Analyse HIjackThis
eric_engelman
-
eric_engelman Messages postés 40 Statut Membre -
eric_engelman Messages postés 40 Statut Membre -
Bonjour, j'ai des problèmes d'affichage de fenetres, c'est regulier
https://imageshack.com/
http://img134.imageshack.us/img134/6112/pb2oe1.jpg
mais quand j'ai plusieurs taches/fenetres d'ouverte d'un seul coup je change de fenetre sans mon accord !
Voici mon rapport HijackThis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:12:30, on 07/01/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\nfsclnt.exe
C:\Program Files\SQLLIB\bin\db2jds.exe
C:\Program Files\SQLLIB\bin\db2sec.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\program files\notes\ntmulti.exe
C:\WINNT\system32\svchost.exe
C:\SFU\Mapper\mapsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SYSTEM32\DWRCST.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\WINNT\tppaldr.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\IBM\IMNNQ\HTTPDL.exe
C:\PROGRA~1\IBM\IMNNQ\imnsvdem.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\akitel\akitel2.exe
D:\worldlinebar\WorldlineBAR.exe
C:\Program Files\Notes\NLNOTES.EXE
C:\Program Files\Notes\NCDaemon.exe
C:\Program Files\Notes\ntaskldr.EXE
C:\Program Files\Notes\nxpcdmn.EXE
C:\db2log\HijackThis.exe
C:\Program Files\Opera\Opera.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf.localnet/awl.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.elisa.net;cra.mm.fr.atosorigin.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINNT\tppaldr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Lanceur FinePrint v5] "C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O4 - Startup: akitel.lnk = C:\Program Files\akitel\akitel2.exe
O4 - Startup: Raccourci vers WorldlineBAR.lnk = D:\worldlinebar\WorldlineBAR.exe
O4 - Global Startup: Démarrage du serveur de recherche HTML.lnk = C:\Program Files\SQLLIB\bin\db2nq.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: pcnfsd.burotik.cmd
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.atosworldline.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\Software\..\Telephony: DomainName = fr01.awl.atosorigin.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{DED957DC-E183-492F-A52C-A7E11A14AFDB}: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O21 - SSODL: bvtqfvx - {D23BD6D0-94B1-4948-8FFC-D3E6412225D9} - C:\WINNT\bvtqfvx.dll
O21 - SSODL: alxvdvm - {5412579E-B681-49CF-B343-62CDEC10B137} - C:\WINNT\alxvdvm.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DB2 JDBC Applet Server - Control Center (DB2ControlCenterServer) - Unknown owner - C:\Program Files\SQLLIB\bin\db2ccs.exe
O23 - Service: DB2 JDBC Applet Server (DB2JDS) - Unknown owner - C:\Program Files\SQLLIB\bin\db2jds.exe
O23 - Service: DB2 Security Server (DB2NTSECSERVER) - International Business Machines Corporation - C:\Program Files\SQLLIB\bin\db2sec.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\program files\notes\ntmulti.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINNT\privacy_danger\index.htm
--
End of file - 8447 bytes
https://imageshack.com/
http://img134.imageshack.us/img134/6112/pb2oe1.jpg
mais quand j'ai plusieurs taches/fenetres d'ouverte d'un seul coup je change de fenetre sans mon accord !
Voici mon rapport HijackThis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:12:30, on 07/01/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\nfsclnt.exe
C:\Program Files\SQLLIB\bin\db2jds.exe
C:\Program Files\SQLLIB\bin\db2sec.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\program files\notes\ntmulti.exe
C:\WINNT\system32\svchost.exe
C:\SFU\Mapper\mapsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SYSTEM32\DWRCST.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\WINNT\tppaldr.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\IBM\IMNNQ\HTTPDL.exe
C:\PROGRA~1\IBM\IMNNQ\imnsvdem.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\akitel\akitel2.exe
D:\worldlinebar\WorldlineBAR.exe
C:\Program Files\Notes\NLNOTES.EXE
C:\Program Files\Notes\NCDaemon.exe
C:\Program Files\Notes\ntaskldr.EXE
C:\Program Files\Notes\nxpcdmn.EXE
C:\db2log\HijackThis.exe
C:\Program Files\Opera\Opera.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf.localnet/awl.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.elisa.net;cra.mm.fr.atosorigin.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINNT\tppaldr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Lanceur FinePrint v5] "C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O4 - Startup: akitel.lnk = C:\Program Files\akitel\akitel2.exe
O4 - Startup: Raccourci vers WorldlineBAR.lnk = D:\worldlinebar\WorldlineBAR.exe
O4 - Global Startup: Démarrage du serveur de recherche HTML.lnk = C:\Program Files\SQLLIB\bin\db2nq.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: pcnfsd.burotik.cmd
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.atosworldline.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\Software\..\Telephony: DomainName = fr01.awl.atosorigin.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{DED957DC-E183-492F-A52C-A7E11A14AFDB}: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O21 - SSODL: bvtqfvx - {D23BD6D0-94B1-4948-8FFC-D3E6412225D9} - C:\WINNT\bvtqfvx.dll
O21 - SSODL: alxvdvm - {5412579E-B681-49CF-B343-62CDEC10B137} - C:\WINNT\alxvdvm.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DB2 JDBC Applet Server - Control Center (DB2ControlCenterServer) - Unknown owner - C:\Program Files\SQLLIB\bin\db2ccs.exe
O23 - Service: DB2 JDBC Applet Server (DB2JDS) - Unknown owner - C:\Program Files\SQLLIB\bin\db2jds.exe
O23 - Service: DB2 Security Server (DB2NTSECSERVER) - International Business Machines Corporation - C:\Program Files\SQLLIB\bin\db2sec.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\program files\notes\ntmulti.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINNT\privacy_danger\index.htm
--
End of file - 8447 bytes
Configuration: Windows XP Opera 8.50
A voir également:
- Analyse HIjackThis
- Hijackthis - Télécharger - Antivirus & Antimalwares
- Échec de l'analyse antivirus. ✓ - Forum Antivirus
- Logiciel analyse image - Télécharger - Photo & Graphisme
- Analyse et reparation du lecteur c ✓ - Forum Windows 10
- Analyse composant pc - Guide
20 réponses
Slt
Je t'ai répondu ► http://www.commentcamarche.net/forum/affich 4480816 infecte par worm win32 netsky?page=2#41
Pourquoi tu ne continues pas là-bas
Je t'ai répondu ► http://www.commentcamarche.net/forum/affich 4480816 infecte par worm win32 netsky?page=2#41
Pourquoi tu ne continues pas là-bas
Bonjour,
1) Télécharge et utilise ce kit de désinfection:
http://www.commentcamarche.net/faq/sujet 2618 virus kit de desinfection pour eradiquer w32 netsky
2) Fais une analyse BitDefender à partir d'IE: https://www.bitdefender.fr/
et poste le rapport stp.
