Outerinfo: le retour
Legep
-
Legep -
Legep -
Bonjour,
Comme je le disais dans un message précedent, en voulant desinstaller des programmes je suis tombé sur un "programme" assez farfelu :
petite corbeille en icone, suivie de outerinfo, utilisé rarement et dont le poids affiche 850 MO !!! En parcourant le forul, ill s'agirait d'un virus... Mais vu le poids de la chose j'ai un doute :)!!! Je transmets ci dessous le rappport Fsecure, at j'y ajouterai par la suite le rapport HIJACK. Erf, j'avais pourtant l'impression d'etre bien protégée!!! Avast, Zone Alarm, Adware, Merci par avance de vos reponses.
Scanning Report
Monday, January 07, 2008 10:53:48 - 13:09:02
Computer name: SYSTEME
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\ D:\ E:\ F:\ G:\
--------------------------------------------------------------------------------
Result: 13 malware found
HTML/AdClicker.A (virus)
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\K3S1Q3SX\SECURE32[1].HTM (Renamed & Submitted)
Vundo.gen38 (virus)
C:\WINDOWS\SYSTEM32\CXWHOLOG.INI (Submitted)
C:\WINDOWS\SYSTEM32\EOEWQTMP.INI (Submitted)
C:\WINDOWS\SYSTEM32\EXCOMJWR.INI (Submitted)
C:\WINDOWS\SYSTEM32\HKLCEGUP.INI (Submitted)
C:\WINDOWS\SYSTEM32\HVLKLDKL.INI (Submitted)
C:\WINDOWS\SYSTEM32\JJVUBJQD.INI (Submitted)
C:\WINDOWS\SYSTEM32\KAMWETOQ.INI (Submitted)
C:\WINDOWS\SYSTEM32\NAQCSWTS.INI (Submitted)
C:\WINDOWS\SYSTEM32\OSADRGXI.INI (Submitted)
C:\WINDOWS\SYSTEM32\PWHCJDTI.INI (Submitted)
C:\WINDOWS\SYSTEM32\SRBJUJOK.INI (Submitted)
W32/Horst.gen28 (virus)
C:\WINDOWS\SYSTEM\SMVSS.EXE (Submitted)
--------------------------------------------------------------------------------
Statistics
Scanned:
Files: 88948
System: 0
Not scanned: 42
Actions:
Disinfected: 0
Renamed: 1
Deleted: 0
None: 12
Submitted: 13
Files not scanned:
C:\PAGEFILE.SYS
C:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{ABE5591B-EE06-4DA2-AFF7-B3118AB221AC}.BIN
C:\FOUND.002\DIR0022.CHK\TOC.HTM
C:\FOUND.002\DIR0021.CHK\LSTVIEWS.INI
C:\FOUND.002\DIR0020.CHK\DIVX.INF
C:\FOUND.002\DIR0018.CHK\LFBMP13N.DLL
C:\FOUND.002\DIR0017.CHK\MSPFLTRS.DLL
C:\FOUND.002\DIR0017.CHK\OFETOC.XML
C:\FOUND.002\DIR0016.CHK\PAPYRUS.INF
C:\FOUND.002\DIR0015.CHK\CASCADE.INF
C:\FOUND.002\DIR0014.CHK\SYSTEM.DRAWING.DESIGN.DLL
C:\FOUND.002\DIR0013.CHK\SMARTNAV.HTM
C:\FOUND.002\DIR0011.CHK\ADVANCEDTOPICS.HTM
C:\FOUND.002\DIR0009.CHK\NSVD.EXE
C:\FOUND.002\DIR0008.CHK\CONVOLUTION3D.DLL
C:\FOUND.002\DIR0007.CHK\MICROSOFT.DIRECTX.DIRECTSOUND.DLL
C:\FOUND.002\DIR0006.CHK\AUXILIAIRE SP�CIALIS� V�T�RINAIRE - APPRENTISSAGE.RTF
C:\FOUND.002\DIR0005.CHK\LABORANTIN - TITRES EN ITALIQUE AVEC PHOTO.RTF
C:\FOUND.002\DIR0002.CHK\GESTIONNAIRE DU SPORT - PUCES.RTF
C:\FOUND.002\DIR0001.CHK\MENUISIER �B�NISTE - CENTR� AVEC PHOTO.RTF
C:\FOUND.001\DIR0032.CHK\INDEX.HTM
C:\FOUND.001\DIR0031.CHK\BLANK.INF
C:\FOUND.001\DIR0030.CHK\SPSTD5.INF
C:\FOUND.001\DIR0029.CHK\SPSTD1.INF
C:\FOUND.001\DIR0028.CHK\PHOTO.HTM
C:\FOUND.001\DIR0011.CHK\ALRULES.BIN
C:\FOUND.001\DIR0010.CHK\VOLUME.XML
C:\FOUND.000\DIR0018.CHK\ADJOINT ADMINISTRATIF - R�PONSE.RTF
C:\FOUND.000\DIR0017.CHK\CASCADEUR - R�PONSE.RTF
C:\FOUND.000\DIR0016.CHK\ANALYSTE FINANCIER.RTF
C:\FOUND.000\DIR0015.CHK\ANIMATEUR DE LOISIRS.RTF
C:\FOUND.000\DIR0014.CHK\CAMBISTE.RTF
C:\FOUND.000\DIR0013.CHK\AGENT DE PROPRET�.RTF
C:\FOUND.000\DIR0012.CHK\CARRELEUR-MOSA�STE.RTF
C:\FOUND.000\DIR0005.CHK\MSCORLIB.DLL
C:\FOUND.000\DIR0004.CHK\CAGCAT10.DLL
