, Name: '01. les oiseaux (1ère partie).mp3'.
    Track 11: Length: 03:32.41, Pause frames: 150, Filters: 0, Name: '02. les oiseaux (2ème partie).mp3'.
    Track 12: Length: 03:20.58, Pause frames: 150, Filters: 0, Name: '03. France.mp3'.
    Track 13: Length: 03:05.03, Pause frames: 150, Filters: 0, Name: '04. c'est un voyou.mp3'.
    Track 14: Length: 05:27.15, Pause frames: 150, Filters: 0, Name: '05. Lucie.mp3'.
    Track 15: Length: 03:54.70, Pause frames: 150, Filters: 0, Name: '06. le chanteur.mp3'.
    Track 16: Length: 03:29.00, Pause frames: 150, Filters: 0, Name: '07. si je suis fou.mp3'.
    Track 17: Length: 04:48.09, Pause frames: 150, Filters: 0, Name: '08. oiseau de nuit.mp3'.
    Track 18: Length: 03:48.01, Pause frames: 150, Filters: 0, Name: '09. le pied par terre.mp3'.
    Total size: 77:39.74

    10:29:32 #3 Phase 73 File dlgbrnst.cpp, Line 1855
    Preparing items

    10:29:32 #4 Text 0 File Reader.cpp, Line 126
    Reader running

    10:29:32 #5 Text 0 File AudioCompilationImpl.cpp, Line 817
    DRM: StartDrmRecording(RealRec:0, ImageRec:1, Copies:1)
    DRM: Beginning burn process.

    10:29:32 #6 ISO9660GEN -11 File geniso.cpp, Line 3899
    First writeable address = 0 (0x00000000)

    10:29:32 #7 Text 0 File Burncd.cpp, Line 3173
    Turn on Track-at-once, using CD-R/RW media

    10:29:32 #8 Text 0 File DlgWaitCD.cpp, Line 247
    Last possible write address on media: 2147483646 (477218:37.21)
    Last address to be written: 361348 ( 80:19.73)

    10:29:32 #9 Text 0 File DlgWaitCD.cpp, Line 259
    Write in overburning mode: NO (enabled: CD)

    10:29:32 #10 Text 0 File DlgWaitCD.cpp, Line 2162
    Recorder: Image Recorder;
    CD type reading failed
    ATIP Data: ?

    10:29:32 #11 Text 0 File DlgWaitCD.cpp, Line 420
    >>> Protocol of DlgWaitCD activities: <<<
    =========================================