1) Télécharge et utilise ce kit de désinfection:
http://www.commentcamarche.net/faq/sujet 2618 virus kit de desinfection pour eradiquer w32 netsky
2) Fais une analyse BitDefender à partir d'IE: https://www.bitdefender.fr/
et poste le rapport stp.
ce fut long mais le voici :
BitDefender Online Scanner - Rapport virus en temps réel
Généré à: Tue, Jan 08, 2008 - 15:15:24
--------------------------------------------------------------------------------
Info d'analyse
Fichiers scannés
515071
Infectés Fichiers
10
Virus Détectés
Trojan.Zlob.CBB
6
Adware.Navipromo.BYT
2
Generic.Adw.SaveNow.F5FEB660
1
Dropped:Trojan.FakeAlert.PG
1
BitDefender Online Scanner - Rapport virus en temps réel
Généré à: Tue, Jan 08, 2008 - 15:15:24
--------------------------------------------------------------------------------
Info d'analyse
Fichiers scannés
515071
Infectés Fichiers
10
Virus Détectés
Trojan.Zlob.CBB
6
Adware.Navipromo.BYT
2
Generic.Adw.SaveNow.F5FEB660
1
Dropped:Trojan.FakeAlert.PG
1
C'est quoi ce rapport !? Tu as bien cliqué sur le bouton "BitDefender scan online" en bas de la colonne gauche ?
Tous les rapports BitDefender que j'ai vus jusqu'à présent étaient plus complets ...
++
EDIT: reste avec ^^Marie^^ sur l'autre post, j'avais oublié que c'était un doublon ... (et c'est très mal!)
Tous les rapports BitDefender que j'ai vus jusqu'à présent étaient plus complets ...
++
EDIT: reste avec ^^Marie^^ sur l'autre post, j'avais oublié que c'était un doublon ... (et c'est très mal!)
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Voici le rapport
BitDefender Online Scanner
Rapport d'analyse généré à: Tue, Jan 08, 2008 - 23:21:18
Voie d'analyse: C:\;D:\;
Statistiques
Temps
04:48:29
Fichiers
505830
Directoires
9326
Secteurs de boot
3
Archives
12982
Paquets programmes
33877
Résultats
Virus identifiés
2
Fichiers infectés
3
Fichiers suspects
0
Avertissements
0
Désinfectés
0
Fichiers effacés
3
Info sur les moteurs
Définition virus
886525
Version des moteurs
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Analyse des plugins
14
Archive des plugins
38
Unpack des plugins
7
E-mail plugins
6
Système plugins
1
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
*;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)=>DaemonTools_WhenUSave_Installer.exe
Infecté par: Generic.Adw.SaveNow.F5FEB660
C:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)=>DaemonTools_WhenUSave_Installer.exe
Echec de la désinfection
C:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)=>DaemonTools_WhenUSave_Installer.exe
Supprimé
C:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)
Echec de la mise à jour
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109302.dll
Infecté par: Trojan.Zlob.CBB
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109302.dll
Echec de la désinfection
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109302.dll
Supprimé
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109303.exe
Infecté par: Trojan.Zlob.CBB
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109303.exe
Echec de la désinfection
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109303.exe
Supprimé
BitDefender Online Scanner
Rapport d'analyse généré à: Tue, Jan 08, 2008 - 23:21:18
Voie d'analyse: C:\;D:\;
Statistiques
Temps
04:48:29
Fichiers
505830
Directoires
9326
Secteurs de boot
3
Archives
12982
Paquets programmes
33877
Résultats
Virus identifiés
2
Fichiers infectés
3
Fichiers suspects
0
Avertissements
0
Désinfectés
0
Fichiers effacés
3
Info sur les moteurs
Définition virus
886525
Version des moteurs
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Analyse des plugins
14
Archive des plugins
38
Unpack des plugins
7
E-mail plugins
6
Système plugins
1
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
*;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)=>DaemonTools_WhenUSave_Installer.exe
Infecté par: Generic.Adw.SaveNow.F5FEB660
C:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)=>DaemonTools_WhenUSave_Installer.exe
Echec de la désinfection
C:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)=>DaemonTools_WhenUSave_Installer.exe
Supprimé
C:\Program Files\DAEMON Tools\SetupDTSB.exe=>(CAB Sfx r)
Echec de la mise à jour
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109302.dll
Infecté par: Trojan.Zlob.CBB
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109302.dll
Echec de la désinfection
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109302.dll
Supprimé
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109303.exe
Infecté par: Trojan.Zlob.CBB
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109303.exe
Echec de la désinfection
C:\System Volume Information\_restore{038D1B8C-0944-4C4E-A861-266AD47DA565}\RP378\A0109303.exe
Supprimé
j'ai effectivement passé le kit de desinfection comme cité au dessus mais il n'a rien detecté.
