Avis sur ce rapport hijackthis
Résolu
sabinop
Messages postés
36
Statut
Membre
-
g!rly Messages postés 18462 Statut Contributeur -
g!rly Messages postés 18462 Statut Contributeur -
Bonjour,
J'ai déja posté ce message mais je crois que le titre du message ne correspondait pas à ma demande,
c'est pour cela que je change de forum merci.
Ce pc est celui de ma fille et il beugue beaucoup ,même pour effectuer le scan avec HijackThis cela a été difficile.
Evidement n' étant pas calé dutout en informatique je demande de l'aide pour analyser ce rapport .
Merci par avance et j'espère que j'ai mis le maximun d'infos .
Le rapport qui suit est celui d'un Pc portable Packard Bell Esasy Note
Amd Turion (tm) 64 mobille tecnhologie ML-32 792Mhz 512 de Ram
Logfile of HijackThis v1.99.1
Scan saved at 15:37:10, on 01/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Apps\Powercinema\PCMService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\ctfmon.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PBFRV2 - {4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} - C:\WINDOWS\system32\pbfrv2.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PBFRV2 - {4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} - C:\WINDOWS\system32\pbfrv2.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [\\Cravo\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P34 "\\Cravo\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P58 "Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO" /O16 "\\CRAVO\AutoEPSO" /M "Stylus CX3600"
O4 - HKCU\..\Run: [Bintype] C:\DOCUME~1\MLANIE~1\APPLIC~1\COOLDO~1\Win Part Lite.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?d8b947208a7a4892adf5a945f6cc07db
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?d8b947208a7a4892adf5a945f6cc07db
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
Configuration: Windows XP
Firefox 2.0.0.11
J'ai déja posté ce message mais je crois que le titre du message ne correspondait pas à ma demande,
c'est pour cela que je change de forum merci.
Ce pc est celui de ma fille et il beugue beaucoup ,même pour effectuer le scan avec HijackThis cela a été difficile.
Evidement n' étant pas calé dutout en informatique je demande de l'aide pour analyser ce rapport .
Merci par avance et j'espère que j'ai mis le maximun d'infos .
Le rapport qui suit est celui d'un Pc portable Packard Bell Esasy Note
Amd Turion (tm) 64 mobille tecnhologie ML-32 792Mhz 512 de Ram
Logfile of HijackThis v1.99.1
Scan saved at 15:37:10, on 01/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Apps\Powercinema\PCMService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\ctfmon.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PBFRV2 - {4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} - C:\WINDOWS\system32\pbfrv2.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PBFRV2 - {4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} - C:\WINDOWS\system32\pbfrv2.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [\\Cravo\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P34 "\\Cravo\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P58 "Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO" /O16 "\\CRAVO\AutoEPSO" /M "Stylus CX3600"
O4 - HKCU\..\Run: [Bintype] C:\DOCUME~1\MLANIE~1\APPLIC~1\COOLDO~1\Win Part Lite.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?d8b947208a7a4892adf5a945f6cc07db
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?d8b947208a7a4892adf5a945f6cc07db
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
Configuration: Windows XP
Firefox 2.0.0.11
Configuration: Windows XP Firefox 2.0.0.12
21 réponses
- 1
- 2
Suivant
Résumé de la discussion
Le fil porte sur un PC portable Packard Bell sous Windows XP qui rame et nécessite l’analyse d’un rapport HijackThis pour identifier des éléments potentiellement indésirables. Des conseils privilégient le remplacement d'AVG Free par Avira Antivir Personal et un diagnostic complet, avec configuration en mode expert et balayage des rootkits, mémoire et master boot sector, puis un nouveau rapport HijackThis. D'autres réponses recommandent des actions complémentaires, comme vider les fichiers temporaires, désinstaller des programmes indésirables, et réaliser des scans supplémentaires avec des outils gratuits, notamment. Certains éléments détectés peuvent être légitimes (par exemple des services Java ou des composants logiciels), il convient donc de vérifier leur fonction avant toute suppression afin d'éviter des dysfonctionnements.
-
Bonsoir sabinop,
je voie que ce n´est pas tres propre.
maman va avoir du travail ;-)
Télécharge combofix.exe (par sUBs) sur ton Bureau.
-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message ainsi qu´un nouveau hijack this.