    10:29:32 #12 Text 0 File ThreadedTransferInterface.cpp, Line 813
    Setup items (after recorder preparation)
    0: TRM_AUDIO_NOPRE (01. aimer est plus fort que d'être aimé.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 18843 (18843) = #18843/4:11.18
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 18843 blocks [ Image Recorder ]
    1: TRM_AUDIO_NOPRE (02. tous les cris les SOS.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 22994 (22994) = #22994/5:6.44
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 22994 blocks [ Image Recorder ]
    2: TRM_AUDIO_NOPRE (03. l'aziza.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 19644 (19644) = #19644/4:21.69
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 19644 blocks [ Image Recorder ]
    3: TRM_AUDIO_NOPRE (04. le blues est blanc.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 16210 (16210) = #16210/3:36.10
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 16210 blocks [ Image Recorder ]
    4: TRM_AUDIO_NOPRE (05. sauver l'amour.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 19848 (19848) = #19848/4:24.48
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 19848 blocks [ Image Recorder ]
    5: TRM_AUDIO_NOPRE (06. petite Angèle.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 21404 (21404) = #21404/4:45.29
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 21404 blocks [ Image Recorder ]
    6: TRM_AUDIO_NOPRE (07. petit homme mort au combat.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 22401 (22401) = #22401/4:58.51
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 22401 blocks [ Image Recorder ]
    7: TRM_AUDIO_NOPRE (08. ne parle pas de malheur.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 20618 (20618) = #20618/4:34.68
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 20618 blocks [ Image Recorder ]
    8: TRM_AUDIO_NOPRE (09. un enfant assis attend la pluie.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 26427 (26427) = #26427/5:52.27
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 26427 blocks [ Image Recorder ]
    9: TRM_AUDIO_NOPRE (01. les oiseaux (1ère partie).mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 16988 (16988) = #16988/3:46.38
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 16988 blocks [ Image Recorder ]
    10: TRM_AUDIO_NOPRE (02. les oiseaux (2ème partie).mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 15941 (15941) = #15941/3:32.41
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15941 blocks [ Image Recorder ]
    11: TRM_AUDIO_NOPRE (03. France.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 15058 (15058) = #15058/3:20.58
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15058 blocks [ Image Recorder ]
    12: TRM_AUDIO_NOPRE (04. c'est un voyou.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 13878 (13878) = #13878/3:5.3
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 13878 blocks [ Image Recorder ]
    13: TRM_AUDIO_NOPRE (05. Lucie.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 24540 (24540) = #24540/5:27.15
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 24540 blocks [ Image Recorder ]
    14: TRM_AUDIO_NOPRE (06. le chanteur.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 17620 (17620) = #17620/3:54.70
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 17620 blocks [ Image Recorder ]
    15: TRM_AUDIO_NOPRE (07. si je suis fou.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 15675 (15675) = #15675/3:29.0
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 15675 blocks [ Image Recorder ]
    16: TRM_AUDIO_NOPRE (08. oiseau de nuit.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 21609 (21609) = #21609/4:48.9
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 21609 blocks [ Image Recorder ]
    17: TRM_AUDIO_NOPRE (09. le pied par terre.mp3)
    2 indices, index0 (150) not provided
    original disc pos #0 + 17101 (17101) = #17101/3:48.1
    relocatable, disc pos for caching/writing not required/not required, no patch infos
    -> TRM_AUDIO_NOPRE, 2352, config 0, wanted index0 0 blocks, length 17101 blocks [ Image Recorder ]
    --------------------------------------------------------------
    18: TRM_DATA_MODE2_FORM1_NOSUB (CTransferItem)
    2 indices, index0 (150) not provided
    original disc pos #0 + 600 (600) = #600/0:8.0
    relocatable, disc pos for caching/writing not required/required, no patch infos
    -> TRM_DATA_MODE2_FORM1_NOSUB, 2048, config 0, wanted index0 0 blocks, length 600 blocks [ Image Recorder ]
    --------------------------------------------------------------

    10:29:36 #13 Phase 40 File dlgbrnst.cpp, Line 1855
    Aborted by user

    10:29:36 #14 Text 0 File AudioCompilationImpl.cpp, Line 828
    DRM: DRM burn session terminated.

    10:29:36 #15 Text 0 File AudioCompilationImpl.cpp, Line 857
    DRM: Closing entire DRM handling. Bye.

    Existing drivers:
    File 'Drivers\CDRALW2K.SYS': Ver=8.0.0.212 , size=2560 bytes, created 05/10/2006 04:42:42
    File 'Drivers\ASPI32.SYS': Ver=4.71 (0002), size=16877 bytes, created 17/07/2002 11:53:02
    File 'Drivers\PXHELP20.SYS': Ver=3.00.41a, size=36560 bytes, created 27/09/2006 23:53:22 (Prassi/Veritas driver for win 2K)
    File 'Drivers\atapi.sys': Ver=?.?.?.?, size=95360 bytes, created 03/08/2004 23:59:44 (Adapter driver for src)

    Registry Keys:
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\AllocateCDROMs : 0 (Security Option)
    0
  8. moK´s@ Messages postés 4410 Statut Membre 89
     
    bon on va pas etre copain a la fin :

    * Télécharge HijackThis et poste le rapport stp

    http://pchelpbordeaux.free.fr/logiciels.html
    Tutorial
    http://pchelpbordeaux.free.fr/tuto.html
    Démo en image
    http://pageperso.aol.fr/balltrap34/demohijack.htm
    0
  9. missitalienne Messages postés 8 Statut Membre
     
    Désolé et merci de ton aide mais j'ai du mal avec ma souris....
    Voici le bon rapport J'ESPERE
    Slts

    ComboFix 07-08-17.2 - "Administrateur" 2007-08-18 12:19:47.2 - NTFSx86
    Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.88 [GMT 2:00]

    ((((((((((((((((((((((((( Files Created from 2007-07-18 to 2007-08-18 )))))))))))))))))))))))))))))))

