Pop up !!!!!!!!!!!
Résolu/Fermé
reason
Messages postés
41
Date d'inscription
mercredi 10 octobre 2007
Statut
Membre
Dernière intervention
26 février 2008
-
20 nov. 2007 à 20:39
zizou00 Messages postés 12 Date d'inscription mardi 20 novembre 2007 Statut Membre Dernière intervention 27 novembre 2007 - 22 nov. 2007 à 23:41
zizou00 Messages postés 12 Date d'inscription mardi 20 novembre 2007 Statut Membre Dernière intervention 27 novembre 2007 - 22 nov. 2007 à 23:41
A voir également:
- Pop up !!!!!!!!!!!
- Serveur pop - Guide
- Autoriser pop up firefox - Guide
- Pop up mcafee - Accueil - Piratage
- Up to box - Accueil - Guide services en ligne
- Sketch up - Télécharger - 3D
11 réponses
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
20 nov. 2007 à 20:43
20 nov. 2007 à 20:43
slt
ad aware a trouvé que des cokkies que tu peux virer
____________
Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).
Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)
Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)
ad aware a trouvé que des cokkies que tu peux virer
____________
Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).
Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)
Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
20 nov. 2007 à 20:56
20 nov. 2007 à 20:56
= Lance navilog1
= Cette fois-ci choisi l'option 2
= Navilog va faire le nettoyage.. patient jusqu'à ce qui soit marqué *** Nettoyage Termine le ..... ***
= Un rapport va être génrer sur ton C:\ qui sera en option 2
Note: le bureau disparaît
= colle le contenu du rapport de navilog (qui est en option2)
PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tape explorer et valide. Celà te fera apparaitre ton bureau.
___________________________
encore des problemes?
= Cette fois-ci choisi l'option 2
= Navilog va faire le nettoyage.. patient jusqu'à ce qui soit marqué *** Nettoyage Termine le ..... ***
= Un rapport va être génrer sur ton C:\ qui sera en option 2
Note: le bureau disparaît
= colle le contenu du rapport de navilog (qui est en option2)
PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tape explorer et valide. Celà te fera apparaitre ton bureau.
___________________________
encore des problemes?
reason
Messages postés
41
Date d'inscription
mercredi 10 octobre 2007
Statut
Membre
Dernière intervention
26 février 2008
3
20 nov. 2007 à 20:56
20 nov. 2007 à 20:56
voila le scan
merci
Search Navipromo version 3.3.6 commencé le 20/11/2007 à 20:53:29,74
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 14.11.2007 à 18h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
*** Recherche Programmes installés ***
*** Recherche dossiers dans C:\WINDOWS ***
*** Recherche dossiers dans C:\Program Files ***
C:\Program Files\WebMediaPlayer trouvé !
*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***
*** Recherche dossiers dans C:\Documents and Settings\reason\Application Data ***
*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDÉ~1\PROGRA~1 ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Aucun fichier trouvé dans :
- C:\WINDOWS\system32
- C:\DOCUME~1\REASON\LOCALS~1\APPLIC~1
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans C:\WINDOWS\system32 *
* Recherche dans C:\DOCUME~1\REASON\LOCALS~1\APPLIC~1 *
Fichiers trouvés :
vpsxktatx.exe trouvé !
vpsxktatx.dat trouvé !
vpsxktatx_nav.dat trouvé !
vpsxktatx_navps.dat trouvé !
*** Recherche fichiers ***
C:\WINDOWS\pack.epk trouvé !
C:\WINDOWS\system32\nvs2.inf trouvé !
*** Recherche clés spécifiques dans le Registre ***
HKEY_CURRENT_USER\Software\Lanconfig trouvé !
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche fichiers connus:
2)Recherche Heuristique :
C:\WINDOWS\system32\pwirjepkvu.dat trouvé !
C:\WINDOWS\system32\pwirjepkvu_nav.dat trouvé !
C:\DOCUME~1\REASON\LOCALS~1\APPLIC~1\vpsxktatx.dat trouvé !
C:\DOCUME~1\REASON\LOCALS~1\APPLIC~1\vpsxktatx_nav.dat trouvé !
3)Recherche Certificats :
Certificat Egroup trouvé !
*** Analyse terminée le 20/11/2007 à 20:54:52,94 ***
merci
Search Navipromo version 3.3.6 commencé le 20/11/2007 à 20:53:29,74
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 14.11.2007 à 18h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
*** Recherche Programmes installés ***
*** Recherche dossiers dans C:\WINDOWS ***
*** Recherche dossiers dans C:\Program Files ***
C:\Program Files\WebMediaPlayer trouvé !