@+-
tout d'abord merci de me donner de ton temps et ( je remercie aussi tous ceux qui m'ont répondu ) je joins le travail que tu m'a demandé .
ComboFix 08-02-13.2 - Mélanie Cravo 2008-02-13 10:12:52.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.221 [GMT 1:00]
Endroit: C:\Documents and Settings\Mélanie Cravo\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
.
((((((((((((((((((((((((((((( Fichiers créés 2008-01-13 to 2008-02-13 ))))))))))))))))))))))))))))))))))))
.
2008-02-01 19:36 . 2007-01-18 13:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-02-01 15:33 . 2008-02-01 15:37 <REP> d-------- C:\Program Files\Hijackthis Version Française
2008-02-01 14:02 . 2008-02-01 15:19 <REP> d-------- C:\Program Files\a-squared Free
2008-01-18 21:42 . 2008-01-18 21:42 268 --ah----- C:\sqmdata05.sqm
2008-01-18 21:42 . 2008-01-18 21:42 232 --ah----- C:\sqmdata08.sqm
2008-01-18 21:42 . 2008-01-18 21:42 148 --ah----- C:\sqmdata09.sqm
2008-01-18 21:42 . 2008-01-18 21:42 148 --ah----- C:\sqmdata07.sqm
2008-01-18 21:42 . 2008-01-18 21:42 148 --ah----- C:\sqmdata06.sqm
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-07 20:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2008-02-01 14:45 920 ----a-w C:\Documents and Settings\Mélanie Cravo\Application Data\wklnhst.dat
2008-02-01 14:22 --------- d-----w C:\Program Files\Macrogaming
2008-02-01 12:55 --------- d-----w C:\Program Files\Lavasoft
2008-02-01 12:55 --------- d-----w C:\Documents and Settings\Mélanie Cravo\Application Data\Lavasoft
2008-01-27 14:13 --------- d-----w C:\Documents and Settings\Mélanie Cravo\Application Data\OpenOffice.org2
2007-12-30 10:26 --------- d-----w C:\Program Files\eMule
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D}]
C:\WINDOWS\system32\pbfrv2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{EE5D279F-081B-4404-994D-C6B60AAEBA6D}
[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d}]
[HKEY_CLASSES_ROOT\pbfrv2.PBFRV2]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D}"= C:\WINDOWS\system32\pbfrv2.dll [ ]
[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d}]
[HKEY_CLASSES_ROOT\pbfrv2.PBFRV2]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bintype"="C:\DOCUME~1\MLANIE~1\APPLIC~1\COOLDO~1\Win Part Lite.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
"\\Cravo\EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 04:00 98304]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 13:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 13:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 13:00 455168]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 11:12 102492]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 11:11 692316]
"SoundMan"="SOUNDMAN.EXE" [2005-01-20 19:04 77824 C:\WINDOWS\SOUNDMAN.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"PCMService"="c:\Apps\Powercinema\PCMService.exe" [2005-04-29 08:07 127118]
"EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 04:00 98304]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-29 18:49 579072]
"\\Cravo\EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 04:00 98304]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-09-02 13:22 180269]
"Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 04:00 98304]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 19:10 219136]
R3 CIR;Hid Device;C:\WINDOWS\system32\DRIVERS\CIR.sys [2005-05-20 08:01]
R3 kbd;Keyboard;C:\WINDOWS\system32\DRIVERS\kbd.sys [2005-05-20 08:31]
R3 ULI5261;ULi Based Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN.SYS [2004-12-31 14:24]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64fa5718-9ebe-11dc-ac5f-00038a000015}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-12 15:41:01 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-13 10:15:23
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
\\Cravo\EPSON Stylus CX3600 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P34 "\\Cravo\EPSON Stylus CX3600 Series" /M "Stylus CX3600" /EF "HKCU"????????????????????????????????p???W?<~0?9~????*?9~??9~??????;~:? ???????????????V???9~????????????????????T???????????W?<~??9~??????9~??9~??V???????????9~???????????????????????????????|??????????V???????????????;~s?9~??9~-?:~:? ?????????,???????????1????m??/???W???????4????Y:~:? ?????????????P???????????????T????Y:~????P????????S??????????????X?;~????P???????j?;~P???????8???????????`??