    2007-08-18 12:09 51,200 --a------ C:\WINDOWS\nircmd.exe
    2007-08-18 11:53 <REP> d-------- C:\WINDOWS\system32\Panda Software
    2007-08-18 11:53 <REP> d-------- C:\WINDOWS\LastGood
    2007-08-17 21:59 <REP> d-------- C:\WINDOWS\system32\NtmsData
    2007-08-17 20:51 <REP> d--h----- C:\WINDOWS\system32\GroupPolicy
    2007-08-12 13:10 19,793 --a------ C:\WINDOWS\cc_20070812_1310.reg

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-08-16 19:26 --------- d-------- C:\Program Files\Fichiers communs\AOL
    2007-08-12 23:03 --------- d-------- C:\Program Files\AOL 9.0
    2007-08-12 16:04 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\AdobeUM
    2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe
    2007-07-28 00:02 94416 --a--c--- C:\WINDOWS\system32\drivers\aswmon2.sys
    2007-07-28 00:02 92848 --a--c--- C:\WINDOWS\system32\drivers\aswmon.sys
    2007-07-28 00:00 23152 --a--c--- C:\WINDOWS\system32\drivers\aswRdr.sys
    2007-07-27 23:59 42912 --a--c--- C:\WINDOWS\system32\drivers\aswTdi.sys
    2007-07-27 23:58 26624 --a--c--- C:\WINDOWS\system32\drivers\aavmker4.sys
    2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AVASTSS.scr
    2007-06-21 12:01 103720 --a------ C:\WINDOWS\system32\AOLDial.dll

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF4DA5D4-805B-9066-3918-A21B9B156B2A}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMan"="soundman.exe" [2002-03-22 19:48 C:\WINDOWS\soundman.exe]
    "HostManager"="C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe" [2006-11-17 15:16]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2005-06-14 18:05]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^AOL 9.0 Icône AOL.lnk]
    path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\AOL 9.0 Icône AOL.lnk
    backup=C:\WINDOWS\pss\AOL 9.0 Icône AOL.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^AOL Compagnon.lnk]
    path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\AOL Compagnon.lnk
    backup=C:\WINDOWS\pss\AOL Compagnon.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
    C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
    "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapFax]
    C:\Program Files\Classic PhoneTools\CapFax.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
    "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odebit Multimedia V3]
    C:\Program Files\Odebit Multimédia\V3\Odebit.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odebit Multimedia V3 - Services]
    C:\Program Files\Odebit Multimédia\V3\Odebit.exe /info

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    "C:\Program Files\QuickTime\qttask.exe" -atboottime

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]
    "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
    C:\Program Files\Winamp\winampa.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "TapiSrv"=3 (0x3)
    "BthServ"=2 (0x2)
    "avast! Web Scanner"=3 (0x3)
    "avast! Mail Scanner"=3 (0x3)
    "avast! Antivirus"=2 (0x2)

    R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS
    R3 alcan5ln;SpeedTouch(tm) USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys
    S3 AN983;Carte Fast Ethernet 10/100 Mbps ADMtek AN983/AN985/ADM951X;C:\WINDOWS\system32\DRIVERS\AN983.sys
    S3 Aox402Camera;SE402 Video Camera (WDM);C:\WINDOWS\system32\DRIVERS\se402vc.sys
    S3 driverhardwarev2;driverhardwarev2;\??\C:\Program Files\HardwareDetection\driverhardwarev2.sys
    S3 MR97310_USB_DUAL_CAMERA;XDC-Series;C:\WINDOWS\system32\DRIVERS\mr97310c.sys
    S3 SE402RefCameraStill;SE402 Still Camera (WDM);C:\WINDOWS\system32\DRIVERS\se402sc.sys

    *Newly Created Service* - CATCHME
    *Newly Created Service* - RKPAVPROC

    Contents of the 'Scheduled Tasks' folder
    2007-08-18 09:24:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE

    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-08-18 12:20:26
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-08-18 12:21:06
    C:\ComboFix-quarantined-files.txt ... 2007-08-18 12:20
    C:\ComboFix2.txt ... 2007-08-18 12:11

    --- E O F ---
    0
  10. moK´s@ Messages postés 4410 Statut Membre 89
     
    apparament tu as du mal la c´est un combo fix que tu m´a pondu

    click sur mon lien du post 8 et post le rapport...
    0
  11. missitalienne Messages postés 8 Statut Membre
     