C:\FOUND.000\DIR0002.CHK\BLUEPRNT.INF
C:\FOUND.000\DIR0000.CHK\CLNTWRAP.HTM
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\00131F19ED370A80124978343115632D_F7996E1D-9AC2-40F5-9DDF-C2BD58B50BAD
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\DSS\MACHINEKEYS\0A9F566667FE6579667A76999A8AB534_F7996E1D-9AC2-40F5-9DDF-C2BD58B50BAD
--------------------------------------------------------------------------------
Options
Scanning engines:
F-Secure Libra: 2.4.2, 2008-01-06
F-Secure AVP: 7.0.171, 2008-01-07
F-Secure Orion: 1.2.37, 2008-01-07
F-Secure Blacklight: 1.0.64
F-Secure Pegasus: 1.19.0, 2007-11-31
Scanning options:
Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
Use Advanced heuristics
--------------------------------------------------------------------------------
Copyright © 1998-2007 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.
Comme je le disais dans un message précedent, en voulant desinstaller des programmes je suis tombé sur un "programme" assez farfelu :
petite corbeille en icone, suivie de outerinfo, utilisé rarement et dont le poids affiche 850 MO !!! En parcourant le forul, ill s'agirait d'un virus... Mais vu le poids de la chose j'ai un doute :)!!! Je transmets ci dessous le rappport Fsecure, at j'y ajouterai par la suite le rapport HIJACK. Erf, j'avais pourtant l'impression d'etre bien protégée!!! Avast, Zone Alarm, Adware, Merci par avance de vos reponses.
Scanning Report
Monday, January 07, 2008 10:53:48 - 13:09:02
Computer name: SYSTEME
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\ D:\ E:\ F:\ G:\
--------------------------------------------------------------------------------
Result: 13 malware found
HTML/AdClicker.A (virus)
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\K3S1Q3SX\SECURE32[1].HTM (Renamed & Submitted)
Vundo.gen38 (virus)
C:\WINDOWS\SYSTEM32\CXWHOLOG.INI (Submitted)
C:\WINDOWS\SYSTEM32\EOEWQTMP.INI (Submitted)
C:\WINDOWS\SYSTEM32\EXCOMJWR.INI (Submitted)
C:\WINDOWS\SYSTEM32\HKLCEGUP.INI (Submitted)
C:\WINDOWS\SYSTEM32\HVLKLDKL.INI (Submitted)
C:\WINDOWS\SYSTEM32\JJVUBJQD.INI (Submitted)
C:\WINDOWS\SYSTEM32\KAMWETOQ.INI (Submitted)
C:\WINDOWS\SYSTEM32\NAQCSWTS.INI (Submitted)
C:\WINDOWS\SYSTEM32\OSADRGXI.INI (Submitted)
C:\WINDOWS\SYSTEM32\PWHCJDTI.INI (Submitted)
C:\WINDOWS\SYSTEM32\SRBJUJOK.INI (Submitted)
W32/Horst.gen28 (virus)
C:\WINDOWS\SYSTEM\SMVSS.EXE (Submitted)
--------------------------------------------------------------------------------
Statistics
Scanned:
Files: 88948
System: 0
Not scanned: 42
Actions:
Disinfected: 0
Renamed: 1
Deleted: 0
None: 12
Submitted: 13
Files not scanned:
C:\PAGEFILE.SYS
C:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{ABE5591B-EE06-4DA2-AFF7-B3118AB221AC}.BIN
C:\FOUND.002\DIR0022.CHK\TOC.HTM
C:\FOUND.002\DIR0021.CHK\LSTVIEWS.INI
C:\FOUND.002\DIR0020.CHK\DIVX.INF
C:\FOUND.002\DIR0018.CHK\LFBMP13N.DLL
C:\FOUND.002\DIR0017.CHK\MSPFLTRS.DLL
C:\FOUND.002\DIR0017.CHK\OFETOC.XML
C:\FOUND.002\DIR0016.CHK\PAPYRUS.INF
C:\FOUND.002\DIR0015.CHK\CASCADE.INF
C:\FOUND.002\DIR0014.CHK\SYSTEM.DRAWING.DESIGN.DLL
C:\FOUND.002\DIR0013.CHK\SMARTNAV.HTM
C:\FOUND.002\DIR0011.CHK\ADVANCEDTOPICS.HTM
C:\FOUND.002\DIR0009.CHK\NSVD.EXE
C:\FOUND.002\DIR0008.CHK\CONVOLUTION3D.DLL
C:\FOUND.002\DIR0007.CHK\MICROSOFT.DIRECTX.DIRECTSOUND.DLL
C:\FOUND.002\DIR0006.CHK\AUXILIAIRE SP�CIALIS� V�T�RINAIRE - APPRENTISSAGE.RTF
C:\FOUND.002\DIR0005.CHK\LABORANTIN - TITRES EN ITALIQUE AVEC PHOTO.RTF