je suis toujours infecté car le rapport bitdefender me l'a signalé !
c'est l'horreur
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:13:35, on 09/01/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\nfsclnt.exe
C:\Program Files\SQLLIB\bin\db2jds.exe
C:\Program Files\SQLLIB\bin\db2sec.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\program files\notes\ntmulti.exe
C:\WINNT\system32\svchost.exe
C:\SFU\Mapper\mapsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\WINNT\tppaldr.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\IBM\IMNNQ\HTTPDL.exe
C:\PROGRA~1\IBM\IMNNQ\imnsvdem.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\akitel\akitel2.exe
D:\worldlinebar\WorldlineBAR.exe
C:\Program Files\Notes\NLNOTES.EXE
C:\Program Files\Notes\NCDaemon.exe
C:\Program Files\Notes\ntaskldr.EXE
C:\Program Files\Notes\nxpcdmn.EXE
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Opera\Opera.exe
C:\db2log\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf.localnet/awl.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.elisa.net;cra.mm.fr.atosorigin.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINNT\tppaldr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Lanceur FinePrint v5] "C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O4 - Startup: akitel.lnk = C:\Program Files\akitel\akitel2.exe
O4 - Startup: Raccourci vers WorldlineBAR.lnk = D:\worldlinebar\WorldlineBAR.exe
O4 - Global Startup: Démarrage du serveur de recherche HTML.lnk = C:\Program Files\SQLLIB\bin\db2nq.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: pcnfsd.burotik.cmd
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.atosworldline.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\Software\..\Telephony: DomainName = fr01.awl.atosorigin.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{DED957DC-E183-492F-A52C-A7E11A14AFDB}: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O21 - SSODL: bvtqfvx - {D23BD6D0-94B1-4948-8FFC-D3E6412225D9} - C:\WINNT\bvtqfvx.dll
O21 - SSODL: alxvdvm - {5412579E-B681-49CF-B343-62CDEC10B137} - C:\WINNT\alxvdvm.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DB2 JDBC Applet Server - Control Center (DB2ControlCenterServer) - Unknown owner - C:\Program Files\SQLLIB\bin\db2ccs.exe
O23 - Service: DB2 JDBC Applet Server (DB2JDS) - Unknown owner - C:\Program Files\SQLLIB\bin\db2jds.exe
O23 - Service: DB2 Security Server (DB2NTSECSERVER) - International Business Machines Corporation - C:\Program Files\SQLLIB\bin\db2sec.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\program files\notes\ntmulti.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINNT\privacy_danger\index.htm
je suis toujours infecté car le rapport bitdefender me l'a signalé !
c'est l'horreur
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:13:35, on 09/01/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\nfsclnt.exe
C:\Program Files\SQLLIB\bin\db2jds.exe
C:\Program Files\SQLLIB\bin\db2sec.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\program files\notes\ntmulti.exe
C:\WINNT\system32\svchost.exe
C:\SFU\Mapper\mapsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\WINNT\tppaldr.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\IBM\IMNNQ\HTTPDL.exe
C:\PROGRA~1\IBM\IMNNQ\imnsvdem.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\akitel\akitel2.exe
D:\worldlinebar\WorldlineBAR.exe
C:\Program Files\Notes\NLNOTES.EXE
C:\Program Files\Notes\NCDaemon.exe
C:\Program Files\Notes\ntaskldr.EXE
C:\Program Files\Notes\nxpcdmn.EXE
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Opera\Opera.exe
C:\db2log\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf.localnet/awl.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.elisa.net;cra.mm.fr.atosorigin.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINNT\tppaldr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Lanceur FinePrint v5] "C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O4 - Startup: akitel.lnk = C:\Program Files\akitel\akitel2.exe
O4 - Startup: Raccourci vers WorldlineBAR.lnk = D:\worldlinebar\WorldlineBAR.exe
O4 - Global Startup: Démarrage du serveur de recherche HTML.lnk = C:\Program Files\SQLLIB\bin\db2nq.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: pcnfsd.burotik.cmd
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.atosworldline.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\Software\..\Telephony: DomainName = fr01.awl.atosorigin.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{DED957DC-E183-492F-A52C-A7E11A14AFDB}: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O21 - SSODL: bvtqfvx - {D23BD6D0-94B1-4948-8FFC-D3E6412225D9} - C:\WINNT\bvtqfvx.dll
O21 - SSODL: alxvdvm - {5412579E-B681-49CF-B343-62CDEC10B137} - C:\WINNT\alxvdvm.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DB2 JDBC Applet Server - Control Center (DB2ControlCenterServer) - Unknown owner - C:\Program Files\SQLLIB\bin\db2ccs.exe
O23 - Service: DB2 JDBC Applet Server (DB2JDS) - Unknown owner - C:\Program Files\SQLLIB\bin\db2jds.exe
O23 - Service: DB2 Security Server (DB2NTSECSERVER) - International Business Machines Corporation - C:\Program Files\SQLLIB\bin\db2sec.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\program files\notes\ntmulti.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINNT\privacy_danger\index.htm
1) Télécharge Combofix.exe sur ton Bureau: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Déconnecte-toi du net et désactive ton antivirus pour que Combofix puisse s'exécuter normalement.