*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***
*** Recherche dossiers dans C:\Documents and Settings\reason\Application Data ***
*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDÉ~1\PROGRA~1 ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Aucun fichier trouvé dans :
- C:\WINDOWS\system32
- C:\DOCUME~1\REASON\LOCALS~1\APPLIC~1
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans C:\WINDOWS\system32 *
* Recherche dans C:\DOCUME~1\REASON\LOCALS~1\APPLIC~1 *
Fichiers trouvés :
vpsxktatx.exe trouvé !
vpsxktatx.dat trouvé !
vpsxktatx_nav.dat trouvé !
vpsxktatx_navps.dat trouvé !
*** Recherche fichiers ***
C:\WINDOWS\pack.epk trouvé !
C:\WINDOWS\system32\nvs2.inf trouvé !
*** Recherche clés spécifiques dans le Registre ***
HKEY_CURRENT_USER\Software\Lanconfig trouvé !
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche fichiers connus:
2)Recherche Heuristique :
C:\WINDOWS\system32\pwirjepkvu.dat trouvé !
C:\WINDOWS\system32\pwirjepkvu_nav.dat trouvé !
C:\DOCUME~1\REASON\LOCALS~1\APPLIC~1\vpsxktatx.dat trouvé !
C:\DOCUME~1\REASON\LOCALS~1\APPLIC~1\vpsxktatx_nav.dat trouvé !
3)Recherche Certificats :
Certificat Egroup trouvé !
*** Analyse terminée le 20/11/2007 à 20:54:52,94 ***
reason
Messages postés
41
Date d'inscription
mercredi 10 octobre 2007
Statut
Membre
Dernière intervention
26 février 2008
3
20 nov. 2007 à 21:16
20 nov. 2007 à 21:16
j'ai suivi a la lettre les etapes indiqué par jlpjlp, que je remercei je confirme que j'ai plus de souci avec les pop up ! :)
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
21 nov. 2007 à 08:59
21 nov. 2007 à 08:59
ok
parfait tu peux desinstaller navilog
il faut toujours telecharger la derniere version
si tu as de nouveau pbs tu dis
a plus
parfait tu peux desinstaller navilog
il faut toujours telecharger la derniere version
si tu as de nouveau pbs tu dis
a plus
zizou00
Messages postés
12
Date d'inscription
mardi 20 novembre 2007
Statut
Membre
Dernière intervention
27 novembre 2007
22 nov. 2007 à 18:43
22 nov. 2007 à 18:43
bonjour,
voilà j'ai suivi toute les démarches décrites ci dessus le probleme n'est pas encore resolu voilà le rapport n°2 de navilog:
Clean Navipromo version 3.3.6 commencé le 22/11/2007 à 17:31:48,57
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 14.11.2007 à 18h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13
Mode suppression automatique
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
*** Suppression avec sauvegardes résultats GenericNaviSearch ***
* Suppression dans C:\WINDOWS\System32 *
* Suppression dans C:\DOCUME~1\HP_PRO~1\LOCALS~1\APPLIC~1 *
*** Suppression dossiers dans C:\WINDOWS ***
*** Suppression dossiers dans C:\Program Files ***
*** Suppression dossiers dans C:\Documents and Settings\All Users\Application Data ***
*** Suppression dossiers dans C:\Documents and Settings\HP_Propri‚taire\Application Data ***
*** Suppression dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***
*** Suppression fichiers ***
*** Suppression fichiers temporaires ***
Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp effectué !
*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche fichiers connus:
C:\WINDOWS\system32\ghkmp.bak2 trouvé ! infection Vundo possible non traitée par cet outil !
2)Recherche, création sauvegardes et suppression Heuristique :
*** Sauvegarde du Registre vers dossier Backupnavi ***
sauvegarde du Registre réalisé avec succès !
*** Nettoyage Registre ***
Nettoyage Registre Ok
*** Certificats ***
Certificat Egroup absent !
*** Fichiers suspects non supprimés par Navilog1 ***
!! Fichiers légitimes possibles, à contrôler avant suppression !!
*** Nettoyage terminé le 22/11/2007 à 17:35:40,25 ***
cependant ce que je n'ai pas compris c'est que le rapprt n°1 lorseque l'on le copie on le colle où? et merci de votre cooperation
voilà j'ai suivi toute les démarches décrites ci dessus le probleme n'est pas encore resolu voilà le rapport n°2 de navilog:
Clean Navipromo version 3.3.6 commencé le 22/11/2007 à 17:31:48,57
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 14.11.2007 à 18h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13
Mode suppression automatique
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
*** Suppression avec sauvegardes résultats GenericNaviSearch ***
* Suppression dans C:\WINDOWS\System32 *
* Suppression dans C:\DOCUME~1\HP_PRO~1\LOCALS~1\APPLIC~1 *
*** Suppression dossiers dans C:\WINDOWS ***
*** Suppression dossiers dans C:\Program Files ***
*** Suppression dossiers dans C:\Documents and Settings\All Users\Application Data ***
*** Suppression dossiers dans C:\Documents and Settings\HP_Propri‚taire\Application Data ***
*** Suppression dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***
*** Suppression fichiers ***
*** Suppression fichiers temporaires ***
Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\HP_Propri‚taire\Local Settings\Temp effectué !
