Rapport hijack this
Bonjour voici mon rapport hijack this. quelqu un peut me dire ce que je dois faire svp?
Logfile of HijackThis v1.99.1
Scan saved at 21:56:14, on 16/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\NOTEPAD.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiMfd.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.icrfast.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\2.bin\S4BAR.DLL (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: IEHlprObj Class - {F62A47A7-4CA3-9D00-95A3-6724d43a9E8C} - LineAudio.dll (file missing)
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Piolet] C:\Program Files\Piolet\Piolet.exe SILENT
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ML1HelperStartUp] C:\PROGRA~1\MIDNIG~1\ML1HEL~1.EXE /partner ML1
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe
O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] C:\Program Files\Magic Waterfall Screensaver\MW1Helper.exe /partner MW1
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe /iconic
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [admin coal file htm] C:\Documents and Settings\All Users\Application Data\FLAP SHIM ADMIN COAL\managermulti.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\HPQ\XPXWWPP5\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Metaplan] C:\DOCUME~1\COMPAQ~1\APPLIC~1\SLOWSP~1\Multicopybias.exe
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2090b0a877714b659af5281268a6070c
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2090b0a877714b659af5281268a6070c
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} - http://acces.blonde.com/package/op/PackageHtmlCab.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
Logfile of HijackThis v1.99.1
Scan saved at 21:56:14, on 16/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\NOTEPAD.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiMfd.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.icrfast.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\2.bin\S4BAR.DLL (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: IEHlprObj Class - {F62A47A7-4CA3-9D00-95A3-6724d43a9E8C} - LineAudio.dll (file missing)
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Piolet] C:\Program Files\Piolet\Piolet.exe SILENT
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ML1HelperStartUp] C:\PROGRA~1\MIDNIG~1\ML1HEL~1.EXE /partner ML1
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe
O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] C:\Program Files\Magic Waterfall Screensaver\MW1Helper.exe /partner MW1
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe /iconic
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [admin coal file htm] C:\Documents and Settings\All Users\Application Data\FLAP SHIM ADMIN COAL\managermulti.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\HPQ\XPXWWPP5\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Metaplan] C:\DOCUME~1\COMPAQ~1\APPLIC~1\SLOWSP~1\Multicopybias.exe
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2090b0a877714b659af5281268a6070c
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2090b0a877714b659af5281268a6070c
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} - http://acces.blonde.com/package/op/PackageHtmlCab.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
Configuration: Windows XP Firefox 2.0.0.6
5 réponses
-
Contributeur sécuritébonsoir,
beaucoup de programmes au démarrage, ainsi qu'un einfection LOP
* Télécharge LopXPMH sur ton Bureau.
http://www.alt-shift-return.org/Info/Fichiers/lopxpMH2.zip
* Dézippe-le (clic droit >> Extraire ici) et double clique sur le fichier lopxpMH.bat.
* Poste le contenu du rapport qui va s'ouvrir.
-
voila le rapport.
Rapport lopxpMH2 version 2.0 fait à 22:23:15,64 le 16/09/2007
C:\Documents and Settings\Compaq_Propriétaire\Bureau\lopxpMH2\lopxpMH2
******************************************
## Répertoires Application Data
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\Documents and Settings\All Users\Application Data
25/11/2004 05:25 <REP> .
25/11/2004 05:25 <REP> ..
01/01/2005 08:37 <REP> Adobe
13/05/2005 16:36 <REP> AOL
16/07/2007 16:51 <REP> Apple
01/01/2005 08:39 <REP> Apple Computer
17/09/2005 21:21 <REP> DVD Shrink
27/07/2006 21:06 <REP> FLAP SHIM ADMIN COAL
22/11/2006 14:21 <REP> Google
01/01/2005 09:06 <REP> InstallShield
09/05/2005 21:49 <REP> Macrovision
18/06/2007 13:16 <REP> Messenger Plus!
