Un virus me dérange - Page 2

Résolu
Précédent
  • 1
  • 2
  1. g!rly Messages postés 18462 Statut Contributeur 407
     
    salut,

    ouvre le bloc note et copie colle les commandes en gras :

    @echo on
    taskkill /im explorer.exe /f
    taskkill /im wscript.exe
    start reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\EXplorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 1 /f
    start reg import kill.reg
    del c:\autorun.* /f /q /as
    del %SYSTEMROOT%\system32\autorun.* /f /q /as
    del d:\autorun.* /f /q /as
    del e:\autorun.* /f /q /as
    del f:\autorun.* /f /q /as
    del g:\autorun.* /f /q /as
    del h:\autorun.* /f /q /as
    del i:\autorun.* /f /q /as
    del j:\autorun.* /f /q /as
    del k:\autorun.* /f /q /as
    del l:\autorun.* /f /q /as
    start explorer.exe

    ferme le bloc et enregistre le sur le bureau sous le nom de kill_autorun_vbs.bat

    va sur le bureau et double clik sur kill_autorun_vbs.bat et laisse le faire son boulot

    repost le rapport de g!rly.bat

    @+
    0
  2. gorBobs Messages postés 57 Statut Membre 1
     
    Combo Fix sur le même ordinateur:

    ComboFix 08-02.05.3 - HP_Propriétaire 2008-02-09 13:24:16.1 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.98 [GMT 1:00]
    Endroit: C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\QROTCDAT\ComboFix[1].exe
    * Création d'un nouveau point de restauration
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Autorun.inf
    C:\Documents and Settings\HP_Propriétaire\Application Data\MessengerSkinner
    C:\Documents and Settings\HP_Propriétaire\Application Data\MessengerSkinner\Userdata\defaultPack.cab
    C:\Documents and Settings\HP_Propriétaire\Application Data\MessengerSkinner\Userdata\languages.xml
    C:\Documents and Settings\HP_Propriétaire\Application Data\MessengerSkinner\Userdata\pack1.cab
    C:\Program Files\instant access
    C:\Program Files\instant access\Center\NoCreditCard.lnk
    C:\Program Files\instant access\DesktopIcons\NoCreditCard.lnk
    C:\Program Files\instant access\Multi\20070302170330\Common\module.php
    C:\Program Files\instant access\Multi\20070302170330\dialerexe.ini
    C:\Program Files\instant access\Multi\20070302170330\js\js_api_dialer.php
    C:\Program Files\instant access\Multi\20070302170330\medias\button1.gif
    C:\Program Files\instant access\Multi\20070302170330\medias\button2.gif
    C:\Program Files\instant access\Multi\20070302170330\medias\button3.gif
    C:\Program Files\instant access\Multi\20070302170330\medias\button4.gif
    C:\Program Files\instant access\Multi\20070302170330\medias\dialer.ico
    C:\Program Files\messengerskinner
    C:\WINDOWS\dialerexe.ini
    C:\WINDOWS\pack.epk
    C:\WINDOWS\setup.exe
    C:\WINDOWS\system32\amvo.exe
    C:\WINDOWS\system32\amvo1.dll
    C:\WINDOWS\system32\nvs2.inf
    C:\WINDOWS\system32\rxcqfvkli_navtmp.dat
    C:\WINDOWS\system32\xjflhapn.dat
    C:\WINDOWS\system32\xjflhapn.exe
    c:\WINDOWS\system32\xjflhapn_nav.dat
    C:\WINDOWS\system32\xjflhapn_navps.dat
    D:\Autorun.inf

    .
    ((((((((((((((((((((((((((((( Fichiers créés 2008-01-09 to 2008-02-09 ))))))))))))))))))))))))))))))))))))
    .