*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche fichiers connus:
C:\WINDOWS\system32\ghkmp.bak2 trouvé ! infection Vundo possible non traitée par cet outil !
2)Recherche, création sauvegardes et suppression Heuristique :
*** Sauvegarde du Registre vers dossier Backupnavi ***
sauvegarde du Registre réalisé avec succès !
*** Nettoyage Registre ***
Nettoyage Registre Ok
*** Certificats ***
Certificat Egroup absent !
*** Fichiers suspects non supprimés par Navilog1 ***
!! Fichiers légitimes possibles, à contrôler avant suppression !!
*** Nettoyage terminé le 22/11/2007 à 17:35:40,25 ***
cependant ce que je n'ai pas compris c'est que le rapprt n°1 lorseque l'on le copie on le colle où? et merci de votre cooperation
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
22 nov. 2007 à 18:49
22 nov. 2007 à 18:49
ok tu as une infection vundo c'est pour cela que ca persiste:
________________
colle un rapport hijackthis
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
manuel :
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html
Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.
ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste
Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."
__________________________
scan avec vundofix (colle le rapport)
Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4
Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.
Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.
puis :
virtumondebegone (colle le rapport)
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
_________________________
colle le rapport d'un scan en ligne
avec un des suivants:
Panda en ligne : (désactive ton antivirus si il le considere comme suspect)
http://pandasoftware.fr
________________________
recolle ensuite un nouveau rapport hijackthis et dis tes soucis surtout!
________________
colle un rapport hijackthis
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
manuel :
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html
Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.
ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste
Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."
__________________________
scan avec vundofix (colle le rapport)
Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4
Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.
Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.
puis :
virtumondebegone (colle le rapport)
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
_________________________
colle le rapport d'un scan en ligne
avec un des suivants:
Panda en ligne : (désactive ton antivirus si il le considere comme suspect)
http://pandasoftware.fr
________________________
recolle ensuite un nouveau rapport hijackthis et dis tes soucis surtout!
zizou00
Messages postés
12
Date d'inscription
mardi 20 novembre 2007
Statut
Membre
Dernière intervention
27 novembre 2007
22 nov. 2007 à 19:29
22 nov. 2007 à 19:29
A jlpjlp voilà j'ai telechargé vundofix 6.5.4 le scan n'a pas trouvé de fichiers infecte j'ai telechargé virtmundbegone lorseque je l'ai executé mon ordinateur a redemarré et m'a donne un bloc note vous trouveriez ci joint une copie ainsi que le rapport de hijack this
hij:
ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:22:03, on 22/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\UMonit.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\keyhook.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Megatec\UPSilon 2000\RupsMon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Megatec\UPSilon 2000\Monw32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\BinarySense\HDDlife\HDDlifePro.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Megatec\UPSilon 2000\USBMate.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60327
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.menara.ma/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\ftcleokj.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\UMonit.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\UMonit2K.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: HDDlife.lnk = C:\Program Files\BinarySense\HDDlife\HDDlifePro.exe
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Rupsmon Daemon.lnk = ?
O4 - Global Startup: أوقات الصلاة.lnk = C:\HAD\PTW.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.coupdepoucepc.com/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://charon777.free.fr/plugins/hardwaredetection.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A669C16-DACF-4302-A677-613A820D3D1A}: NameServer = 212.217.0.14 196.217.246.210
O18 - Protocol: bw+0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw+0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw-0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw-0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw00 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw00s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw10 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw10s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw20 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw20s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw30 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw30s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw40 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw40s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw50 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw50s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw60 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw60s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw70 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw70s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw80 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw80s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw90 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw90s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwa0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwa0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwb0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwb0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwc0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwc0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwd0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwd0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwe0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwe0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwf0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwf0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - (no file)
O18 - Protocol: bwg0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwg0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwh0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwh0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwi0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwi0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwj0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwj0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwk0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwk0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwl0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwl0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwm0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwm0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwn0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwn0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwo0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwo0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwp0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwp0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwq0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwq0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwr0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwr0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bws0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bws0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwt0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwt0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwu0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwu0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwv0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwv0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bww0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bww0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwx0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwx0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwy0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwy0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwz0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwz0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: offline-8876480 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Rupsmon - Mega System Technologies, Inc. - C:\Program Files\Megatec\UPSilon 2000\RupsMon.exe
O23 - Service: USBMate - Mega Corp. - C:\Program Files\Megatec\UPSilon 2000\USBMate.exe
--et VBC:
1/22/2007, 18:13:05] - VirtumundoBeGone v1.5 ( "C:\Downloads\Software\VirtumundoBeGone.exe" )
[11/22/2007, 18:13:09] - Detected System Information:
[11/22/2007, 18:13:09] - Windows Version: 5.1.2600, Service Pack 2
[11/22/2007, 18:13:09] - Current Username: HP_Propriétaire (Admin)
[11/22/2007, 18:13:09] - Windows is in NORMAL mode.