25/11/2004 05:25 <REP> Microsoft
01/01/2005 08:44 <REP> Motive
05/10/2005 13:27 <REP> OD2
01/01/2005 08:39 <REP> QuickTime
01/01/2005 08:21 <REP> SBSI
01/05/2007 13:33 <REP> Softdisk LLC
01/01/2005 08:56 <REP> Symantec
22/03/2007 02:25 <REP> TEMP
27/12/2005 15:25 <REP> Windows Genuine Advantage
24/08/2006 13:00 <REP> Windows Live Toolbar
09/11/2005 21:57 <REP> Yahoo! Companion
24/11/2004 00:13 62 desktop.ini
07/07/2005 21:51 1 444 hpzinstall.log
23/11/2006 12:51 0 LauncherAccess.dt
24/11/2005 23:07 1 755 QTSBandwidthCache
4 fichier(s) 3 261 octets
23 Rép(s) 56 873 082 880 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\Documents and Settings\Compaq_Propriétaire\Application Data
30/06/2005 23:26 <REP> .
30/06/2005 23:26 <REP> ..
09/05/2005 20:44 <REP> Adobe
01/07/2005 13:19 <REP> AdobeUM
30/06/2005 23:26 <REP> Apple Computer
09/01/2007 20:54 <REP> Azureus
06/08/2006 20:27 <REP> BitTorrent
18/03/2007 17:39 <REP> ConvertTemp
21/01/2006 16:11 <REP> Creative
11/11/2006 15:35 <REP> DivX
22/01/2007 23:24 <REP> FrostWire
25/09/2005 13:40 <REP> Google
13/05/2005 16:38 <REP> Help
09/07/2005 01:32 <REP> Hewlett-Packard
30/06/2005 23:26 <REP> Identities
10/06/2005 19:00 <REP> InterVideo
20/07/2005 22:04 <REP> Lavasoft
31/08/2005 19:31 <REP> Leadertech
09/05/2005 22:27 <REP> Macromedia
30/06/2005 23:26 <REP> Microsoft
10/05/2005 21:26 <REP> Motive
07/08/2006 00:21 <REP> Mozilla
13/06/2005 19:30 <REP> MSNInstaller
05/10/2005 13:38 <REP> OD2
28/08/2007 01:21 <REP> Real
30/06/2005 23:26 <REP> SampleView
13/07/2006 12:57 <REP> Samsung
15/03/2007 21:14 <REP> Screenshot Sender
11/02/2006 00:29 <REP> ShopperReports
28/06/2007 22:29 <REP> slow spam ping
27/12/2005 16:23 <REP> SoftPerfect Personal Firewall
31/08/2005 19:31 <REP> Sonic
30/06/2005 23:26 <REP> Sun
30/06/2005 23:26 <REP> Symantec
10/05/2005 21:54 <REP> Template
18/03/2007 17:39 <REP> Temporary
18/03/2007 17:39 <REP> TransRender
18/10/2005 16:45 <REP> vlc
24/08/2006 21:20 <REP> WholeSecurity
13/05/2005 16:37 <REP> You've Got Pictures Screensaver
30/06/2005 23:26 62 desktop.ini
10/05/2005 21:54 3 070 wklnhst.dat
2 fichier(s) 3 132 octets
40 Rép(s) 56 873 086 976 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application Data
30/06/2005 23:26 <REP> .
30/06/2005 23:26 <REP> ..
30/06/2005 23:26 <REP> {7148F0A6-6813-11D6-A77B-00B0D0142030}
01/07/2005 13:19 <REP> Adobe
21/09/2005 22:58 <REP> Ahead
16/07/2007 16:51 <REP> Apple
30/06/2005 23:26 <REP> Apple Computer
30/06/2005 23:26 <REP> ApplicationHistory
27/12/2005 17:22 <REP> Google
13/05/2005 16:38 <REP> Help
28/05/2005 16:14 <REP> Identities
30/06/2005 23:26 <REP> Microsoft
10/10/2005 14:44 <REP> MicroVision Applications
07/08/2006 00:21 <REP> Mozilla
03/09/2006 14:36 <REP> OD2
20/09/2005 21:41 <REP> Shareaza
09/05/2005 22:33 <REP> WMTools Downloaded Files
30/05/2005 13:46 100 864 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
30/06/2005 23:26 142 fusioncache.dat
10/05/2005 19:51 40 544 GDIPFONTCACHEV1.DAT
28/08/2007 02:31 3 721 588 IconCache.db
4 fichier(s) 3 863 138 octets
17 Rép(s) 56 873 082 880 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\Documents and Settings\Default User\Application Data
25/11/2004 05:25 <REP> .