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\\\Cravo\\EPSON Stylus CX3600 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATI9BE.EXE /P34 \"\\\\Cravo\\EPSON Stylus CX3600 Series\" /O6 \"USB001\" /M \"Stylus CX3600\""
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\\\Cravo\\EPSON Stylus CX3600 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATI9BE.EXE /P34 \"\\\\Cravo\\EPSON Stylus CX3600 Series\" /M \"Stylus CX3600\" /EF \"HKCU\"\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0àØ\12\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0pÙ\12\[u]0/u0W\[u]0/u4<~0ˆ9~ÿÿÿÿ*ˆ9~À´9~\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0?å;~:\[u]0/u1\[u]0/ua\[u]0/u0‚\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\14ªV\[u]0/u0Ë´9~\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0ÀÙ\12\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0TÙ\12\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0ˆþ\12\[u]0/u0W\[u]0/u4<~д9~ÿÿÿÿË´9~½Ú9~\[u]0/u0ªV\[u]0/u0‚\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0ßÚ9~\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/ucÚ\12\[u]0/u0ãê‘|ÀÙ\12\[u]0/u0\18\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0ªV\[u]0/u0‚\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0?å;~s´9~öÚ9~-Û:~:\[u]0/u1\[u]0/ua\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0,\[u]0/u1\[u]0/u9\[u]0/u0\[u]0/u2\[u]0/u2\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u01\[u]0/u0\[u]0/u8\[u]0/u0\[u]0/u3m\[u]0/u3\[u]0/u0/\[u]0/u2\[u]0/u0\[u]0/u0W\[u]0/u2\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u04Ú\12\[u]0/u0?Y:~:\[u]0/u1\[u]0/ua\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0PÒ¤\[u]0/u0\[u]0/u0\[u]0/u0¤\[u]0/u0ÿÿÿÿ\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0TÚ\12\[u]0/u0Y:~\[u]0/u0\[u]0/u0¤\[u]0/u0PÒ¤\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/ubS\[u]0/u2\10¨Ú\12\[u]0/u0\[u]0/u3\[u]0/u0\[u]0/u0\[u]0/u0€Ú\12\[u]0/u0X±;~\[u]0/u0\[u]0/u0¤\[u]0/u0PÒ¤\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0j±;~PÒ¤\[u]0/u0\[u]0/u0\[u]0/u0¤\[u]0/u08í\12\[u]0/u0\[u]0/u4\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0`ç\12"
.
Temps d'accomplissement: 2008-02-13 10:15:57
.
2008-01-10 20:10:38 --- E O F ---
Hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 10:32:47, on 13/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLUPnPBrowser.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PBFRV2 - {4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} - C:\WINDOWS\system32\pbfrv2.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PBFRV2 - {4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} - C:\WINDOWS\system32\pbfrv2.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [\\Cravo\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P34 "\\Cravo\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P58 "Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO" /O16 "\\CRAVO\AutoEPSO" /M "Stylus CX3600"
O4 - HKCU\..\Run: [Bintype] C:\DOCUME~1\MLANIE~1\APPLIC~1\COOLDO~1\Win Part Lite.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?d8b947208a7a4892adf5a945f6cc07db
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?d8b947208a7a4892adf5a945f6cc07db
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe -
salut sabinop,
Copie le texte ci-dessous :
File::
C:\DOCUME~1\MLANIE~1\APPLIC~1\COOLDO~1\Win Part Lite.exe
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D}"=-
[-HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d}]
[-HKEY_CLASSES_ROOT\pbfrv2.PBFRV2]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D}"=-
[-HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d}]
[-HKEY_CLASSES_ROOT\pbfrv2.PBFRV2]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bintype"=-
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt2 accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
puis post aussi le rapport du logiciel que nardino voulait te faire passer :
Télécharge Lop S&D (de Angeldark et Eric71) sur le Bureau :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7crPW-mouMdBfVK6f3sPUapdg4hQngU7HgbyFsjR1dD3-TqtdVs0SMRrdcdNC7rmqax1GJa3lMBhw4WnFlfv3Pv6p78xJeLuL7OAVVlKBRcdJRu0uFv1MpM3um1jegyBBCiIlb-2vFxKwIF_rTHq9-XXVjySFdSH_F1Pj_BExu-b9p26-am8ve-dqiTUXvzYlXDAT5GWnSimZIPHtF77f1BE1nLOHA%3D%3D&attredirects=3
[*]Double-clique sur Lop S&D.exe pour lancer l'installation,
[*]Puis double-clique sur le raccourci Lop S&D présent sur le Bureau.