[11/22/2007, 18:13:09] - Searching for Browser Helper Objects:
[11/22/2007, 18:13:09] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[11/22/2007, 18:13:09] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[11/22/2007, 18:13:09] - BHO 3: {180B14DF-DCC9-4D12-B93D-E8F32615E1FF} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 4: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[11/22/2007, 18:13:09] - BHO 5: {298DF716-189E-4DEF-8C83-B621C09D17A8} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 6: {3108B150-2738-4753-9115-3CB17CDEC840} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 7: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/22/2007, 18:13:09] - BHO 8: {64F56FC1-1272-44CD-BA6E-39723696E350} (EoBho Class)
[11/22/2007, 18:13:09] - BHO 9: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/22/2007, 18:13:09] - BHO 10: {77FA831A-258D-4D6C-A508-2E9947A2F045} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 11: {89fa6622-e885-42da-b9a7-abca3b201feb} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - Checking for HKLM\...\Winlogon\Notify\cprthiur
[11/22/2007, 18:13:09] - Key not found: HKLM\...\Winlogon\Notify\cprthiur, continuing.
[11/22/2007, 18:13:09] - BHO 12: {8DE29EE1-378B-4570-9A74-1D72CA3C00A1} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 13: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/22/2007, 18:13:09] - BHO 14: {A95B2816-1D7E-4561-A202-68C0DE02353A} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - Checking for HKLM\...\Winlogon\Notify\ftcleokj
[11/22/2007, 18:13:09] - Found: HKLM\...\Winlogon\Notify\ftcleokj - This is probably Virtumundo.
[11/22/2007, 18:13:09] - Assigning {A95B2816-1D7E-4561-A202-68C0DE02353A} MSEvents Object
[11/22/2007, 18:13:09] - BHO list has been changed! Starting over...
[11/22/2007, 18:13:09] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[11/22/2007, 18:13:09] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[11/22/2007, 18:13:09] - BHO 3: {180B14DF-DCC9-4D12-B93D-E8F32615E1FF} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 4: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[11/22/2007, 18:13:09] - BHO 5: {298DF716-189E-4DEF-8C83-B621C09D17A8} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 6: {3108B150-2738-4753-9115-3CB17CDEC840} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - No filename found. Continuing.
[11/22/2007, 18:13:10] - BHO 7: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/22/2007, 18:13:10] - BHO 8: {64F56FC1-1272-44CD-BA6E-39723696E350} (EoBho Class)
[11/22/2007, 18:13:10] - BHO 9: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/22/2007, 18:13:10] - BHO 10: {77FA831A-258D-4D6C-A508-2E9947A2F045} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - No filename found. Continuing.
[11/22/2007, 18:13:10] - BHO 11: {89fa6622-e885-42da-b9a7-abca3b201feb} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - Checking for HKLM\...\Winlogon\Notify\cprthiur
[11/22/2007, 18:13:10] - Key not found: HKLM\...\Winlogon\Notify\cprthiur, continuing.
[11/22/2007, 18:13:10] - BHO 12: {8DE29EE1-378B-4570-9A74-1D72CA3C00A1} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - No filename found. Continuing.
[11/22/2007, 18:13:10] - BHO 13: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/22/2007, 18:13:10] - BHO 14: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/22/2007, 18:13:10] - ALERT: Found MSEvents Object!
[11/22/2007, 18:13:10] - BHO 15: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/22/2007, 18:13:10] - BHO 16: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[11/22/2007, 18:13:10] - BHO 17: {B8279A7A-A732-4DB9-95BE-8A4CBA52C0EC} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - No filename found. Continuing.
[11/22/2007, 18:13:10] - BHO 18: {B99E4159-D657-4AFA-85BE-D2E82A219C3F} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - Checking for HKLM\...\Winlogon\Notify\pmkhg
[11/22/2007, 18:13:10] - Key not found: HKLM\...\Winlogon\Notify\pmkhg, continuing.
[11/22/2007, 18:13:10] - BHO 19: {BBDA78C3-63D2-4BAA-AA3D-E2977BF92749} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - No filename found. Continuing.
[11/22/2007, 18:13:10] - BHO 20: {CC59E0F9-7E43-44FA-9FAA-8377850BF205} (FDMIECookiesBHO Class)
[11/22/2007, 18:13:10] - Finished Searching Browser Helper Objects
[11/22/2007, 18:13:10] - *** Detected MSEvents Object
[11/22/2007, 18:13:10] - Trying to remove MSEvents Object...