25/11/2004 05:25 <REP> ..
09/05/2005 19:31 <REP> Apple Computer
25/11/2004 05:25 <REP> Identities
25/11/2004 05:25 <REP> Microsoft
09/05/2005 19:31 <REP> SampleView
09/05/2005 19:31 <REP> Sun
09/05/2005 19:31 <REP> Symantec
24/11/2004 00:13 62 desktop.ini
1 fichier(s) 62 octets
8 Rép(s) 56 873 082 880 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\Documents and Settings\Default User\Local Settings\Application Data
25/11/2004 05:25 <REP> .
25/11/2004 05:25 <REP> ..
09/05/2005 19:31 <REP> {7148F0A6-6813-11D6-A77B-00B0D0142030}
09/05/2005 19:31 <REP> Apple Computer
09/05/2005 19:31 <REP> ApplicationHistory
25/11/2004 05:25 <REP> Microsoft
09/05/2005 19:31 135 fusioncache.dat
09/05/2005 19:31 0 IconCache.db
2 fichier(s) 135 octets
6 Rép(s) 56 873 082 880 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\Documents and Settings\LocalService\Application Data
01/01/2005 08:15 <REP> .
01/01/2005 08:15 <REP> ..
01/01/2005 08:15 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 56 873 082 880 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\Documents and Settings\LocalService\Local Settings\Application Data
01/01/2005 08:15 <REP> .
01/01/2005 08:15 <REP> ..
01/01/2005 08:15 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 56 873 082 880 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\Documents and Settings\NetworkService\Application Data
01/01/2005 08:15 <REP> .
01/01/2005 08:15 <REP> ..
01/01/2005 08:15 <REP> Microsoft
21/07/2005 21:23 <REP> Symantec
0 fichier(s) 0 octets
4 Rép(s) 56 873 082 880 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\Documents and Settings\NetworkService\Local Settings\Application Data
01/01/2005 08:15 <REP> .
01/01/2005 08:15 <REP> ..
01/01/2005 08:15 <REP> Microsoft
16/08/2006 12:22 <REP> PCHealth
0 fichier(s) 0 octets
4 Rép(s) 56 873 078 784 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\WINDOWS\system32\config\systemprofile\Application Data
25/11/2004 05:58 <REP> .
25/11/2004 05:58 <REP> ..
30/06/2005 23:26 <REP> Apple Computer
25/11/2004 05:58 <REP> Identities
25/11/2004 05:58 <REP> Microsoft
30/06/2005 23:26 <REP> SampleView
30/06/2005 23:26 <REP> Sun
30/06/2005 23:26 <REP> Symantec
24/11/2004 00:13 62 desktop.ini
1 fichier(s) 62 octets
8 Rép(s) 56 873 078 784 octets libres
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data
25/11/2004 05:58 <REP> .
25/11/2004 05:58 <REP> ..
30/06/2005 23:26 <REP> {7148F0A6-6813-11D6-A77B-00B0D0142030}
30/06/2005 23:26 <REP> Apple Computer
30/06/2005 23:26 <REP> ApplicationHistory
25/11/2004 05:58 <REP> Microsoft
30/06/2005 23:26 135 fusioncache.dat
30/06/2005 23:26 0 IconCache.db
2 fichier(s) 135 octets
6 Rép(s) 56 873 078 784 octets libres
******************************************
Recherche des taches planifiées dans C:\WINDOWS\tasks
C:\WINDOWS\Tasks\Norton
Norton inexploitable
******************************************
## Répertoires de C:\Program Files
Le volume dans le lecteur C s'appelle PRESARIO
Le numéro de série du volume est D437-D1E5
Répertoire de C:\Program Files
16/09/2007 21:55 <REP> .
16/09/2007 21:55 <REP> ..