[*]Séléctionne la langue souhaitée , puis choisis l'Option 1 (Recherche)
Le scan prend moins d'une minute.
[*]A l'issue du scan, le bloc-notes va s'ouvrir avec le résultat de la recherche.
[*]Enregistre le rapport LopR.txt sur le Bureau pour le retrouver facilement, sinon il sauvegardé à la racine de la partition système : C:\LopR.txt
[*]Post le rapport de l´option 1 ici stp
Tutoriel par Eric71
https://sites.google.com/site/eric71mespages/lop.sd.exe
Bonne soirée
@+ -
Bonjour girly et merci pour ta patience et ton travail
Je te signale que depuis j'ai installé Avg anti spywares et que j'ai fait
quelques petites bidouilles j'espèreque cela n' aucune concequence mais je voulais te le faire savoir .J'ai procéder comme tu me l'a demander et voici les rapports.
ComboFix 08-02-14.1 - Mélanie Cravo 2008-02-14 9:23:04.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.152 [GMT 1:00]
Endroit: C:\Documents and Settings\Mélanie Cravo\Mes documents\Telechargements\ComboFix.exe
Command switches used :: C:\Documents and Settings\Mélanie Cravo\Bureau\CFScript.txt..txt
* Création d'un nouveau point de restauration
FILE
C:\DOCUME~1\MLANIE~1\APPLIC~1\COOLDO~1\Win Part Lite.exe
.
((((((((((((((((((((((((((((( Fichiers créés 2008-01-14 to 2008-02-14 ))))))))))))))))))))))))))))))))))))
.
2008-02-14 09:17 . 2008-02-14 09:17 <REP> d-------- C:\WINDOWS\LastGood
2008-02-13 13:21 . 2008-02-13 13:21 <REP> d-------- C:\Documents and Settings\Mélanie Cravo\Application Data\Grisoft
2008-02-13 13:20 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-13 11:33 . 2008-02-13 11:33 <REP> d-------- C:\Documents and Settings\Mélanie Cravo\DoctorWeb
2008-02-13 11:33 . 2008-02-13 11:33 <REP> d-------- C:\Documents and Settings\Mélanie Cravo\DoctorWeb
2008-02-01 19:36 . 2007-01-18 13:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-02-01 15:33 . 2008-02-13 16:59 <REP> d-------- C:\Program Files\Hijackthis Version Française
2008-02-01 14:02 . 2008-02-13 11:20 <REP> d-------- C:\Program Files\a-squared Free
2008-01-18 21:42 . 2008-01-18 21:42 268 --ah----- C:\sqmdata05.sqm
2008-01-18 21:42 . 2008-01-18 21:42 232 --ah----- C:\sqmdata08.sqm
2008-01-18 21:42 . 2008-01-18 21:42 148 --ah----- C:\sqmdata09.sqm
2008-01-18 21:42 . 2008-01-18 21:42 148 --ah----- C:\sqmdata07.sqm
2008-01-18 21:42 . 2008-01-18 21:42 148 --ah----- C:\sqmdata06.sqm
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-13 16:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2008-02-13 15:54 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-02-13 12:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-01 14:45 920 ----a-w C:\Documents and Settings\Mélanie Cravo\Application Data\wklnhst.dat
2008-02-01 14:22 --------- d-----w C:\Program Files\Macrogaming
2008-02-01 12:55 --------- d-----w C:\Program Files\Lavasoft
2008-02-01 12:55 --------- d-----w C:\Documents and Settings\Mélanie Cravo\Application Data\Lavasoft
2008-01-27 14:13 --------- d-----w C:\Documents and Settings\Mélanie Cravo\Application Data\OpenOffice.org2
2007-12-30 10:26 --------- d-----w C:\Program Files\eMule
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
"\\Cravo\EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 04:00 98304]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 13:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 13:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 13:00 455168]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 11:12 102492]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 11:11 692316]
"SoundMan"="SOUNDMAN.EXE" [2005-01-20 19:04 77824 C:\WINDOWS\SOUNDMAN.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"PCMService"="c:\Apps\Powercinema\PCMService.exe" [2005-04-29 08:07 127118]
"EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 04:00 98304]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-29 18:49 579072]
"\\Cravo\EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 04:00 98304]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-09-02 13:22 180269]
"Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 04:00 98304]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 19:10 219136]
R3 CIR;Hid Device;C:\WINDOWS\system32\DRIVERS\CIR.sys [2005-05-20 08:01]
R3 kbd;Keyboard;C:\WINDOWS\system32\DRIVERS\kbd.sys [2005-05-20 08:31]
R3 ULI5261;ULi Based Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN.SYS [2004-12-31 14:24]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64fa5718-9ebe-11dc-ac5f-00038a000015}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-13 16:41:18 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-14 09:25:37
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
\\Cravo\EPSON Stylus CX3600 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P34 "\\Cravo\EPSON Stylus CX3600 Series" /M "Stylus CX3600" /EF "HKCU"????????????????????????????????p???W?<~0?9~????*?9~??9~??????;~:? ???????????????V???9~????????????????????T???????????W?<~??9~??????9~??9~??V???????????9~???????????????????????????????|??????????V???????????????;~s?9~??9~-?:~:? ?????????,???????????1????m??/???W???????4????Y:~:? ?????????????P???????????????T????Y:~????P????????S??????????????X?;~????P???????j?;~P???????8???????????`??
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\\\Cravo\\EPSON Stylus CX3600 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATI9BE.EXE /P34 \"\\\\Cravo\\EPSON Stylus CX3600 Series\" /O6 \"USB001\" /M \"Stylus CX3600\""
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\\\Cravo\\EPSON Stylus CX3600 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATI9BE.EXE /P34 \"\\\\Cravo\\EPSON Stylus CX3600 Series\" /M \"Stylus CX3600\" /EF \"HKCU\"\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0àØ\12\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0pÙ\12\[u]0/u0W\[u]0/u4<~0ˆ9~ÿÿÿÿ*ˆ9~À´9~\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0?å;~:\[u]0/u1\[u]0/ua\[u]0/u0‚\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\14ªV\[u]0/u0Ë´9~\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0ÀÙ\12\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0TÙ\12\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0ˆþ\12\[u]0/u0W\[u]0/u4<~д9~ÿÿÿÿË´9~½Ú9~\[u]0/u0ªV\[u]0/u0‚\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0ßÚ9~\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/ucÚ\12\[u]0/u0ãê‘|ÀÙ\12\[u]0/u0\18\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0ªV\[u]0/u0‚\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0?å;~s´9~öÚ9~-Û:~:\[u]0/u1\[u]0/ua\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0,\[u]0/u1\[u]0/u9\[u]0/u0\[u]0/u2\[u]0/u2\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u01\[u]0/u0\[u]0/u8\[u]0/u0\[u]0/u3m\[u]0/u3\[u]0/u0/\[u]0/u2\[u]0/u0\[u]0/u0W\[u]0/u2\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u04Ú\12\[u]0/u0?Y:~:\[u]0/u1\[u]0/ua\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0PÒ¤\[u]0/u0\[u]0/u0\[u]0/u0¤\[u]0/u0ÿÿÿÿ\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0TÚ\12\[u]0/u0Y:~\[u]0/u0\[u]0/u0¤\[u]0/u0PÒ¤\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/ubS\[u]0/u2\10¨Ú\12\[u]0/u0\[u]0/u3\[u]0/u0\[u]0/u0\[u]0/u0€Ú\12\[u]0/u0X±;~\[u]0/u0\[u]0/u0¤\[u]0/u0PÒ¤\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0j±;~PÒ¤\[u]0/u0\[u]0/u0\[u]0/u0¤\[u]0/u08í\12\[u]0/u0\[u]0/u4\[u]0/u1\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0\[u]0/u0`ç\12"
.
Temps d'accomplissement: 2008-02-14 9:26:19
ComboFix2.txt 2008-02-13 09:15:57
.