[11/22/2007, 18:13:11] - Terminating Process: IEXPLORE.EXE
[11/22/2007, 18:13:11] - Terminating Process: RUNDLL32.EXE
[11/22/2007, 18:13:11] - Disabling Automatic Shell Restart
[11/22/2007, 18:13:11] - Terminating Process: EXPLORER.EXE
[11/22/2007, 18:13:12] - Suspending the NT Session Manager System Service
[11/22/2007, 18:13:12] - Terminating Windows NT Logon/Logoff Manager
[11/22/2007, 18:13:13] - Re-enabling Automatic Shell Restart
[11/22/2007, 18:13:13] - File to disable: C:\WINDOWS\system32\ftcleokj.dll
[11/22/2007, 18:13:14] - Removing HKLM\...\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/22/2007, 18:13:15] - Removing HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/22/2007, 18:13:15] - Adding Kill Bit for ActiveX for GUID: {A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/22/2007, 18:13:15] - Deleting ATLEvents/MSEvents Registry entries
[11/22/2007, 18:13:15] - Removing HKLM\...\Winlogon\Notify\ftcleokj
[11/22/2007, 18:13:15] - Searching for Browser Helper Objects:
[11/22/2007, 18:13:15] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[11/22/2007, 18:13:16] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[11/22/2007, 18:13:16] - BHO 3: {180B14DF-DCC9-4D12-B93D-E8F32615E1FF} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 4: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[11/22/2007, 18:13:16] - BHO 5: {298DF716-189E-4DEF-8C83-B621C09D17A8} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 6: {3108B150-2738-4753-9115-3CB17CDEC840} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 7: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/22/2007, 18:13:16] - BHO 8: {64F56FC1-1272-44CD-BA6E-39723696E350} (EoBho Class)
[11/22/2007, 18:13:16] - BHO 9: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/22/2007, 18:13:16] - BHO 10: {77FA831A-258D-4D6C-A508-2E9947A2F045} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 11: {89fa6622-e885-42da-b9a7-abca3b201feb} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - Checking for HKLM\...\Winlogon\Notify\cprthiur
[11/22/2007, 18:13:16] - Key not found: HKLM\...\Winlogon\Notify\cprthiur, continuing.
[11/22/2007, 18:13:16] - BHO 12: {8DE29EE1-378B-4570-9A74-1D72CA3C00A1} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 13: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/22/2007, 18:13:16] - BHO 14: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/22/2007, 18:13:16] - BHO 15: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[11/22/2007, 18:13:16] - BHO 16: {B8279A7A-A732-4DB9-95BE-8A4CBA52C0EC} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 17: {B99E4159-D657-4AFA-85BE-D2E82A219C3F} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - Checking for HKLM\...\Winlogon\Notify\pmkhg
[11/22/2007, 18:13:16] - Key not found: HKLM\...\Winlogon\Notify\pmkhg, continuing.
[11/22/2007, 18:13:16] - BHO 18: {BBDA78C3-63D2-4BAA-AA3D-E2977BF92749} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 19: {CC59E0F9-7E43-44FA-9FAA-8377850BF205} (FDMIECookiesBHO Class)
[11/22/2007, 18:13:16] - Finished Searching Browser Helper Objects
[11/22/2007, 18:13:16] - Finishing up...
[11/22/2007, 18:13:16] - A restart is needed.
[11/22/2007, 18:13:35] - Attempting to Restart via STOP error (Blue Screen!)
et merci bcq por votre participation le probleme persiste tjrs avec cette pub
hij:
ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:22:03, on 22/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\UMonit.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\keyhook.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Megatec\UPSilon 2000\RupsMon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Megatec\UPSilon 2000\Monw32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\BinarySense\HDDlife\HDDlifePro.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Megatec\UPSilon 2000\USBMate.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60327
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.menara.ma/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\ftcleokj.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\UMonit.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\UMonit2K.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: HDDlife.lnk = C:\Program Files\BinarySense\HDDlife\HDDlifePro.exe
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Rupsmon Daemon.lnk = ?
O4 - Global Startup: أوقات الصلاة.lnk = C:\HAD\PTW.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.coupdepoucepc.com/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://charon777.free.fr/plugins/hardwaredetection.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A669C16-DACF-4302-A677-613A820D3D1A}: NameServer = 212.217.0.14 196.217.246.210
O18 - Protocol: bw+0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw+0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw-0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw-0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw00 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw00s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw10 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw10s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw20 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw20s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw30 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw30s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw40 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw40s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw50 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw50s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw60 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw60s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw70 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw70s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw80 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw80s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw90 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw90s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwa0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwa0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwb0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwb0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwc0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwc0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwd0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwd0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwe0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwe0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwf0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwf0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - (no file)
O18 - Protocol: bwg0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwg0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwh0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwh0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwi0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwi0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwj0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwj0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwk0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwk0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwl0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwl0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwm0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwm0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwn0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwn0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwo0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwo0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwp0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwp0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwq0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwq0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwr0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwr0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bws0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bws0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwt0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwt0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwu0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwu0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwv0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwv0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bww0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bww0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwx0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwx0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwy0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwy0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwz0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwz0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: offline-8876480 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Rupsmon - Mega System Technologies, Inc. - C:\Program Files\Megatec\UPSilon 2000\RupsMon.exe
O23 - Service: USBMate - Mega Corp. - C:\Program Files\Megatec\UPSilon 2000\USBMate.exe
--et VBC:
1/22/2007, 18:13:05] - VirtumundoBeGone v1.5 ( "C:\Downloads\Software\VirtumundoBeGone.exe" )
[11/22/2007, 18:13:09] - Detected System Information:
[11/22/2007, 18:13:09] - Windows Version: 5.1.2600, Service Pack 2
[11/22/2007, 18:13:09] - Current Username: HP_Propriétaire (Admin)
[11/22/2007, 18:13:09] - Windows is in NORMAL mode.