20/09/2005 21:20 <REP> A.S.C
11/06/2007 21:28 <REP> Adobe
06/02/2007 18:21 <REP> Ahead
16/11/2005 19:23 <REP> Anuman Interactive
16/07/2007 16:51 <REP> Apple Software Update
01/01/2005 09:04 <REP> ATI Technologies
01/01/2006 22:02 <REP> Axialis
30/01/2007 03:54 <REP> Azureus
26/08/2006 17:51 <REP> BitComet
17/07/2006 01:15 <REP> CDBurnerXP Pro 3
01/05/2007 13:46 <REP> Common Files
24/11/2004 03:37 <REP> ComPlus Applications
21/01/2006 16:09 <REP> Creative
21/05/2006 21:49 <REP> DIFX
30/01/2007 19:04 <REP> DivX
14/08/2006 12:34 <REP> Easy Internet signup
28/06/2005 21:44 <REP> Easy Messenger
18/11/2006 16:52 <REP> eBay
30/04/2007 01:27 <REP> eChanblard
06/02/2007 18:12 <REP> Elaborate Bytes
16/09/2007 13:16 <REP> eMule
10/01/2006 03:37 <REP> Eracha
28/08/2007 01:23 <REP> Fichiers communs
30/06/2005 23:41 <REP> Free.fr
28/01/2007 15:00 <REP> Google
01/01/2005 08:44 <REP> Help and Support Additions
07/07/2005 21:56 <REP> Hewlett-Packard
16/09/2007 21:56 <REP> Hijackthis Version Française
05/03/2006 00:09 <REP> InterActual
15/08/2007 22:04 <REP> Internet Explorer
27/10/2006 12:40 <REP> InterVideo
22/07/2007 13:50 <REP> Java
02/12/2005 22:19 <REP> KraiSoft
13/05/2005 16:37 <REP> Learn2.com
01/01/2005 09:06 <REP> Macrovision Corp
27/12/2005 15:53 <REP> Messenger
17/06/2007 15:25 <REP> Messenger Plus! Live
16/04/2006 19:02 <REP> MessengerPlus! 3
16/11/2005 20:48 <REP> Micro Application
09/05/2007 12:39 <REP> Microsoft CAPICOM 2.1.0.2
25/11/2004 05:27 <REP> microsoft frontpage
10/05/2005 21:51 <REP> Microsoft Office
02/10/2005 13:23 <REP> Microsoft Works
25/11/2004 05:27 <REP> Movie Maker
29/08/2007 12:57 <REP> Mozilla Firefox
25/11/2004 05:27 <REP> MSN
25/02/2006 21:49 <REP> MSN Apps
25/11/2004 05:27 <REP> MSN Gaming Zone
17/06/2007 15:13 <REP> MSN Messenger
15/08/2007 21:52 <REP> MSXML 4.0
07/11/2005 20:11 <REP> Music Manager
13/06/2005 21:52 <REP> MySearch
16/09/2007 21:50 <REP> Navilog1
01/07/2005 07:13 <REP> NetMeeting
09/08/2007 17:53 <REP> Norton AntiVirus
25/11/2004 05:27 <REP> Online Services
13/06/2007 17:13 <REP> Outlook Express
02/10/2005 13:23 <REP> PC-Doctor for Windows
06/06/2006 20:08 <REP> Pochette Express 2
16/07/2007 16:52 <REP> QuickTime
28/08/2007 01:22 <REP> Real
02/12/2005 22:36 <REP> ReflexiveArcade
16/06/2007 22:52 <REP> Ricochet Xtreme
16/03/2006 17:41 <REP> Saitek
23/11/2006 15:34 <REP> Samsung
30/12/2005 21:13 <REP> Services en ligne
04/02/2007 00:04 <REP> SLD Codec Pack
15/03/2007 21:14 <REP> slow spam ping
10/07/2006 13:32 <REP> SlySoft
16/03/2007 02:18 <REP> solarus
01/01/2005 08:35 <REP> Sonic
01/01/2005 08:36 <REP> Sonic RecordNow!