2008-01-10 20:10:38 --- E O F ---
Logfile of HijackThis v1.99.1
Scan saved at 09:41:13, on 14/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\slserv.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [\\Cravo\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P34 "\\Cravo\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P58 "Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO" /O16 "\\CRAVO\AutoEPSO" /M "Stylus CX3600"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?d8b947208a7a4892adf5a945f6cc07db
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?d8b947208a7a4892adf5a945f6cc07db
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
-----------------------------[ Lop S&D 2.3.4 ]---------------------------
[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : M‚lanie Cravo ] [ "C:\Program Files\Lop SD" ]
[ 14/02/2008 | 9:56:23,37 ] [ PC : MLANIE ]
[ MAJ : 12-02-2008 | 21:52 ]
-------------[ Listing des dossiers dans Application Data ]------------
[08/12/2007|15:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.
[08/12/2007|15:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\..
[02/09/2005|13:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[23/09/2006|12:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
[13/02/2008|17:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg7
[27/09/2006|17:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[16/08/2004|16:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[29/10/2006|10:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[13/02/2008|13:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[16/11/2006|21:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[01/02/2008|13:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[02/09/2005|13:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[16/08/2004|17:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[11/10/2006|19:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[08/12/2007|15:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
[02/09/2005|13:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
[24/09/2006|11:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[09/10/2006|19:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[02/09/2005|13:22] C:\DOCUME~1\DEFAUL~1\APPLIC~1\.
[02/09/2005|13:22] C:\DOCUME~1\DEFAUL~1\APPLIC~1\..
[16/08/2004|16:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[16/08/2004|17:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[02/09/2005|13:35] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[02/09/2005|13:22] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
[02/09/2005|13:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
[02/09/2005|13:18] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[02/09/2005|13:15] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver
[29/10/2006|18:33] C:\DOCUME~1\LOCALS~1\APPLIC~1\.
[29/10/2006|18:33] C:\DOCUME~1\LOCALS~1\APPLIC~1\..
[07/12/2006|18:41] C:\DOCUME~1\LOCALS~1\APPLIC~1\AVG7
[29/10/2006|18:33] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[13/02/2008|13:21] C:\DOCUME~1\MLANIE~1\APPLIC~1\.
[13/02/2008|13:21] C:\DOCUME~1\MLANIE~1\APPLIC~1\..
[01/02/2008|20:23] C:\DOCUME~1\MLANIE~1\APPLIC~1\Adobe
[24/09/2006|11:59] C:\DOCUME~1\MLANIE~1\APPLIC~1\AdobeUM
[07/12/2006|18:49] C:\DOCUME~1\MLANIE~1\APPLIC~1\AVG7
[28/02/2007|21:03] C:\DOCUME~1\MLANIE~1\APPLIC~1\COOL DOG BALM
[27/09/2006|17:15] C:\DOCUME~1\MLANIE~1\APPLIC~1\CyberLink
[16/08/2004|16:55] C:\DOCUME~1\MLANIE~1\APPLIC~1\desktop.ini
[23/09/2006|12:49] C:\DOCUME~1\MLANIE~1\APPLIC~1\Google
[13/02/2008|13:21] C:\DOCUME~1\MLANIE~1\APPLIC~1\Grisoft
[24/09/2006|10:17] C:\DOCUME~1\MLANIE~1\APPLIC~1\Help
[16/08/2004|17:19] C:\DOCUME~1\MLANIE~1\APPLIC~1\Identities
[01/02/2008|13:55] C:\DOCUME~1\MLANIE~1\APPLIC~1\Lavasoft
[27/09/2006|17:20] C:\DOCUME~1\MLANIE~1\APPLIC~1\Leadertech
[24/09/2006|13:44] C:\DOCUME~1\MLANIE~1\APPLIC~1\Macromedia
[01/02/2008|14:01] C:\DOCUME~1\MLANIE~1\APPLIC~1\Microsoft
[24/09/2006|10:38] C:\DOCUME~1\MLANIE~1\APPLIC~1\Mozilla
[24/09/2006|11:28] C:\DOCUME~1\MLANIE~1\APPLIC~1\MSNInstaller
[27/01/2008|15:13] C:\DOCUME~1\MLANIE~1\APPLIC~1\OpenOffice.org2
[02/09/2005|13:22] C:\DOCUME~1\MLANIE~1\APPLIC~1\Real
[27/09/2006|17:20] C:\DOCUME~1\MLANIE~1\APPLIC~1\Sonic
[02/09/2005|13:03] C:\DOCUME~1\MLANIE~1\APPLIC~1\Sun
[24/09/2006|00:18] C:\DOCUME~1\MLANIE~1\APPLIC~1\Symantec
[30/09/2006|20:55] C:\DOCUME~1\MLANIE~1\APPLIC~1\Template
[06/12/2006|00:09] C:\DOCUME~1\MLANIE~1\APPLIC~1\vlc
[01/02/2008|15:45] C:\DOCUME~1\MLANIE~1\APPLIC~1\wklnhst.dat
[02/09/2005|13:15] C:\DOCUME~1\MLANIE~1\APPLIC~1\You've Got Pictures Screensaver
[16/08/2004|17:18] C:\DOCUME~1\NETWOR~1\APPLIC~1\.