    2008-02-03 17:07 . 2008-02-03 17:06 103,870 -r-hs---- C:\2ifetri.cmd
    2008-02-03 17:05 . 2008-02-02 16:59 104,644 -r-hs---- C:\i.cmd
    2008-01-27 15:17 . 2008-01-21 12:45 106,358 -r-hs---- C:\xn1i9x.com

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-02-09 12:11 --------- d-----w C:\Program Files\Wanadoo
    2008-01-27 15:12 --------- d-----w C:\Program Files\Fichiers communs\Sandlot Shared
    2008-01-27 15:11 --------- d--h--w C:\Program Files\Fichiers communs\Carlson
    2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
    2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
    2007-11-14 07:28 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
    2006-09-24 09:33 208 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\wklnhst.dat
    2005-05-12 05:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]
    "MSNCleaner"="C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\O9UNCXYZ\MSNCleaner.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496]
    "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 17:04 52736]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-08 04:05 344064]
    "HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 07:35 49152]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-05-05 00:21 278528]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 21:43 233472]
    "PCDrProfiler"="" []
    "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 21:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 06:12 49152]
    "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10 409600]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-03 03:23 98304]
    "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-06-26 21:36 180269]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
    "EoEngine"="" []
    "EoSudoku"="" []
    "KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44 61440]
    "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
    "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]

    C:\Documents and Settings\HP_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
    D‚marrage d'Office.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [1996-12-16 23:00:00 51984]
    Microsoft Recherche acc‚l‚r‚e.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [1996-12-16 23:00:00 111376]

    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Adobe Gamma Loader.exe.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-23 14:02:20 98304]
    Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-23 14:02:20 98304]
    Contr“leur de calendrier Ulead.lnk - C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2006-06-16 16:35:04 69632]
    DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-02-24 18:31:12 962661]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 06:23:26 282624]
    Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]

    S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
    S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e32ec91-1431-11dc-af3c-4d6564696130}]
    \Shell\AutoRun\command - G:\LaunchU3.exe

    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-09 13:28:34
    Windows 5.1.2600 Service Pack 2 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-02-09 13:29:33
    ComboFix-quarantined-files.txt 2008-02-09 12:29:18
    .
    2008-01-09 00:21:17 --- E O F ---
    0
  3. gorBobs Messages postés 57 Statut Membre 1
     
    C:\autorun.inf Non trouvé
    C:\MS32DLL.dll.vbs Non trouvé
    D:\autorun.inf Non trouvé
    D:\MS32DLL.dll.vbs Non trouvé
    C:\WINDOWS\MS32DLL.dll.vbs non trouvé

    ! REG.EXE VERSION 3.0

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    hpsysdrv REG_SZ c:\windows\system\hpsysdrv.exe
    ATIPTA REG_SZ C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    HPHUPD08 REG_SZ c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
    Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
    PCDrProfiler REG_SZ
    AlcxMonitor REG_SZ ALCXMNTR.EXE
    HP Software Update REG_EXPAND_SZ C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    Easy-PrintToolBox REG_SZ C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
    QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
    TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    EoEngine REG_SZ
    EoSudoku REG_SZ
    KBD REG_SZ C:\HP\KBD\KBD.EXE
    WOOWATCH REG_SZ C:\PROGRA~1\Wanadoo\Watch.exe
    WOOTASKBARICON REG_SZ C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

    ! REG.EXE VERSION 3.0

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    WOOKIT REG_SZ C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
    updateMgr REG_SZ C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    MSNCleaner REG_SZ C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\O9UNCXYZ\MSNCleaner.exe
    0
  4. g!rly Messages postés 18462 Statut Contributeur 407
     
    ok

    Télécharge HijackThis ici :

    -> http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

    Tutoriel d´instalation : (Merci a Balltrap34 pour cette réalisation)

    -> http://pageperso.aol.fr/balltrap34/Hijenr.gif

    Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

    -> http://pageperso.aol.fr/balltrap34/demohijack.htm

    Post le rapport généré ici stp...

    @+
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. gorBobs Messages postés 57 Statut Membre 1
     
    Le rapport du logiciel:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:53:53, on 09/02/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\windows\system\hpsysdrv.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
    C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    O4 - HKCU\..\Run: [MSNCleaner] C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\O9UNCXYZ\MSNCleaner.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
    O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
    O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
    O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bobo-lescargot.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7E193F24-B422-4704-8286-3B9086AB0417}: NameServer = 80.10.246.1 81.253.149.2
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    0
  7. g!rly Messages postés 18462 Statut Contributeur 407
     
    re,

    Copie le texte ci-dessous :

    File::
    C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\O9UNCXYZ\MSNCleaner.exe
    C:\2ifetri.cmd
    C:\i.cmd
    C:\xn1i9x.com

    Folder::

    Registry::
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "EoEngine"=-
    "EoSudoku"=-
    "PCDrProfiler"=-
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSNCleaner"=-

    Ouvre le Bloc-Notes puis colle le texte copié.
    (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
    Sauvegarde ce fichier sous le nom de CFScript.txt.

    Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

    http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

    Cela va relancer Combofix,

    Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

    Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

    Ne touche à rien tant que le scan n'est pas terminé.

    Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

    S'il n'y a pas de rédémarrage, poste quand même les rapports.

    installes un par feu :

    par feu : kerio

    http://www.malekal.com/kerio_firewall.php#mozTocId721480

    https://www.vulgarisation-informatique.com/kerio.php

    https://kerio.probb.fr/f2-sunbelt-kerio-personal-firewall

    ou zone alarm plus facil a configurer mais moins performant

    https://www.malekal.com/tutoriel-zonealarm-firewall/

    puis

    regarde ceci concernant avast :

    antivir vs avast :

    -> http://forum.malekal.com/ftopic3528.php

    alors je te conseille de le desinstaller et d´installer antivir a la place

    Telecharge et instal l'antivirus Antivir Personal Edition Classic :

    ->https://www.malekal.com/avira-free-security-antivirus-gratuit/

    https://www.avira.com/en/prime

    http://mickael.barroux.free.fr/securite/antivir.php
    http://speedweb1.free.fr/frames2.php?page=tuto5
    <- tutoriel configuration du scanner...

    une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
    puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
    coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
    puis sur la droite coche les case suivantes :
    scan boot sectors of selected drives
    scan master boot sectors
    scan memory
    search foe rootkit before scan
    decoche :
    ignore off line files
    toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

    Je te dis tous ca par rapport a antivir car j´aimerais que tu fasse un scan complet de ta machine a l´aide de ce dernier avec les reglages stipulés ci dessus

    Donc post le rapport de combofix, celui de hijack this et celui d´antivir dans ta prochaine reponse

    bon courrage

    @+
    0
  8. gorBobs Messages postés 57 Statut Membre 1
     
    ComboFix 08-02.05.3 - HP_Propriétaire 2008-02-09 15:34:31.2 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.92 [GMT 1:00]
    Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
    Command switches used :: C:\Documents and Settings\HP_Propriétaire\Bureau\CFScript.txt
    * Création d'un nouveau point de restauration

    FILE
    C:\2ifetri.cmd
    C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\O9UNCXYZ\MSNCleaner.exe
    C:\i.cmd
    C:\xn1i9x.com
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\2ifetri.cmd
    C:\i.cmd
    C:\xn1i9x.com

    .
    ((((((((((((((((((((((((((((( Fichiers créés 2008-01-09 to 2008-02-09 ))))))))))))))))))))))))))))))))))))
    .

    2008-02-09 13:51 . 2008-02-09 13:51 <REP> d-------- C:\Program Files\Trend Micro
    2008-02-09 13:22 . 2004-08-05 19:00 400,896 --a------ C:\kmd.exe

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-02-09 12:33 --------- d-----w C:\Program Files\Wanadoo
    2008-01-27 15:12 --------- d-----w C:\Program Files\Fichiers communs\Sandlot Shared
    2008-01-27 15:11 --------- d--h--w C:\Program Files\Fichiers communs\Carlson
    2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
    2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
    2007-11-14 07:28 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
    2006-09-24 09:33 208 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\wklnhst.dat
    2005-05-12 05:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496]
    "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 17:04 52736]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-08 04:05 344064]
    "HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 07:35 49152]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-05-05 00:21 278528]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 21:43 233472]
    "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 21:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 06:12 49152]
    "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10 409600]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-03 03:23 98304]
    "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-06-26 21:36 180269]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
    "KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44 61440]
    "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
    "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]

    C:\Documents and Settings\HP_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
    D‚marrage d'Office.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [1996-12-16 23:00:00 51984]
    Microsoft Recherche acc‚l‚r‚e.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [1996-12-16 23:00:00 111376]

    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Adobe Gamma Loader.exe.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-23 14:02:20 98304]
    Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-23 14:02:20 98304]
    Contr“leur de calendrier Ulead.lnk - C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2006-06-16 16:35:04 69632]
    DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-02-24 18:31:12 962661]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 06:23:26 282624]
    Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]

    S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
    S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e32ec91-1431-11dc-af3c-4d6564696130}]
    \Shell\AutoRun\command - G:\LaunchU3.exe