09/08/2007 17:49 <REP> Symantec
24/11/2004 03:37 <REP> Uninstall Information
05/08/2007 19:10 <REP> VideoLAN
04/10/2006 13:48 <REP> VirginMega
21/02/2006 04:50 <REP> Winamp
17/06/2007 15:25 <REP> Windows Live
31/05/2007 21:34 <REP> Windows Live Toolbar
21/01/2006 16:09 <REP> Windows Media Components
17/02/2007 14:15 <REP> Windows Media Connect 2
17/02/2007 14:19 <REP> Windows Media Player
01/07/2005 07:13 <REP> Windows NT
25/11/2004 05:28 <REP> xerox
18/04/2007 22:39 <REP> Yahoo!
0 fichier(s) 0 octets
87 Rép(s) 56 873 074 688 octets libres
******************************************
## Popups autorisées
* Internet Explorer
! REG.EXE VERSION 3.0
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow
*.OD2.COM REG_SZ 0
imp8-g19.free.fr REG_BINARY
imp1-g19.free.fr REG_BINARY
*.ems6.net REG_BINARY
search1-2.free.fr REG_BINARY
www.1001reductions.com REG_BINARY
secure.yves-rocher.fr REG_BINARY
imp3-g19.free.fr REG_BINARY
my.ebay.fr REG_BINARY
www.clubic.com REG_BINARY
216.109.124.98 REG_BINARY
*.hotmail.msn.com REG_BINARY
www.caf.fr REG_BINARY
monprofil.sfr.fr REG_BINARY
imp5-g19.free.fr REG_BINARY
www.hitcv.com REG_BINARY
www.poolbreizh.com REG_BINARY
www.bodybloom.com REG_BINARY
update.microsoft.com REG_BINARY
www.agences-immobilieres.com REG_BINARY
perso.orange.fr REG_BINARY
www.anpe.fr REG_BINARY
www.triforce-legend.com REG_BINARY
*.mail.live.com REG_BINARY
jeuconcours2006.aliceadsl.fr REG_BINARY
www.funradio.fr REG_BINARY
www.nrj.fr REG_BINARY
www.fan-prisonbreak.com REG_BINARY
www.sfr.fr REG_BINARY
imp4-g19.free.fr REG_BINARY
www.jeuxvideo.com REG_BINARY
www.emalin.com REG_BINARY
tv-bt.jouteya.net REG_BINARY
www.supreme.fr REG_BINARY
www.videosdesexe.com REG_BINARY
www.ma-reduc.com REG_BINARY
www.gratte-moi.com REG_BINARY
www.emule-paradise.com REG_BINARY
noel.alapage.com REG_BINARY
www.priceminister.com REG_BINARY
www.conforama.fr REG_BINARY
www.prison-break.fr REG_BINARY
zelda.nintendo-europe.com REG_BINARY
www.kingoloto.com REG_BINARY
www.afebas.com REG_BINARY
cgi5.ebay.fr REG_BINARY
*.movies.yahoo.com REG_BINARY
www.tiffanys-pool.com REG_BINARY
www.sexymovies.be REG_BINARY
www.yves-rocher.fr REG_BINARY
imp7-g19.free.fr REG_BINARY
imp6-g19.free.fr REG_BINARY
www.01net.com REG_BINARY
www.easy-torrent.com REG_BINARY
www.bittovore.com REG_BINARY
www.topliste-fr.com REG_BINARY
www.big-annuaire.com REG_BINARY
www.torrent-divx-emule.com REG_BINARY
gratuit.hitclic.com REG_BINARY
novatorrent.ifrance.com REG_BINARY
www.divxtoplist.com REG_BINARY
lesmeilleurssitesweb.ifrance.com REG_BINARY
torrent.role-expert.com REG_BINARY
*.overnet.free.fr REG_BINARY
imp.free.fr REG_BINARY
www.torrent-avenue.com REG_BINARY
*.divx-fr.eu REG_BINARY
*.top-divx.org REG_BINARY
*.divxtorrents.net REG_BINARY
dbzmania.over-blog.net REG_BINARY
www.ulimit.com REG_BINARY
*.manganosaints.free.fr REG_BINARY
www.emule-mania.com REG_BINARY
scaleo.fujitsu-siemens.com REG_BINARY
www.dailymotion.com REG_BINARY
www.credit-agricole.fr REG_BINARY
www.divx-films.com REG_BINARY
www.cap-divx.com REG_BINARY
www.root-top.com REG_BINARY
www.lunivers2dbgt.net REG_BINARY
adsl.free.fr REG_BINARY
www.extrait-videos-gratuit.com REG_BINARY