* Double clique sur Combofix.exe
* Mets le en langue française F
* Tape sur la touche 1 (Yes) pour démarrer le scan
* Lorsque le scan sera terminé, un rapport apparaîtra
* Poste le rapport qui se se trouve là: C:\Combofix.txt
2) Télécharge sur ton bureau: http://www.malekal.com/download/clean.zip
* Une fois sur le bureau, clic droit sur ton fichier clean.zip << extraire tout ou extraire ici. Cela va créer un dossier clean
* Double-clic sur ce dossier clean, tu y trouveras dedans plusieurs fichiers
* Double-clic sur clean. Cela va ouvrir une fenêtre noire
* Un menu va apparaître, choisis l'option 1 en appuyant sur la touche 1 de ton clavier. Clean va travailler...
Un rapport va etre généré (C:/rapport_clean.txt), colle le contenu ici
3) Ainsi qu'un nouveau log HiJackThis stp.
Déconnecte-toi du net et désactive ton antivirus pour que Combofix puisse s'exécuter normalement.
* Double clique sur Combofix.exe
* Mets le en langue française F
* Tape sur la touche 1 (Yes) pour démarrer le scan
* Lorsque le scan sera terminé, un rapport apparaîtra
* Poste le rapport qui se se trouve là: C:\Combofix.txt
2) Télécharge sur ton bureau: http://www.malekal.com/download/clean.zip
* Une fois sur le bureau, clic droit sur ton fichier clean.zip << extraire tout ou extraire ici. Cela va créer un dossier clean
* Double-clic sur ce dossier clean, tu y trouveras dedans plusieurs fichiers
* Double-clic sur clean. Cela va ouvrir une fenêtre noire
* Un menu va apparaître, choisis l'option 1 en appuyant sur la touche 1 de ton clavier. Clean va travailler...
Un rapport va etre généré (C:/rapport_clean.txt), colle le contenu ici
3) Ainsi qu'un nouveau log HiJackThis stp.
Rapport combofix
ComboFix 08-01-09.2 - fr17764 2008-01-09 13:48:53.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.361 [GMT 1:00]
Running from: C:\db2log\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\MediaVideoCodec
C:\Program Files\MediaVideoCodec\install.ico
C:\WINNT\alxvdvm.dll
C:\WINNT\bvtqfvx.dll
C:\WINNT\dat.txt
C:\WINNT\rs.txt
C:\WINNT\search_res.txt
C:\WINNT\system32\oledb32.dll
D:\Documents and Settings\FR17764\Bureau\Error Cleaner.url
D:\Documents and Settings\FR17764\Bureau\Privacy Protector.url
D:\Documents and Settings\FR17764\Bureau\Spyware&Malware Protection.url
D:\Documents and Settings\FR17764\Favoris\Error Cleaner.url
D:\Documents and Settings\FR17764\Favoris\Privacy Protector.url
D:\Documents and Settings\FR17764\Favoris\Spyware&Malware Protection.url
.
((((((((((((((((((((((((((((( Fichiers créés 2007-12-09 to 2008-01-09 ))))))))))))))))))))))))))))))))))))
.
2008-01-09 13:42 . 2000-08-31 08:00 51,200 --a------ C:\WINNT\NirCmd.exe
2008-01-08 11:04 . 2008-01-08 18:29 <REP> d-------- C:\WINNT\BDOSCAN8
2008-01-04 10:54 . 2007-09-05 23:22 289,144 --a------ C:\WINNT\system32\VCCLSID.exe
2008-01-04 10:54 . 2006-04-27 16:49 288,417 --a------ C:\WINNT\system32\SrchSTS.exe
2008-01-04 10:54 . 2007-12-20 23:11 81,920 --a------ C:\WINNT\system32\IEDFix.exe
2008-01-04 10:54 . 2003-06-05 20:13 53,248 --a------ C:\WINNT\system32\Process.exe
2008-01-04 10:54 . 2004-07-31 17:50 51,200 --a------ C:\WINNT\system32\dumphive.exe
2008-01-04 10:54 . 2007-10-03 23:36 25,600 --a------ C:\WINNT\system32\WS2Fix.exe
2008-01-03 15:39 . 2008-01-03 15:39 44,032 --a------ C:\WINNT\system32\DWRCST.exe
2008-01-02 11:49 . 2008-01-03 14:38 <REP> d-------- D:\Documents and Settings\admin_dsk\Mes documents
2008-01-02 10:52 . 2008-01-02 10:52 <REP> d-------- C:\Program Files\Panda Security
2008-01-02 10:17 . 2008-01-02 10:17 <REP> d-------- C:\WINNT\system32\Kaspersky Lab
2008-01-02 08:44 . 2008-01-02 08:44 <REP> d-------- D:\Documents and Settings\LocalService.AUTORITE NT.001\Application DataPDFcreator
2007-12-31 14:36 . 2008-01-04 12:12 2,854 --a------ C:\WINNT\system32\tmp.reg
2007-12-31 11:06 . 2007-12-31 11:07 <REP> d-------- C:\Program Files\CCleaner
2007-12-31 10:14 . 2007-12-31 10:14 <REP> d-------- D:\Documents and Settings\FR17764\Application Data\Grisoft
2007-12-31 10:14 . 2007-12-31 10:14 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-31 10:14 . 2007-05-30 13:10 10,872 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2007-12-24 14:38 . 2007-12-24 14:38 5,690,368 --a------ C:\Présentation2.pps
2007-12-24 14:34 . 2007-12-24 14:36 24 ---hs---- C:\WINNT\SD80BC5D7.tmp
2007-12-10 12:39 . 2007-12-10 12:39 <REP> d-------- C:\Program Files\DVD Shrink
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-09 06:33 --------- d-----w C:\Program Files\Web Radio Player 3.6
2007-12-31 13:35 --------- d-----w C:\Program Files\Opera
2007-12-31 12:28 --------- d-----w C:\Program Files\Google
2007-12-31 10:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-31 10:15 --------- d-----w C:\Program Files\CyberLink
2007-12-31 10:09 --------- d-----w C:\Program Files\GetRight
2007-12-31 10:06 --------- d-----w C:\Program Files\Yahoo!