    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-09 15:38:09
    Windows 5.1.2600 Service Pack 2 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-02-09 15:38:58
    ComboFix-quarantined-files.txt 2008-02-09 14:38:43
    ComboFix2.txt 2008-02-09 12:29:34
    .
    2008-01-09 00:21:17 --- E O F ---

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:42:39, on 09/02/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\windows\system\hpsysdrv.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
    C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
    O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
    O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
    O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bobo-lescargot.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7E193F24-B422-4704-8286-3B9086AB0417}: NameServer = 81.253.149.9 80.10.246.132
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    0
  9. g!rly Messages postés 18462 Statut Contributeur 407
     
    en attendanrt le rapport d´antivir ou apres

    tu pourras cocher ces lignes superflues et les fixer a l´aide de hijack this

    O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
    O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
    O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)

    comment fixer :

    Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

    -> http://pageperso.aol.fr/balltrap34/demohijack.htm

    ta version de acrobat reader n´est pas a jour, tu veux la version 8.1 derniere en date alors desinstale ta version par le panneau de configuration / ajoue et suppression de programme

    et instale la derniere :

    https://get2.adobe.com/reader/otherversions/

    ou foxit plus léger :

    https://www.clubic.com/telecharger-fiche13808-foxit-reader.html

    puis regarde ce tutorial pour mettre ta console java a jour :

    https://www.malekal.com/maintenir-java-adobe-reader-et-le-player-flash-a-jour/
    @+
    0
  10. gorBobs Messages postés 57 Statut Membre 1
     
    AntiVir PersonalEdition Classic
    Report file date: dimanche 10 février 2008 14:03

    Scanning for 1096761 virus strains and unwanted programs.

    Licensed to: Avira AntiVir PersonalEdition Classic
    Serial number: 0000149996-ADJIE-0001
    Platform: Windows XP
    Windows version: (Service Pack 2) [5.1.2600]
    Username: SYSTEM
    Computer name: LE-SEUL

    Version information:
    BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
    AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
    AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
    LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
    LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
    ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
    ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 12:50:37
    ANTIVIR2.VDF : 7.0.2.113 1673728 Bytes 08/02/2008 12:50:37
    ANTIVIR3.VDF : 7.0.2.114 2048 Bytes 08/02/2008 12:50:37
    AVEWIN32.DLL : 7.6.0.62 3240448 Bytes 10/02/2008 12:50:38
    AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
    AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
    AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
    AVPACK32.DLL : 7.6.0.3 360488 Bytes 10/02/2008 12:50:40
    AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
    AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
    AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
    NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
    RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
    RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
    SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

    Configuration settings for the scan:
    Jobname..........................: Complete system scan
    Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
    Logging..........................: low
    Primary action...................: interactive
    Secondary action.................: ignore
    Scan master boot sector..........: on
    Scan boot sector.................: on
    Boot sectors.....................: D:,
    Scan memory......................: on
    Process scan.....................: on
    Scan registry....................: on
    Search for rootkits..............: on
    Scan all files...................: All files
    Scan archives....................: on
    Recursion depth..................: 20
    Smart extensions.................: on
    Macro heuristic..................: on
    File heuristic...................: high

    Start of the scan: dimanche 10 février 2008 14:03

    Starting search for hidden objects.
    '48948' objects were checked, '0' hidden objects were found.