    Logfile of HijackThis v1.99.1
    Scan saved at 13:37, on 18/08/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\soundman.exe
    C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    c:\program files\fichiers communs\aol\1166697745\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
    c:\program files\fichiers communs\aol\1166697745\ee\aolsoftware.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\AOL 9.0\waol.exe
    C:\Program Files\AOL 9.0\shellmon.exe
    C:\Program Files\Fichiers communs\Aol\aoltpspd.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {AF4DA5D4-805B-9066-3918-A21B9B156B2A} - (no file)
    O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
    O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O3 - Toolbar: (no name) - {e0e899ab-f487-11d5-8d29-0050ba6940e3} - (no file)
    O4 - HKLM\..\Run: [SoundMan] soundman.exe
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
    O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - http://by104fd.bay104.hotmail.msn.com/activex/HMAtchmt.ocx
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer = 205.188.146.145
    O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    0
  12. moK´s@ Messages postés 4410 Statut Membre 89
     
    fais ceci :

    ¤ Télécharge Clean
    ----> http://www.malekal.com/download/clean.zip

    Dézippe tout le contenu dans le même dossier. Double clic sur clean ou clean.cmd choisissez l'option 1.
    Un rapport va s'ouvrir, copie et colle le contenu ici
    0
  13. missitalienne Messages postés 8 Statut Membre
     
    18/08/2007 a 13:55:23,86

    *** Recherche des fichiers dans C:

    *** Recherche des fichiers dans C:\WINDOWS\

    *** Recherche des fichiers dans C:\WINDOWS\system32

    *** Recherche des fichiers dans C:\Program Files
    "C:\Program Files\Viewpoint\" FOUND
    *** Fin du rapport !
    0
  14. moK´s@ Messages postés 4410 Statut Membre 89
     
    re,

    ¤Démarre en mode sans échec :
    Pour cela, tu tapote la touche F8 des le début de l allumage du pc sans t arrêter
    Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
    Une fois sur le bureau si il n y a pas toutes les couleurs et autres c est normal !
    (Si F8 ne marche pas utilise la touche F5)

    Puis ouvre le dossier clean et ouvre clean.cmd et choisis l'option 2.
    Redémarre normalement et poste le log clean.
    0
  15. missitalienne
     
    Script execute en mode sans echec
    Rapport clean par Malekal_morte - http://www.malekal.com
    Script execute en mode sans echec 21/08/2007 a 20:24:46,95

    Microsoft Windows XP [version 5.1.2600]

    *** Suppression des fichiers dans C:

    *** Suppression des fichiers dans C:\WINDOWS\

    *** Suppression des fichiers dans C:\WINDOWS\system32

    *** Suppression des fichiers dans C:\Program Files
    tentative de suppression de "C:\Program Files\Viewpoint\"

    *** Suppression des clefs du registre effectuee..
    *** Fin du rapport !
    0
  16. missitalienne
     
    Désolée j'ai oublié de vous saluer avant tout.
    Voici le rapport en mode sans echec que vous m'aviez demandé en date du samedi 18 août, encore un grand merci pour votre aide.

    Script execute en mode sans echec
    Rapport clean par Malekal_morte - http://www.malekal.com
    Script execute en mode sans echec 21/08/2007 a 20:24:46,95

    Microsoft Windows XP [version 5.1.2600]

    *** Suppression des fichiers dans C:

    *** Suppression des fichiers dans C:\WINDOWS\

    *** Suppression des fichiers dans C:\WINDOWS\system32

    *** Suppression des fichiers dans C:\Program Files
    tentative de suppression de "C:\Program Files\Viewpoint\"

    *** Suppression des clefs du registre effectuee..
    *** Fin du rapport !
    0
  17. moK´s@ Messages postés 4410 Statut Membre 89
     
    salut missitalienne,

    télécharges smitfraudfix :

    En image :
    http://siri.urz.free.fr/Fix/SmitfraudFix.php

    tu doubles cliques sur smitfraudfix.cmd et tu choisi l option 1
    cela vas générer un rapport.

    Copie/colle le rapport sur le forum stp.

    @+
    0
    1. missitalienne
       
      Voici le rapport que vous m'avez demandé.
      Merci.