2007-12-24 13:47 --------- d-----w C:\Program Files\SlySoft
2007-12-24 11:59 --------- d-----w D:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-11-13 09:17 --------- d-----w C:\Program Files\ZGuideTV
2006-06-16 13:59 56 -csh--r C:\WINNT\system32\6AA02B9D35.sys
2006-06-16 13:59 2,516 -csha-w C:\WINNT\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\WINNT\system32\hkcmd.exe" [2004-08-20 14:51 118784]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 19:00 94208]
"Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe" [2003-10-07 08:48 147514]
"TPP Auto Loader"="C:\WINNT\tppaldr.exe" [2002-06-24 11:20 118784]
"NeroFilterCheck"="C:\WINNT\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" [2006-11-17 03:06 136768]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 13:42 1404928]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592]
"Lanceur FinePrint v5"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" [2006-06-19 20:09 499712]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINNT\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="cmd.exe" [2004-08-05 13:00 400896 C:\WINNT\system32\cmd.exe]
D:\Documents and Settings\FR17764\Menu D‚marrer\Programmes\D‚marrage\
akitel.lnk - C:\Program Files\akitel\akitel2.exe [2007-04-05 16:37:36]
Raccourci vers WorldlineBAR.lnk - D:\worldlinebar\WorldlineBAR.exe [2005-02-24 15:59:52]
D:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage du serveur de recherche HTML.lnk - C:\Program Files\SQLLIB\bin\db2nq.exe [2006-02-21 17:08:13]
GetRight - Tray Icon.lnk - C:\Program Files\GetRight\getright.exe [2005-12-27 13:53:43]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26]
pcnfsd.burotik.cmd [2005-09-28 13:37:33]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\[u]0[/u]\[u]0[/u]]
"Script"=disableDNSRegistration.vbs
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\[u]0[/u]]
"Script"=\\fr01.awl.atosorigin.net\SysVol\fr01.awl.atosorigin.net\scripts\RegId.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\2\[u]0[/u]]
"Script"=\\fr01.awl.atosorigin.net\SysVol\fr01.awl.atosorigin.net\scripts\RegKobil.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-812780242-3449912065-677842238-6150\Scripts\Logon\[u]0[/u]\[u]0[/u]]
"Script"=\\fr01.awl.atosorigin.net\SysVol\fr01.awl.atosorigin.net\scripts\Add_local_Grp.bat
R2 Client for NFS;Client for NFS;C:\WINNT\system32\nfsclnt.exe [2003-11-08 13:42]
R2 DLPortIO;DriverLINX Port I/O Driver;C:\WINNT\system32\DRIVERS\DLPortIO.SYS [1999-01-10 12:00]
R2 Mapsvc;User Name Mapping;C:\SFU\Mapper\mapsvc.exe [2003-11-08 13:42]
R3 NfsRdr;NfsRdr;C:\WINNT\system32\drivers\nfsrdr.sys [2003-11-08 13:42]
R3 Portmap;Portmap;C:\WINNT\system32\drivers\portmap.sys [2003-11-08 13:42]
R3 RpcXdr;RpcXdr;C:\WINNT\system32\drivers\rpcxdr.sys [2003-11-08 13:42]
S0 PowerSwitch;PowerSwitch;C:\WINNT\system32\drivers\psdvr.sys []
S3 DB2ControlCenterServer;DB2 JDBC Applet Server - Control Center;"C:\Program Files\SQLLIB\bin\db2ccs.exe" [2000-05-11 08:16]
S3 TPP200;USB Storage Adapter V2 (TPP);C:\WINNT\system32\DRIVERS\TPP200.SYS [2002-06-24 11:20]
S4 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2006-05-03 12:40]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d18fb804-2c47-11da-a707-00123f62c85e}]
\Shell\AutoRun\command - G:\run.bat
\Shell\wizard\command - G:\run.bat
\Shell\X2\command - G:\X.bat 2
\Shell\X3\command - G:\X.bat 3
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-09 13:54:06
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-09 13:55:26
ComboFix-quarantined-files.txt 2008-01-09 12:55:09
ComboFix 08-01-09.2 - fr17764 2008-01-09 13:48:53.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.361 [GMT 1:00]
Running from: C:\db2log\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\MediaVideoCodec
C:\Program Files\MediaVideoCodec\install.ico
C:\WINNT\alxvdvm.dll
C:\WINNT\bvtqfvx.dll
C:\WINNT\dat.txt
C:\WINNT\rs.txt
C:\WINNT\search_res.txt
C:\WINNT\system32\oledb32.dll
D:\Documents and Settings\FR17764\Bureau\Error Cleaner.url
D:\Documents and Settings\FR17764\Bureau\Privacy Protector.url
D:\Documents and Settings\FR17764\Bureau\Spyware&Malware Protection.url
D:\Documents and Settings\FR17764\Favoris\Error Cleaner.url
D:\Documents and Settings\FR17764\Favoris\Privacy Protector.url
D:\Documents and Settings\FR17764\Favoris\Spyware&Malware Protection.url
.
((((((((((((((((((((((((((((( Fichiers créés 2007-12-09 to 2008-01-09 ))))))))))))))))))))))))))))))))))))
.