C:\FOUND.002\DIR0002.CHK\GESTIONNAIRE DU SPORT - PUCES.RTF
C:\FOUND.002\DIR0001.CHK\MENUISIER �B�NISTE - CENTR� AVEC PHOTO.RTF
C:\FOUND.001\DIR0032.CHK\INDEX.HTM
C:\FOUND.001\DIR0031.CHK\BLANK.INF
C:\FOUND.001\DIR0030.CHK\SPSTD5.INF
C:\FOUND.001\DIR0029.CHK\SPSTD1.INF
C:\FOUND.001\DIR0028.CHK\PHOTO.HTM
C:\FOUND.001\DIR0011.CHK\ALRULES.BIN
C:\FOUND.001\DIR0010.CHK\VOLUME.XML
C:\FOUND.000\DIR0018.CHK\ADJOINT ADMINISTRATIF - R�PONSE.RTF
C:\FOUND.000\DIR0017.CHK\CASCADEUR - R�PONSE.RTF
C:\FOUND.000\DIR0016.CHK\ANALYSTE FINANCIER.RTF
C:\FOUND.000\DIR0015.CHK\ANIMATEUR DE LOISIRS.RTF
C:\FOUND.000\DIR0014.CHK\CAMBISTE.RTF
C:\FOUND.000\DIR0013.CHK\AGENT DE PROPRET�.RTF
C:\FOUND.000\DIR0012.CHK\CARRELEUR-MOSA�STE.RTF
C:\FOUND.000\DIR0005.CHK\MSCORLIB.DLL
C:\FOUND.000\DIR0004.CHK\CAGCAT10.DLL
C:\FOUND.000\DIR0002.CHK\BLUEPRNT.INF
C:\FOUND.000\DIR0000.CHK\CLNTWRAP.HTM
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\00131F19ED370A80124978343115632D_F7996E1D-9AC2-40F5-9DDF-C2BD58B50BAD
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\DSS\MACHINEKEYS\0A9F566667FE6579667A76999A8AB534_F7996E1D-9AC2-40F5-9DDF-C2BD58B50BAD
--------------------------------------------------------------------------------
Options
Scanning engines:
F-Secure Libra: 2.4.2, 2008-01-06
F-Secure AVP: 7.0.171, 2008-01-07
F-Secure Orion: 1.2.37, 2008-01-07
F-Secure Blacklight: 1.0.64
F-Secure Pegasus: 1.19.0, 2007-11-31
Scanning options:
Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
Use Advanced heuristics
--------------------------------------------------------------------------------
Copyright © 1998-2007 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.
Configuration: Windows XP sp2 Internet Explorer 7.0 amd sempron 2800+ 1.6gh 1024 mo ram
2 réponses
-
Rebonjour, :)
Et voici le rappport hijack :)))
Logfile of HijackThis v1.99.1
Scan saved at 14:00:24, on 07/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\atwtusb.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Police française\police.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: CAdBlocker Object - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - C:\Program Files\Acronis\PrivacyExpert\Blocker.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Consulter les dictionnaires (SYSTRAN) - res://C:\Program Files\SYSTRAN\6\\GUIres.dll/lookup.js
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Traduire (SYSTRAN) - res://C:\Program Files\SYSTRAN\6\\GUIres.dll/translate.js
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Acronis Pop-up Blocker - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\Program Files\Acronis\PrivacyExpert\Blocker.dll
O9 - Extra 'Tools' menuitem: Acronis Pop-up Blocker - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\Program Files\Acronis\PrivacyExpert\Blocker.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - https://www.f-secure.com/en/home/support
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - (no file)
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL
O20 - Winlogon Notify: jkhfd - C:\WINDOWS\system32\jkhfd.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winhoo32 - winhoo32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\dljhpaey.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -
Bonjour,
N'ayant pas obtenu de reponses a ma question, je me demandais si le post avait été lu ;) ou si je n'avais simplement pas d'infection :))).
Merci de votre réponse