      SmitFraudFix v2.214

      Rapport fait à 21:36:53,14, 21/08/2007
      Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
      Le type du système de fichiers est NTFS
      Fix executé en mode normal

      »»»»»»»»»»»»»»»»»»»»»»»» Process

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
      C:\WINDOWS\wanmpsvc.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\soundman.exe
      C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\AOL 9.0 VR\waol.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wuauclt.exe
      c:\program files\fichiers communs\aol\1166697745\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
      c:\program files\fichiers communs\aol\1166697745\ee\aolsoftware.exe
      C:\Program Files\AOL 9.0 VR\shellmon.exe
      C:\Program Files\Fichiers communs\AOL\Topspeed\3.0\aoltpsd3.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      c:\program files\aol\aol toolbar 4.0\AolTbServer.exe
      C:\WINDOWS\system32\cmd.exe

      »»»»»»»»»»»»»»»»»»»»»»»» hosts


      »»»»»»»»»»»»»»»»»»»»»»»» C:\


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur\Application Data


      »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Favoris


      »»»»»»»»»»»»»»»»»»»»»»»» Bureau


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


      »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


      »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
      "Source"="About:Home"
      "SubscribedURL"="About:Home"
      "FriendlyName"="Ma page d'accueil"


      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll


      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
      "AppInit_DLLs"=""


      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
      "System"=""


      »»»»»»»»»»»»»»»»»»»»»»»» Rustock



      »»»»»»»»»»»»»»»»»»»»»»»» DNS

      Description: WAN (PPP/SLIP) Interface
      DNS Server Search Order: 205.188.146.145

      Description: SpeedTouch(tm) USB ADSL RFC1483 - Miniport d'ordonnancement de paquets
      DNS Server Search Order: 192.168.1.1

      Description: SpeedTouch(tm) USB ADSL RFC1483 - Miniport d'ordonnancement de paquets
      DNS Server Search Order: 10.0.0.138

      HKLM\SYSTEM\CCS\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CCS\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
      HKLM\SYSTEM\CCS\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer=205.188.146.145
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer=205.188.146.145
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
      HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138


      »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


      »»»»»»»»»»»»»»»»»»»»»»»» Fin
      0
    2. missitalienne
       
      Voici le rapport avec un peu de mal désolée et merci pour l'aide.

      SmitFraudFix v2.214

      Rapport fait à 21:36:53,14, 21/08/2007
      Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
      Le type du système de fichiers est NTFS
      Fix executé en mode normal

      »»»»»»»»»»»»»»»»»»»»»»»» Process

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
      C:\WINDOWS\wanmpsvc.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\soundman.exe
      C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\AOL 9.0 VR\waol.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wuauclt.exe
      c:\program files\fichiers communs\aol\1166697745\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
      c:\program files\fichiers communs\aol\1166697745\ee\aolsoftware.exe
      C:\Program Files\AOL 9.0 VR\shellmon.exe
      C:\Program Files\Fichiers communs\AOL\Topspeed\3.0\aoltpsd3.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      c:\program files\aol\aol toolbar 4.0\AolTbServer.exe
      C:\WINDOWS\system32\cmd.exe

      »»»»»»»»»»»»»»»»»»»»»»»» hosts


      »»»»»»»»»»»»»»»»»»»»»»»» C:\


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur\Application Data


      »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Favoris


      »»»»»»»»»»»»»»»»»»»»»»»» Bureau


      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


      »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


      »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
      "Source"="About:Home"
      "SubscribedURL"="About:Home"
      "FriendlyName"="Ma page d'accueil"


      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll


      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
      "AppInit_DLLs"=""


      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
      "System"=""


      »»»»»»»»»»»»»»»»»»»»»»»» Rustock



      »»»»»»»»»»»»»»»»»»»»»»»» DNS

      Description: WAN (PPP/SLIP) Interface
      DNS Server Search Order: 205.188.146.145

      Description: SpeedTouch(tm) USB ADSL RFC1483 - Miniport d'ordonnancement de paquets
      DNS Server Search Order: 192.168.1.1

      Description: SpeedTouch(tm) USB ADSL RFC1483 - Miniport d'ordonnancement de paquets
      DNS Server Search Order: 10.0.0.138

      HKLM\SYSTEM\CCS\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CCS\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
      HKLM\SYSTEM\CCS\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer=205.188.146.145
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer=205.188.146.145
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{0590B5B0-4949-4A4D-8A75-D31526EBA095}: DhcpNameServer=192.168.1.1
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{C122CB97-51F1-4C95-AC6C-C33BA3EE3915}: DhcpNameServer=10.0.0.138
      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
      HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138


      »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


      »»»»»»»»»»»»»»»»»»»»»»»» Fin
      0
  18. moK´s@ Messages postés 4410 Statut Membre 89
     
    ok

    peux tu poster un nouveau hijack this stp
    0
    1. missitalienne
       
      Voici le rapport, merci.