netbios-wait.com REG_SZ
www.netbios-wait.com REG_SZ
titefolledu24.skyblog.com REG_BINARY
www.laposte.com REG_BINARY
wideo.nouvellestar.fr REG_BINARY
www.aliceadsl.fr REG_BINARY
www.ca-charente-perigord.fr REG_BINARY
servicejeux.nrj.fr REG_BINARY
www.chartsinfrance.net REG_BINARY
www.toujoursplusfortquetoi.com REG_BINARY
www.otaku-attitude.net REG_BINARY
www.canalsat.fr REG_BINARY
www.bernard-dumas.fr REG_BINARY
www.missglad.com REG_BINARY
www.easymiss.com REG_BINARY
plus-belle-la-vie.france3.fr REG_BINARY
*.fr.atari.com REG_BINARY
chat.free.fr REG_BINARY
www.lebillardenimage.com REG_BINARY
*.play.yahoo.com REG_BINARY
www.adultoons.biz REG_BINARY
www.webdetente.com REG_BINARY
www.films-divx.com REG_BINARY
www.fellations-gratuites.eu REG_BINARY
top-porno-gratuit.3x.fm REG_BINARY
www.xduvideos.com REG_BINARY
fr.wedoo.com REG_BINARY
www.lebest.fr REG_BINARY
www.telecharger-torrent.com REG_BINARY
www.torrentreactor.net REG_BINARY
ultimatetuning.free.fr REG_BINARY
annonces.turbo.fr REG_BINARY
wideo.turbo.fr REG_BINARY
www.groupama.fr REG_BINARY
www.torrent-divx.com REG_BINARY
vcheck.emule-project.net REG_BINARY
*.free.fr/horde/imp/view.php?thismailbox=INBOX&index=1213&id=3&actionID=113&mime=3a2baa380f62715e1c032ae823e895d0 REG_BINARY
search.free.fr REG_BINARY
*.lien-torrent.com REG_BINARY
www.hentaiglad.com REG_BINARY
www.allosponsor.com REG_BINARY
www.absolutecover.net REG_BINARY
www.covercomoz.com REG_BINARY
cnosphotos.free.fr REG_BINARY
topjaquettes.free.fr REG_BINARY
90plan.ovh.net REG_BINARY
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.od2.com
<SANS NOM> REG_SZ 0
* Mozilla Firefox (1 autorisé 2 interdit)
---------- C:\DOCUMENTS AND SETTINGS\COMPAQ_PROPRITAIRE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\HY72JLCE.DEFAULT\HOSTPERM.1
host popup 1 www.emule-paradise.com
host popup 1 www.zelda-crystals.tk
host popup 1 www.3suisses.fr
******************************************
## Registre
* [HKEY_CURRENT_USER\\Software\Microsoft\Internet Explorer\Main]
Search Bar REG_SZ http://www.bing.com/spresults.aspx
* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
admin coal file htm REG_SZ C:\Documents and Settings\All Users\Application Data\FLAP SHIM ADMIN COAL\managermulti.exe
* [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Metaplan REG_SZ C:\DOCUME~1\COMPAQ~1\APPLIC~1\SLOWSP~1\Multicopybias.exe
******************************************
## Zones de sécurité
* HKCU Domains (4)
* P3P History (5)
******************************************
## Recherche C:\WINDOWS\*.htm, "C:\WINDOWS\*.gif"
*************** Fin du rapport ****************
-
-
Bonsoir,
As-tu procédé a ces manip : virus methode preliminaire de desinfection version fr, avant de poster ce log hijack ? -
Contributeur sécuritébonsoir clownface,
en tous les cas, ca n'enlèvera pas LOP
-
Contributeur sécuritépas grave :)
-
Contributeur sécuritéil est certain que si tu visites des sites de ce style
www.videosdesexe.com
www.sexymovies.be
top-porno-gratuit.3x.fm
www.xduvideos.com
www.fellations-gratuites.eu
tu auras toujours des problèmes.....
rajoute à tes surfs les téléchargements via la mule, tu as la totale