    The scan of running processes will be started
    Scan process 'avscan.exe' - '1' Module(s) have been scanned
    Scan process 'sched.exe' - '1' Module(s) have been scanned
    Scan process 'avgnt.exe' - '1' Module(s) have been scanned
    Scan process 'avguard.exe' - '1' Module(s) have been scanned
    Scan process 'firefox.exe' - '1' Module(s) have been scanned
    Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
    Scan process 'Watch.exe' - '1' Module(s) have been scanned
    Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
    Scan process 'alg.exe' - '1' Module(s) have been scanned
    Scan process 'CALMAIN.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
    Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
    Scan process 'ALERTM~1.EXE' - '1' Module(s) have been scanned
    Scan process 'PollingModule.exe' - '1' Module(s) have been scanned
    Scan process 'Inactivity.exe' - '1' Module(s) have been scanned
    Scan process 'Toaster.exe' - '1' Module(s) have been scanned
    Scan process 'FINDFAST.EXE' - '1' Module(s) have been scanned
    Scan process 'ComComp.exe' - '1' Module(s) have been scanned
    Scan process 'OSA.EXE' - '1' Module(s) have been scanned
    Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
    Scan process 'dslmon.exe' - '1' Module(s) have been scanned
    Scan process 'CalCheck.exe' - '1' Module(s) have been scanned
    Scan process 'EspaceWanadoo.exe' - '1' Module(s) have been scanned
    Scan process 'jusched.exe' - '1' Module(s) have been scanned
    Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
    Scan process 'kbd.exe' - '1' Module(s) have been scanned
    Scan process 'realsched.exe' - '1' Module(s) have been scanned
    Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
    Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
    Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned
    Scan process 'explorer.exe' - '1' Module(s) have been scanned
    Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
    Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
    Scan process 'lsass.exe' - '1' Module(s) have been scanned
    Scan process 'services.exe' - '1' Module(s) have been scanned
    Scan process 'winlogon.exe' - '1' Module(s) have been scanned
    Scan process 'csrss.exe' - '1' Module(s) have been scanned
    Scan process 'smss.exe' - '1' Module(s) have been scanned
    45 processes with 45 modules were scanned

    Starting master boot sector scan:
    Master boot sector HD0
    [NOTE] No virus was found!

    Start scanning boot sectors:
    Boot sector 'C:\'
    [NOTE] No virus was found!
    Boot sector 'D:\'
    [NOTE] No virus was found!

    Starting to scan the registry.
    The registry was scanned ( '42' files ).

    Starting the file scan:

    Begin scan in 'C:\' <HP_PAVILION>
    C:\hiberfil.sys
    [WARNING] The file could not be opened!
    C:\pagefile.sys
    [WARNING] The file could not be opened!
    C:\QooBox\Quarantine\C\2ifetri.cmd.vir
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '4814fe06.qua'!
    C:\QooBox\Quarantine\C\i.cmd.vir
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '4811fdd2.qua'!
    C:\QooBox\Quarantine\C\WINDOWS\system32\amvo.exe.vir
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '4824fe17.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP270\A0048152.exe
    [DETECTION] Is the Trojan horse TR/Dropper.Gen
    [INFO] The file was moved to '47defe16.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP275\A0051881.exe
    [DETECTION] Contains detection pattern of the dial-up program DIAL/170041.A
    [INFO] The file was moved to '47defe3e.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP276\A0051882.com
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe43.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP276\A0051896.dll
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe48.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP276\A0051897.com
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe4d.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051902.com
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe51.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051922.dll
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe55.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051926.com
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe58.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051939.exe
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe5b.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051960.exe
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe5f.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051974.dll
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe62.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051975.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe66.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051993.dll
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe6e.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051994.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe75.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0052005.dll
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe7a.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0052006.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe7d.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP278\A0052010.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe81.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP278\A0052022.dll
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe84.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP279\A0052027.dll
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe88.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP279\A0052035.exe
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe8a.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP280\A0052118.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe91.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP280\A0052119.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe93.qua'!
    C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP280\A0052120.com
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47defe96.qua'!
    Begin scan in 'D:\' <HP_RECOVERY>
    D:\xn1i9x.com
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47e003d5.qua'!
    D:\i.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '4812039b.qua'!
    D:\2ifetri.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '481503da.qua'!
    D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051904.com
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47df07f8.qua'!
    D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051928.com
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47df07fb.qua'!
    D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051977.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47df07fe.qua'!
    D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051996.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47df0801.qua'!
    D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0052008.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47df0805.qua'!
    D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP278\A0052012.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47df0807.qua'!
    D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP276\A0051884.com
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47df0809.qua'!
    D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP276\A0051899.com
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47df080b.qua'!
    D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP287\A0052991.com
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47df080e.qua'!
    D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP287\A0052992.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47df0810.qua'!
    D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP287\A0052993.cmd
    [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen
    [INFO] The file was moved to '47df0812.qua'!

    End of the scan: dimanche 10 février 2008 15:19
    Used time: 1:16:10 min

    The scan has been done completely.