2008-01-09 13:42 . 2000-08-31 08:00 51,200 --a------ C:\WINNT\NirCmd.exe
2008-01-08 11:04 . 2008-01-08 18:29 <REP> d-------- C:\WINNT\BDOSCAN8
2008-01-04 10:54 . 2007-09-05 23:22 289,144 --a------ C:\WINNT\system32\VCCLSID.exe
2008-01-04 10:54 . 2006-04-27 16:49 288,417 --a------ C:\WINNT\system32\SrchSTS.exe
2008-01-04 10:54 . 2007-12-20 23:11 81,920 --a------ C:\WINNT\system32\IEDFix.exe
2008-01-04 10:54 . 2003-06-05 20:13 53,248 --a------ C:\WINNT\system32\Process.exe
2008-01-04 10:54 . 2004-07-31 17:50 51,200 --a------ C:\WINNT\system32\dumphive.exe
2008-01-04 10:54 . 2007-10-03 23:36 25,600 --a------ C:\WINNT\system32\WS2Fix.exe
2008-01-03 15:39 . 2008-01-03 15:39 44,032 --a------ C:\WINNT\system32\DWRCST.exe
2008-01-02 11:49 . 2008-01-03 14:38 <REP> d-------- D:\Documents and Settings\admin_dsk\Mes documents
2008-01-02 10:52 . 2008-01-02 10:52 <REP> d-------- C:\Program Files\Panda Security
2008-01-02 10:17 . 2008-01-02 10:17 <REP> d-------- C:\WINNT\system32\Kaspersky Lab
2008-01-02 08:44 . 2008-01-02 08:44 <REP> d-------- D:\Documents and Settings\LocalService.AUTORITE NT.001\Application DataPDFcreator
2007-12-31 14:36 . 2008-01-04 12:12 2,854 --a------ C:\WINNT\system32\tmp.reg
2007-12-31 11:06 . 2007-12-31 11:07 <REP> d-------- C:\Program Files\CCleaner
2007-12-31 10:14 . 2007-12-31 10:14 <REP> d-------- D:\Documents and Settings\FR17764\Application Data\Grisoft
2007-12-31 10:14 . 2007-12-31 10:14 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-31 10:14 . 2007-05-30 13:10 10,872 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2007-12-24 14:38 . 2007-12-24 14:38 5,690,368 --a------ C:\Présentation2.pps
2007-12-24 14:34 . 2007-12-24 14:36 24 ---hs---- C:\WINNT\SD80BC5D7.tmp
2007-12-10 12:39 . 2007-12-10 12:39 <REP> d-------- C:\Program Files\DVD Shrink
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-09 06:33 --------- d-----w C:\Program Files\Web Radio Player 3.6
2007-12-31 13:35 --------- d-----w C:\Program Files\Opera
2007-12-31 12:28 --------- d-----w C:\Program Files\Google
2007-12-31 10:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-31 10:15 --------- d-----w C:\Program Files\CyberLink
2007-12-31 10:09 --------- d-----w C:\Program Files\GetRight
2007-12-31 10:06 --------- d-----w C:\Program Files\Yahoo!
2007-12-24 13:47 --------- d-----w C:\Program Files\SlySoft
2007-12-24 11:59 --------- d-----w D:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-11-13 09:17 --------- d-----w C:\Program Files\ZGuideTV
2006-06-16 13:59 56 -csh--r C:\WINNT\system32\6AA02B9D35.sys
2006-06-16 13:59 2,516 -csha-w C:\WINNT\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\WINNT\system32\hkcmd.exe" [2004-08-20 14:51 118784]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 19:00 94208]
"Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe" [2003-10-07 08:48 147514]
"TPP Auto Loader"="C:\WINNT\tppaldr.exe" [2002-06-24 11:20 118784]
"NeroFilterCheck"="C:\WINNT\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" [2006-11-17 03:06 136768]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 13:42 1404928]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592]
"Lanceur FinePrint v5"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" [2006-06-19 20:09 499712]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINNT\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="cmd.exe" [2004-08-05 13:00 400896 C:\WINNT\system32\cmd.exe]
D:\Documents and Settings\FR17764\Menu D‚marrer\Programmes\D‚marrage\
akitel.lnk - C:\Program Files\akitel\akitel2.exe [2007-04-05 16:37:36]
Raccourci vers WorldlineBAR.lnk - D:\worldlinebar\WorldlineBAR.exe [2005-02-24 15:59:52]
D:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage du serveur de recherche HTML.lnk - C:\Program Files\SQLLIB\bin\db2nq.exe [2006-02-21 17:08:13]
GetRight - Tray Icon.lnk - C:\Program Files\GetRight\getright.exe [2005-12-27 13:53:43]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26]
pcnfsd.burotik.cmd [2005-09-28 13:37:33]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\[u]0[/u]\[u]0[/u]]
"Script"=disableDNSRegistration.vbs
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\[u]0[/u]]
"Script"=\\fr01.awl.atosorigin.net\SysVol\fr01.awl.atosorigin.net\scripts\RegId.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\2\[u]0[/u]]
"Script"=\\fr01.awl.atosorigin.net\SysVol\fr01.awl.atosorigin.net\scripts\RegKobil.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-812780242-3449912065-677842238-6150\Scripts\Logon\[u]0[/u]\[u]0[/u]]
"Script"=\\fr01.awl.atosorigin.net\SysVol\fr01.awl.atosorigin.net\scripts\Add_local_Grp.bat
R2 Client for NFS;Client for NFS;C:\WINNT\system32\nfsclnt.exe [2003-11-08 13:42]
R2 DLPortIO;DriverLINX Port I/O Driver;C:\WINNT\system32\DRIVERS\DLPortIO.SYS [1999-01-10 12:00]
R2 Mapsvc;User Name Mapping;C:\SFU\Mapper\mapsvc.exe [2003-11-08 13:42]
R3 NfsRdr;NfsRdr;C:\WINNT\system32\drivers\nfsrdr.sys [2003-11-08 13:42]
R3 Portmap;Portmap;C:\WINNT\system32\drivers\portmap.sys [2003-11-08 13:42]
R3 RpcXdr;RpcXdr;C:\WINNT\system32\drivers\rpcxdr.sys [2003-11-08 13:42]
S0 PowerSwitch;PowerSwitch;C:\WINNT\system32\drivers\psdvr.sys []
S3 DB2ControlCenterServer;DB2 JDBC Applet Server - Control Center;"C:\Program Files\SQLLIB\bin\db2ccs.exe" [2000-05-11 08:16]
S3 TPP200;USB Storage Adapter V2 (TPP);C:\WINNT\system32\DRIVERS\TPP200.SYS [2002-06-24 11:20]
S4 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2006-05-03 12:40]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d18fb804-2c47-11da-a707-00123f62c85e}]
\Shell\AutoRun\command - G:\run.bat
\Shell\wizard\command - G:\run.bat
\Shell\X2\command - G:\X.bat 2
\Shell\X3\command - G:\X.bat 3
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-09 13:54:06
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-09 13:55:26
ComboFix-quarantined-files.txt 2008-01-09 12:55:09
Raport clean
2008-01-09 a 13:57:36.95
*** Recherche des fichiers dans C:
*** Recherche des fichiers dans C:\WINNT\
*** Recherche des fichiers dans C:\WINNT\system32
*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !
2008-01-09 a 13:57:36.95
*** Recherche des fichiers dans C:
*** Recherche des fichiers dans C:\WINNT\
*** Recherche des fichiers dans C:\WINNT\system32
*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !
Raport hijack
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:00, on 2008-01-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\nfsclnt.exe
C:\Program Files\SQLLIB\bin\db2jds.exe
C:\Program Files\SQLLIB\bin\db2sec.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\program files\notes\ntmulti.exe
C:\WINNT\system32\svchost.exe
C:\SFU\Mapper\mapsvc.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\WINNT\tppaldr.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\IBM\IMNNQ\HTTPDL.exe
C:\PROGRA~1\IBM\IMNNQ\imnsvdem.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\akitel\akitel2.exe
C:\Program Files\Notes\NLNOTES.EXE
C:\Program Files\Notes\NCDaemon.exe
C:\Program Files\Notes\ntaskldr.EXE
C:\Program Files\Notes\nxpcdmn.EXE
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\WINNT\explorer.exe
C:\WINNT\system32\notepad.exe
C:\Program Files\Opera\Opera.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\ntvdm.exe
C:\WINNT\system32\notepad.exe
C:\db2log\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf.localnet/awl.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.elisa.net;cra.mm.fr.atosorigin.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINNT\tppaldr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Lanceur FinePrint v5] "C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O4 - Startup: akitel.lnk = C:\Program Files\akitel\akitel2.exe
O4 - Startup: Raccourci vers WorldlineBAR.lnk = D:\worldlinebar\WorldlineBAR.exe
O4 - Global Startup: Démarrage du serveur de recherche HTML.lnk = C:\Program Files\SQLLIB\bin\db2nq.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: pcnfsd.burotik.cmd
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.atosworldline.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\Software\..\Telephony: DomainName = fr01.awl.atosorigin.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{DED957DC-E183-492F-A52C-A7E11A14AFDB}: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DB2 JDBC Applet Server - Control Center (DB2ControlCenterServer) - Unknown owner - C:\Program Files\SQLLIB\bin\db2ccs.exe
O23 - Service: DB2 JDBC Applet Server (DB2JDS) - Unknown owner - C:\Program Files\SQLLIB\bin\db2jds.exe
O23 - Service: DB2 Security Server (DB2NTSECSERVER) - International Business Machines Corporation - C:\Program Files\SQLLIB\bin\db2sec.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\program files\notes\ntmulti.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:00, on 2008-01-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\nfsclnt.exe
C:\Program Files\SQLLIB\bin\db2jds.exe
C:\Program Files\SQLLIB\bin\db2sec.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\program files\notes\ntmulti.exe
C:\WINNT\system32\svchost.exe
C:\SFU\Mapper\mapsvc.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\WINNT\tppaldr.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\IBM\IMNNQ\HTTPDL.exe
C:\PROGRA~1\IBM\IMNNQ\imnsvdem.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\akitel\akitel2.exe
C:\Program Files\Notes\NLNOTES.EXE
C:\Program Files\Notes\NCDaemon.exe
C:\Program Files\Notes\ntaskldr.EXE
C:\Program Files\Notes\nxpcdmn.EXE
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\WINNT\explorer.exe
C:\WINNT\system32\notepad.exe
C:\Program Files\Opera\Opera.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\ntvdm.exe
C:\WINNT\system32\notepad.exe
C:\db2log\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf.localnet/awl.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.elisa.net;cra.mm.fr.atosorigin.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINNT\tppaldr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Lanceur FinePrint v5] "C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O4 - Startup: akitel.lnk = C:\Program Files\akitel\akitel2.exe
O4 - Startup: Raccourci vers WorldlineBAR.lnk = D:\worldlinebar\WorldlineBAR.exe
O4 - Global Startup: Démarrage du serveur de recherche HTML.lnk = C:\Program Files\SQLLIB\bin\db2nq.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: pcnfsd.burotik.cmd
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.atosworldline.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\Software\..\Telephony: DomainName = fr01.awl.atosorigin.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{DED957DC-E183-492F-A52C-A7E11A14AFDB}: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DB2 JDBC Applet Server - Control Center (DB2ControlCenterServer) - Unknown owner - C:\Program Files\SQLLIB\bin\db2ccs.exe
O23 - Service: DB2 JDBC Applet Server (DB2JDS) - Unknown owner - C:\Program Files\SQLLIB\bin\db2jds.exe
O23 - Service: DB2 Security Server (DB2NTSECSERVER) - International Business Machines Corporation - C:\Program Files\SQLLIB\bin\db2sec.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\program files\notes\ntmulti.exe
* Ouvre Hijackthis, choisis "do a scan only"
Coche la case devant les lignes:
* Tu sais ce que c'est WorldlineBAR ?