[11/22/2007, 18:13:09] - Searching for Browser Helper Objects:
[11/22/2007, 18:13:09] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[11/22/2007, 18:13:09] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[11/22/2007, 18:13:09] - BHO 3: {180B14DF-DCC9-4D12-B93D-E8F32615E1FF} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 4: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[11/22/2007, 18:13:09] - BHO 5: {298DF716-189E-4DEF-8C83-B621C09D17A8} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 6: {3108B150-2738-4753-9115-3CB17CDEC840} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 7: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/22/2007, 18:13:09] - BHO 8: {64F56FC1-1272-44CD-BA6E-39723696E350} (EoBho Class)
[11/22/2007, 18:13:09] - BHO 9: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/22/2007, 18:13:09] - BHO 10: {77FA831A-258D-4D6C-A508-2E9947A2F045} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 11: {89fa6622-e885-42da-b9a7-abca3b201feb} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - Checking for HKLM\...\Winlogon\Notify\cprthiur
[11/22/2007, 18:13:09] - Key not found: HKLM\...\Winlogon\Notify\cprthiur, continuing.
[11/22/2007, 18:13:09] - BHO 12: {8DE29EE1-378B-4570-9A74-1D72CA3C00A1} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 13: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/22/2007, 18:13:09] - BHO 14: {A95B2816-1D7E-4561-A202-68C0DE02353A} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - Checking for HKLM\...\Winlogon\Notify\ftcleokj
[11/22/2007, 18:13:09] - Found: HKLM\...\Winlogon\Notify\ftcleokj - This is probably Virtumundo.
[11/22/2007, 18:13:09] - Assigning {A95B2816-1D7E-4561-A202-68C0DE02353A} MSEvents Object
[11/22/2007, 18:13:09] - BHO list has been changed! Starting over...
[11/22/2007, 18:13:09] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[11/22/2007, 18:13:09] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[11/22/2007, 18:13:09] - BHO 3: {180B14DF-DCC9-4D12-B93D-E8F32615E1FF} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 4: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[11/22/2007, 18:13:09] - BHO 5: {298DF716-189E-4DEF-8C83-B621C09D17A8} ()
[11/22/2007, 18:13:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:09] - No filename found. Continuing.
[11/22/2007, 18:13:09] - BHO 6: {3108B150-2738-4753-9115-3CB17CDEC840} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - No filename found. Continuing.
[11/22/2007, 18:13:10] - BHO 7: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/22/2007, 18:13:10] - BHO 8: {64F56FC1-1272-44CD-BA6E-39723696E350} (EoBho Class)
[11/22/2007, 18:13:10] - BHO 9: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/22/2007, 18:13:10] - BHO 10: {77FA831A-258D-4D6C-A508-2E9947A2F045} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - No filename found. Continuing.
[11/22/2007, 18:13:10] - BHO 11: {89fa6622-e885-42da-b9a7-abca3b201feb} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - Checking for HKLM\...\Winlogon\Notify\cprthiur
[11/22/2007, 18:13:10] - Key not found: HKLM\...\Winlogon\Notify\cprthiur, continuing.
[11/22/2007, 18:13:10] - BHO 12: {8DE29EE1-378B-4570-9A74-1D72CA3C00A1} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - No filename found. Continuing.
[11/22/2007, 18:13:10] - BHO 13: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/22/2007, 18:13:10] - BHO 14: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/22/2007, 18:13:10] - ALERT: Found MSEvents Object!
[11/22/2007, 18:13:10] - BHO 15: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/22/2007, 18:13:10] - BHO 16: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[11/22/2007, 18:13:10] - BHO 17: {B8279A7A-A732-4DB9-95BE-8A4CBA52C0EC} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - No filename found. Continuing.
[11/22/2007, 18:13:10] - BHO 18: {B99E4159-D657-4AFA-85BE-D2E82A219C3F} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - Checking for HKLM\...\Winlogon\Notify\pmkhg
[11/22/2007, 18:13:10] - Key not found: HKLM\...\Winlogon\Notify\pmkhg, continuing.
[11/22/2007, 18:13:10] - BHO 19: {BBDA78C3-63D2-4BAA-AA3D-E2977BF92749} ()
[11/22/2007, 18:13:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:10] - No filename found. Continuing.