    7417 Scanning directories
    405147 Files were scanned
    40 viruses and/or unwanted programs were found
    0 Files were classified as suspicious:
    0 files were deleted
    0 files were repaired
    40 files were moved to quarantine
    0 files were renamed
    2 Files cannot be scanned
    405107 Files not concerned
    14002 Archives were scanned
    2 Warnings
    0 Notes
    48948 Objects were scanned with rootkit scan
    0 Hidden objects were found
    0
  11. g!rly Messages postés 18462 Statut Contributeur 407
     
    salut,

    bon c´est pas trop mal.

    fais encore ce scan stp

    A.V.G :

    -> Télécharger AVG Anti-Spyware (ewido)

    http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware

    -> L´installer.

    -> lancer AVG Anti-Spyware et clicker sur le bouton Mise à jour. Patienter...

    p.s : si les mises a jours ne se font pas, elles sont telechargable ici :

    http://downloads.ewido.net/avgas-signatures-full-current.exe

    -> Sur la page "analyse":

    choisir d´abord l'onglet "paramètres".

    sous « Comment réagir » clicker sur « Actions recommandées » et dans le menu déroulant, choisir « Supprimer ».

    -> Lancer le scan, (c´est long...).

    -> A la fin du scan copier Et coller le rapport ici.

    -> Une aide en image au cas ou :

    Tutoriel d´installation et de parametrages :

    http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html

    Note : supprime bien tout ce qui va etre trouvé et post le rapport ici

    @++
    0
  12. gorBobs Messages postés 57 Statut Membre 1
     
    ---------------------------------------------------------
    AVG Anti-Spyware - Rapport d'analyse
    ---------------------------------------------------------

    + Créé à: 19:49:20 11/02/2008

    + Résultat de l'analyse:

    :mozilla.565:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
    :mozilla.566:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
    :mozilla.567:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
    :mozilla.568:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
    :mozilla.132:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
    :mozilla.133:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
    :mozilla.134:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
    :mozilla.135:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
    :mozilla.403:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
    :mozilla.926:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
    :mozilla.283:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adbrite : Aucune action entreprise.
    :mozilla.284:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adbrite : Aucune action entreprise.
    :mozilla.159:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
    :mozilla.160:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
    :mozilla.161:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
    :mozilla.162:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
    :mozilla.163:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
    :mozilla.164:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
    :mozilla.165:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
    :mozilla.166:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
    :mozilla.354:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adtech : Aucune action entreprise.
    :mozilla.355:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adtech : Aucune action entreprise.
    :mozilla.417:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
    :mozilla.418:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
    :mozilla.419:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
    :mozilla.420:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
    :mozilla.421:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
    :mozilla.340:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Atdmt : Aucune action entreprise.
    C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
    :mozilla.156:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
    C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@bluestreak[2].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
    :mozilla.886:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Burstnet : Aucune action entreprise.
    :mozilla.887:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Burstnet : Aucune action entreprise.
    :mozilla.329:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
    :mozilla.330:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
    :mozilla.331:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
    :mozilla.332:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
    :mozilla.333:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
    :mozilla.250:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casinotropez : Aucune action entreprise.
    :mozilla.251:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casinotropez : Aucune action entreprise.
    :mozilla.414:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
    :mozilla.415:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
    :mozilla.416:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
    :mozilla.10:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
    C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
    :mozilla.223:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Estat : Aucune action entreprise.
    C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
    :mozilla.809:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Fastclick : Aucune action entreprise.
    :mozilla.810:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Fastclick : Aucune action entreprise.
    :mozilla.572:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Gemius : Aucune action entreprise.
    :mozilla.573:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Gemius : Aucune action entreprise.
    :mozilla.405:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
    :mozilla.406:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
    :mozilla.871:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
    :mozilla.872:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
    :mozilla.873:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
    :mozilla.919:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
    :mozilla.157:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Imrworldwide : Aucune action entreprise.
    :mozilla.158:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Imrworldwide : Aucune action entreprise.
    :mozilla.822:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Ivwbox : Aucune action entreprise.
    :mozilla.54:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
    :mozilla.59:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
    :mozilla.60:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
    C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
    :mozilla.603:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Onestat : Aucune action entreprise.
    :mozilla.604:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Onestat : Aucune action entreprise.
    :mozilla.92:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Overture : Aucune action entreprise.
    :mozilla.93:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Overture : Aucune action entreprise.
    :mozilla.323:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Revenue : Aucune action entreprise.
    :mozilla.191:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
    :mozilla.192:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
    :mozilla.193:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
    :mozilla.194:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
    :mozilla.195:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
    :mozilla.196:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
    :mozilla.197:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
    :mozilla.91:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
    :mozilla.94:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
    :mozilla.95:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
    :mozilla.96:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
    :mozilla.97:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
    :mozilla.714:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Statcounter : Aucune action entreprise.
    :mozilla.47:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
    :mozilla.48:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
    :mozilla.49:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
    :mozilla.50:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
    C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
    :mozilla.839:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Trafficmp : Aucune action entreprise.
    :mozilla.840:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Trafficmp : Aucune action entreprise.
    :mozilla.806:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Vegasred : Aucune action entreprise.
    :mozilla.807:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Vegasred : Aucune action entreprise.
    :mozilla.13:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
    :mozilla.14:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
    :mozilla.145:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Webtrendslive : Aucune action entreprise.
    :mozilla.325:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
    :mozilla.326:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
    :mozilla.327:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
    :mozilla.328:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
    :mozilla.247:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.
    :mozilla.248:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.
    :mozilla.249:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.