* Tu connais ce site: fr01.awl.atosorigin.net ?
Coche la case devant les lignes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm O4 - Startup: akitel.lnk = C:\Program Files\akitel\akitel2.exe O4 - Startup: Raccourci vers WorldlineBAR.lnk = D:\worldlinebar\WorldlineBAR.exe O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: pcnfsd.burotik.cmdFerme toutes les autres fenêtres actives et clique sur "Fix checked"
* Tu sais ce que c'est WorldlineBAR ?
* Tu connais ce site: fr01.awl.atosorigin.net ?
Et voila
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:21, on 2008-01-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\nfsclnt.exe
C:\Program Files\SQLLIB\bin\db2jds.exe
C:\Program Files\SQLLIB\bin\db2sec.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\program files\notes\ntmulti.exe
C:\WINNT\system32\svchost.exe
C:\SFU\Mapper\mapsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SYSTEM32\DWRCST.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\WINNT\tppaldr.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\IBM\IMNNQ\HTTPDL.exe
C:\PROGRA~1\IBM\IMNNQ\imnsvdem.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\akitel\akitel2.exe
D:\worldlinebar\WorldlineBAR.exe
C:\Program Files\Notes\NLNOTES.EXE
C:\Program Files\Notes\NCDaemon.exe
C:\Program Files\Notes\ntaskldr.EXE
C:\Program Files\Notes\nxpcdmn.EXE
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Opera\Opera.exe
C:\db2log\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf.localnet/awl.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.elisa.net;cra.mm.fr.atosorigin.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINNT\tppaldr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Lanceur FinePrint v5] "C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O4 - Startup: akitel.lnk = C:\Program Files\akitel\akitel2.exe
O4 - Startup: Raccourci vers WorldlineBAR.lnk = D:\worldlinebar\WorldlineBAR.exe
O4 - Global Startup: Démarrage du serveur de recherche HTML.lnk = C:\Program Files\SQLLIB\bin\db2nq.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: pcnfsd.burotik.cmd
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.atosworldline.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\Software\..\Telephony: DomainName = fr01.awl.atosorigin.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{DED957DC-E183-492F-A52C-A7E11A14AFDB}: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DB2 JDBC Applet Server - Control Center (DB2ControlCenterServer) - Unknown owner - C:\Program Files\SQLLIB\bin\db2ccs.exe
O23 - Service: DB2 JDBC Applet Server (DB2JDS) - Unknown owner - C:\Program Files\SQLLIB\bin\db2jds.exe
O23 - Service: DB2 Security Server (DB2NTSECSERVER) - International Business Machines Corporation - C:\Program Files\SQLLIB\bin\db2sec.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\program files\notes\ntmulti.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:21, on 2008-01-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\nfsclnt.exe
C:\Program Files\SQLLIB\bin\db2jds.exe
C:\Program Files\SQLLIB\bin\db2sec.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\program files\notes\ntmulti.exe
C:\WINNT\system32\svchost.exe
C:\SFU\Mapper\mapsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SYSTEM32\DWRCST.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\WINNT\tppaldr.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\IBM\IMNNQ\HTTPDL.exe
C:\PROGRA~1\IBM\IMNNQ\imnsvdem.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\akitel\akitel2.exe
D:\worldlinebar\WorldlineBAR.exe
C:\Program Files\Notes\NLNOTES.EXE
C:\Program Files\Notes\NCDaemon.exe
C:\Program Files\Notes\ntaskldr.EXE
C:\Program Files\Notes\nxpcdmn.EXE
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Opera\Opera.exe
C:\db2log\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf.localnet/awl.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.elisa.net;cra.mm.fr.atosorigin.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINNT\tppaldr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Lanceur FinePrint v5] "C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O4 - Startup: akitel.lnk = C:\Program Files\akitel\akitel2.exe
O4 - Startup: Raccourci vers WorldlineBAR.lnk = D:\worldlinebar\WorldlineBAR.exe
O4 - Global Startup: Démarrage du serveur de recherche HTML.lnk = C:\Program Files\SQLLIB\bin\db2nq.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: pcnfsd.burotik.cmd
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=www.atosworldline.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\Software\..\Telephony: DomainName = fr01.awl.atosorigin.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{DED957DC-E183-492F-A52C-A7E11A14AFDB}: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = fr01.awl.atosorigin.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = fr01.awl.atosorigin.net,awl.atosorigin.net,priv.atos.fr,elisa.net,dev.atos.fr,segin.com,axime.com
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DB2 JDBC Applet Server - Control Center (DB2ControlCenterServer) - Unknown owner - C:\Program Files\SQLLIB\bin\db2ccs.exe
O23 - Service: DB2 JDBC Applet Server (DB2JDS) - Unknown owner - C:\Program Files\SQLLIB\bin\db2jds.exe
O23 - Service: DB2 Security Server (DB2NTSECSERVER) - International Business Machines Corporation - C:\Program Files\SQLLIB\bin\db2sec.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\program files\notes\ntmulti.exe
Coucou,
1) tu n'as pas de pare-feu actif => http://www.commentcamarche.net/telecharger/telecharger 206 kerio
2) ton rapport HiJackThis est clean.
3) tu peux désinstaller les logiciels que je t'ai demandé d'installer.
As-tu toujours des soucis ?
1) tu n'as pas de pare-feu actif => http://www.commentcamarche.net/telecharger/telecharger 206 kerio
2) ton rapport HiJackThis est clean.
3) tu peux désinstaller les logiciels que je t'ai demandé d'installer.
As-tu toujours des soucis ?