[11/22/2007, 18:13:10] - BHO 20: {CC59E0F9-7E43-44FA-9FAA-8377850BF205} (FDMIECookiesBHO Class)
[11/22/2007, 18:13:10] - Finished Searching Browser Helper Objects
[11/22/2007, 18:13:10] - *** Detected MSEvents Object
[11/22/2007, 18:13:10] - Trying to remove MSEvents Object...
[11/22/2007, 18:13:11] - Terminating Process: IEXPLORE.EXE
[11/22/2007, 18:13:11] - Terminating Process: RUNDLL32.EXE
[11/22/2007, 18:13:11] - Disabling Automatic Shell Restart
[11/22/2007, 18:13:11] - Terminating Process: EXPLORER.EXE
[11/22/2007, 18:13:12] - Suspending the NT Session Manager System Service
[11/22/2007, 18:13:12] - Terminating Windows NT Logon/Logoff Manager
[11/22/2007, 18:13:13] - Re-enabling Automatic Shell Restart
[11/22/2007, 18:13:13] - File to disable: C:\WINDOWS\system32\ftcleokj.dll
[11/22/2007, 18:13:14] - Removing HKLM\...\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/22/2007, 18:13:15] - Removing HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/22/2007, 18:13:15] - Adding Kill Bit for ActiveX for GUID: {A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/22/2007, 18:13:15] - Deleting ATLEvents/MSEvents Registry entries
[11/22/2007, 18:13:15] - Removing HKLM\...\Winlogon\Notify\ftcleokj
[11/22/2007, 18:13:15] - Searching for Browser Helper Objects:
[11/22/2007, 18:13:15] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[11/22/2007, 18:13:16] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[11/22/2007, 18:13:16] - BHO 3: {180B14DF-DCC9-4D12-B93D-E8F32615E1FF} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 4: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} (Skype add-on (mastermind))
[11/22/2007, 18:13:16] - BHO 5: {298DF716-189E-4DEF-8C83-B621C09D17A8} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 6: {3108B150-2738-4753-9115-3CB17CDEC840} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 7: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/22/2007, 18:13:16] - BHO 8: {64F56FC1-1272-44CD-BA6E-39723696E350} (EoBho Class)
[11/22/2007, 18:13:16] - BHO 9: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/22/2007, 18:13:16] - BHO 10: {77FA831A-258D-4D6C-A508-2E9947A2F045} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 11: {89fa6622-e885-42da-b9a7-abca3b201feb} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - Checking for HKLM\...\Winlogon\Notify\cprthiur
[11/22/2007, 18:13:16] - Key not found: HKLM\...\Winlogon\Notify\cprthiur, continuing.
[11/22/2007, 18:13:16] - BHO 12: {8DE29EE1-378B-4570-9A74-1D72CA3C00A1} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 13: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/22/2007, 18:13:16] - BHO 14: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/22/2007, 18:13:16] - BHO 15: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[11/22/2007, 18:13:16] - BHO 16: {B8279A7A-A732-4DB9-95BE-8A4CBA52C0EC} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 17: {B99E4159-D657-4AFA-85BE-D2E82A219C3F} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - Checking for HKLM\...\Winlogon\Notify\pmkhg
[11/22/2007, 18:13:16] - Key not found: HKLM\...\Winlogon\Notify\pmkhg, continuing.
[11/22/2007, 18:13:16] - BHO 18: {BBDA78C3-63D2-4BAA-AA3D-E2977BF92749} ()
[11/22/2007, 18:13:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 18:13:16] - No filename found. Continuing.
[11/22/2007, 18:13:16] - BHO 19: {CC59E0F9-7E43-44FA-9FAA-8377850BF205} (FDMIECookiesBHO Class)
[11/22/2007, 18:13:16] - Finished Searching Browser Helper Objects
[11/22/2007, 18:13:16] - Finishing up...
[11/22/2007, 18:13:16] - A restart is needed.
[11/22/2007, 18:13:35] - Attempting to Restart via STOP error (Blue Screen!)
et merci bcq por votre participation le probleme persiste tjrs avec cette pub
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
22 nov. 2007 à 19:52
22 nov. 2007 à 19:52
Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.menara.ma/
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\ftcleokj.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - Global Startup: أوقات الصلاة.lnk = C:\HAD\PTW.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://charon777.free.fr/plugins/hardwaredetection.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
ENSUITE FIX LES LIGNES 18 sauf la derniere!