    Fin du rapport
    0
  13. g!rly Messages postés 18462 Statut Contributeur 407
     
    Salut,

    repost un nouveau hijack this stp

    @+
    0
  14. gorBobs Messages postés 57 Statut Membre 1
     
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:57:18, on 11/02/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\windows\system\hpsysdrv.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
    C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
    O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bobo-lescargot.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7E193F24-B422-4704-8286-3B9086AB0417}: NameServer = 81.253.149.1 80.10.246.3
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    0
  15. g!rly Messages postés 18462 Statut Contributeur 407
     
    Re,

    fais ceci :

    demarrer / executer tape sc stop FTRTSVC puis valide par ok

    demarrer/ executer tape sc delete FTRTSVC puis valide par ok"

    C´est un parsite/ espion de france telecom...

    comment va ton pc?

    @+
    0
  16. gorBobs Messages postés 57 Statut Membre 1
     
    Il a l'aire d'aller bien...

    Merci
    0
  17. g!rly Messages postés 18462 Statut Contributeur 407
     
    Ok

    Fais ceci :

    Désactive ta restauration système:
    pour cela :
    Click droit sur poste de travail, dans l´arborescence sur propriétés;
    dans la nouvelle fenettre click sur l´onglet restauration système;
    coche la case désactiver la restauration systèm et applique.
    puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés;
    dans la nouvelle fenettre click sur l´onglet restauration systèm
    décoche la case désactiver la restauration systèm et applique.

    puis

    Télécharge ToolsCleaner sur ton bureau.
    --> http://www.commentcamarche.net/telecharger/telechargement 34055291 toolsclean(...)
    # Clique sur Recherche et laisse le scan agir ...
    # Clique sur Suppression pour finaliser.
    # Tu peux, si tu le souhaites, te servir des Options facultatives.
    # Clique sur Quitter pour obtenir le rapport.
    # Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

    @+
    0
  18. gorBobs Messages postés 57 Statut Membre 1
     
    -->- Recherche:

    C:\Qoobox: trouvé !
    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
    C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe: trouvé !
    C:\Documents and Settings\HP_Propriétaire\Bureau\Divers\HijackThis.lnk: trouvé !
    C:\Program Files\Trend Micro\HijackThis: trouvé !
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
    C:\QooBox\Quarantine\C\Combofix: trouvé !

    ---------------------------------
    -->- Suppression:

    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
    C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe: supprimé !
    C:\Documents and Settings\HP_Propriétaire\Bureau\Divers\HijackThis.lnk: supprimé !
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
    C:\Qoobox: supprimé !
    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
    C:\Program Files\Trend Micro\HijackThis: supprimé !
    0
  19. g!rly Messages postés 18462 Statut Contributeur 407
     
    salut gorBobs,

    bien joué ;-)

    dis moi quoi

    @+
    0
  20. gorBobs Messages postés 57 Statut Membre 1
     
    Merci de m'avoir aider à résoudre ces problèmes...
    0
  21. g!rly Messages postés 18462 Statut Contributeur 407
     
    De rien ;-)
    Bonne continuation`
    Bye`
    0
Précédent
  • 1
  • 2

Discussions similaires

Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
impossible de terminer l’opération car virus Win 7
Slipt -
Malekal_morte- -

2 réponses
Virus dans filezilla
balnelius10 -
fabul -

9 réponses