      Logfile of HijackThis v1.99.1
      Scan saved at 21:49, on 21/08/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
      C:\WINDOWS\wanmpsvc.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\soundman.exe
      C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\AOL 9.0 VR\waol.exe
      C:\WINDOWS\System32\svchost.exe
      c:\program files\fichiers communs\aol\1166697745\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
      c:\program files\fichiers communs\aol\1166697745\ee\aolsoftware.exe
      C:\Program Files\AOL 9.0 VR\shellmon.exe
      C:\Program Files\Fichiers communs\AOL\Topspeed\3.0\aoltpsd3.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      c:\program files\aol\aol toolbar 4.0\AolTbServer.exe
      C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
      O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
      O2 - BHO: (no name) - {AF4DA5D4-805B-9066-3918-A21B9B156B2A} - (no file)
      O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
      O3 - Toolbar: (no name) - {e0e899ab-f487-11d5-8d29-0050ba6940e3} - (no file)
      O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
      O4 - HKLM\..\Run: [SoundMan] soundman.exe
      O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1166697745\ee\AOLSoftware.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0 VR\AOL.EXE" -b
      O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0\resources\fr-FR\local\search.html
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
      O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
      O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
      O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - http://by104fd.bay104.hotmail.msn.com/activex/HMAtchmt.ocx
      O17 - HKLM\System\CCS\Services\Tcpip\..\{D3F0068D-338B-467B-A6D2-6D71CA41759B}: NameServer = 205.188.146.145
      O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
      O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
      O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
      O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
      O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
      O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
      0
  19. moK´s@ Messages postés 4410 Statut Membre 89
     
    re,

    a l´aide de hijack this coche ceci :

    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {AF4DA5D4-805B-9066-3918-A21B9B156B2A} - (no file)
    O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O3 - Toolbar: (no name) - {e0e899ab-f487-11d5-8d29-0050ba6940e3} - (no file)
    O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)

    quitte tes applications et fix les lignes ci dessus.

    * télécharge AVG Anti-Spyware (ewido)

    https://www.avg.com/en-ww/free-antivirus-download
    http://www.infos-du-net.com/telecharger/Ewido-Security-Suite,0301-734.html

    * tu l'installes

    * lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente
    si tu n'arrives pas à le mettre à jour prends ici les màj

    http://downloads.ewido.net/avgas-signatures-full-current.exe

    Sur la page "analyse":

    •- tu choisis d'abord l'onglet "paramètres".
    - sous « Comment réagir » clic sur « Actions recommandées » et dans le menu déroulant, choisir « Supprimer »

    Copie Et colle le rapport ici

    @+
    0
  20. missitalienne
     
    Bonjour, voici le rapport.

    AVG Anti-Spyware - Rapport d'analyse
    ---------------------------------------------------------

    + Créé à: 06:51 22/08/2007

    + Résultat de l'analyse:

    C:\Documents and Settings\Administrateur\Cookies\administrateur@2o7[2].txt -> TrackingCookie.2o7 : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@msnaccountservices.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@adtech[2].txt -> TrackingCookie.Adtech : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Local Settings\Temp\Cookies\administrateur@atdmt[1].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@bluestreak[2].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Local Settings\Temp\Cookies\administrateur@bluestreak[1].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Local Settings\Temp\Cookies\administrateur@doubleclick[2].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@ehg-telecomitalia.hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@revsci[2].txt -> TrackingCookie.Revsci : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@serving-sys[2].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@smartadserver[2].txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Local Settings\Temp\Cookies\administrateur@statcounter[2].txt -> TrackingCookie.Statcounter : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Local Settings\Temp\Cookies\administrateur@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@m.webtrends[2].txt -> TrackingCookie.Webtrends : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
    C:\Documents and Settings\Administrateur\Cookies\administrateur@zedo[1].txt -> TrackingCookie.Zedo : Aucune action entreprise.

    Fin du rapport
    0
  21. moK´s@ Messages postés 4410 Statut Membre 89
     
    salut missitalienne,

    tu as supprimé les tracking cookie?

    encore des soucis?

    @+
    0
  • 1
  • 2