O18 - Protocol: bw+0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw+0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw-0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw-0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw00 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw00s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw10 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw10s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw20 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw20s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw30 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw30s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw40 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw40s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw50 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw50s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw60 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw60s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw70 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw70s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw80 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw80s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw90 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw90s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwa0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwa0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwb0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwb0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwc0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwc0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwd0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwd0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwe0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwe0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwf0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwf0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - (no file)
O18 - Protocol: bwg0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwg0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwh0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwh0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwi0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwi0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwj0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwj0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwk0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwk0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwl0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwl0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwm0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwm0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwn0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwn0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwo0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwo0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwp0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwp0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwq0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwq0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwr0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwr0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bws0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bws0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwt0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwt0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwu0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwu0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwv0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwv0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bww0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bww0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwx0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwx0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwy0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwy0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwz0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwz0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: offline-8876480 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
______________
colle le rapport d'un scan en ligne
avec un des suivants:
Panda en ligne : (désactive ton antivirus si il le considere comme suspect)
http://pandasoftware.fr
________________________
recolle ensuite un nouveau rapport hijackthis et dis tes soucis surtout!
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.menara.ma/
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\ftcleokj.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - Global Startup: أوقات الصلاة.lnk = C:\HAD\PTW.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://charon777.free.fr/plugins/hardwaredetection.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
ENSUITE FIX LES LIGNES 18 sauf la derniere!
O18 - Protocol: bw+0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw+0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw-0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw-0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw00 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw00s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw10 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw10s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw20 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw20s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw30 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw30s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw40 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw40s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw50 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw50s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw60 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw60s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw70 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw70s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw80 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw80s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw90 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bw90s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwa0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwa0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwb0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwb0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwc0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwc0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwd0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwd0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwe0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwe0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwf0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwf0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - (no file)
O18 - Protocol: bwg0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwg0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwh0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwh0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwi0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwi0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwj0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwj0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwk0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwk0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwl0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwl0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwm0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwm0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwn0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwn0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwo0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwo0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwp0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwp0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwq0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwq0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwr0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwr0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bws0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bws0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwt0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwt0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwu0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwu0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwv0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwv0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bww0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bww0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwx0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwx0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwy0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwy0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwz0 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: bwz0s - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
O18 - Protocol: offline-8876480 - {10578EE4-6978-445A-8ECF-ED9599CE20BD} - (no file)
______________
colle le rapport d'un scan en ligne
avec un des suivants:
Panda en ligne : (désactive ton antivirus si il le considere comme suspect)
http://pandasoftware.fr
________________________
recolle ensuite un nouveau rapport hijackthis et dis tes soucis surtout!
zizou00
Messages postés
12
Date d'inscription
mardi 20 novembre 2007
Statut
Membre
Dernière intervention
27 novembre 2007
22 nov. 2007 à 23:23
22 nov. 2007 à 23:23
voila j'ai suivi les recomandations ci dessus l'analyse PANDA n'a detecte aucune anomalie que dois je faire maintenant
zizou00
Messages postés
12
Date d'inscription
mardi 20 novembre 2007
Statut
Membre
Dernière intervention
27 novembre 2007
22 nov. 2007 à 23:41
22 nov. 2007 à 23:41
pardon j'ai fais un scan minutieux
ça a donné le resultat suivant j'ai pas pu desinfecter car logiciel n'est gratuit:
ALYSIS: 2007-11-22 22:37:38
PROTECTIONS: 1
MALWARE: 11
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
avast! antivirus 4.7.1074 [VPS 071122-0] 4.7.1074 No Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@atdmt[2].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@xiti[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@xiti[2].txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@weborama[1].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@advertising[1].txt
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@statse.webtrendslive[2].txt
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@bluestreak[2].txt
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@smartadserver[2].txt
02688344 Spyware/Virtumonde Spyware Yes 2 Yes No C:\WINDOWS\SYSTEM32\FMDQAEBJ.EXE
02784291 Spyware/Vundo Spyware No 0 Yes No C:\WINDOWS\system32\rntcfrbj.dll
02812177 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\xgirkppw.dll
02812177 Spyware/Virtumonde Spyware Yes 2 Yes No C:\WINDOWS\SYSTEM32\KHDQFGHF.DLL
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================
ça a donné le resultat suivant j'ai pas pu desinfecter car logiciel n'est gratuit:
ALYSIS: 2007-11-22 22:37:38
PROTECTIONS: 1
MALWARE: 11
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
avast! antivirus 4.7.1074 [VPS 071122-0] 4.7.1074 No Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@atdmt[2].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@xiti[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@xiti[2].txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@weborama[1].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@advertising[1].txt
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@statse.webtrendslive[2].txt
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@bluestreak[2].txt
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\HP_Propriأ©taire\Cookies\hp_propriأ©taire@smartadserver[2].txt
02688344 Spyware/Virtumonde Spyware Yes 2 Yes No C:\WINDOWS\SYSTEM32\FMDQAEBJ.EXE
02784291 Spyware/Vundo Spyware No 0 Yes No C:\WINDOWS\system32\rntcfrbj.dll
02812177 Spyware/Virtumonde Spyware No 1 Yes No C:\WINDOWS\system32\xgirkppw.dll
02812177 Spyware/Virtumonde Spyware Yes 2 Yes No C:\WINDOWS\SYSTEM32\KHDQFGHF.DLL
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================