[16/08/2004|17:18] C:\DOCUME~1\NETWOR~1\APPLIC~1\..
[29/10/2006|18:33] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[23/09/2006|12:58] C:\DOCUME~1\PROPRI~1\APPLIC~1\.
[23/09/2006|12:58] C:\DOCUME~1\PROPRI~1\APPLIC~1\..
[23/09/2006|12:58] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver
----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------
[14/02/2008 09:41][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job [--272--]
[14/02/2008 08:59][--ah-----] C:\WINDOWS\tasks\SA.DAT [--6--]
[05/08/2004 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini [--65--]
---------------[ Listing des dossiers dans C:\Program Files ]--------------
[14/02/2008|09:55] C:\Program Files\.
[14/02/2008|09:55] C:\Program Files\..
[02/09/2005|13:13] C:\Program Files\Adobe
[01/03/2007|21:36] C:\Program Files\Adverts
[02/09/2005|13:01] C:\Program Files\AMD
[23/09/2006|12:43] C:\Program Files\AOL 9.0
[02/09/2005|13:15] C:\Program Files\AOL Compagnon
[13/02/2008|11:20] C:\Program Files\a-squared Free
[02/09/2005|13:02] C:\Program Files\ATI Technologies
[16/08/2004|17:05] C:\Program Files\ComPlus Applications
[07/12/2006|17:13] C:\Program Files\COOL DOG BALM
[02/09/2005|13:23] C:\Program Files\CyberLink
[30/12/2007|11:26] C:\Program Files\eMule
[08/12/2007|15:15] C:\Program Files\EPSON
[11/10/2006|19:28] C:\Program Files\Fichiers communs
[29/10/2006|10:17] C:\Program Files\Google
[13/02/2008|13:20] C:\Program Files\Grisoft
[14/02/2008|09:41] C:\Program Files\Hijackthis Version Fran‡aise
[08/12/2007|15:15] C:\Program Files\InstallShield Installation Information
[12/12/2007|19:47] C:\Program Files\Internet Explorer
[29/11/2007|22:57] C:\Program Files\Java
[01/02/2008|13:55] C:\Program Files\Lavasoft
[02/09/2005|13:15] C:\Program Files\Learn2.com
[14/02/2008|09:56] C:\Program Files\Lop SD
[01/02/2008|15:22] C:\Program Files\Macrogaming
[16/08/2004|17:03] C:\Program Files\Messenger
[07/12/2006|17:13] C:\Program Files\Messenger Plus! Live
[10/05/2007|19:41] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[16/08/2004|17:11] C:\Program Files\microsoft frontpage
[30/09/2006|20:52] C:\Program Files\Microsoft Office
[30/09/2006|20:52] C:\Program Files\Microsoft Works
[16/08/2004|17:06] C:\Program Files\Movie Maker
[14/02/2008|09:40] C:\Program Files\Mozilla Firefox
[11/10/2006|19:55] C:\Program Files\MSECACHE
[24/09/2006|11:27] C:\Program Files\MSN
[16/08/2004|17:03] C:\Program Files\MSN Gaming Zone
[22/09/2007|13:45] C:\Program Files\MSN Messenger
[15/10/2006|13:13] C:\Program Files\MSXML 4.0
[16/08/2004|17:06] C:\Program Files\NetMeeting
[16/08/2004|17:03] C:\Program Files\Online Services
[29/11/2007|22:57] C:\Program Files\OpenOffice.org 2.3
[14/06/2007|11:11] C:\Program Files\Outlook Express
[02/09/2005|13:15] C:\Program Files\QuickTime
[02/09/2005|13:15] C:\Program Files\Real
[16/08/2004|17:07] C:\Program Files\Services en ligne
[08/12/2007|15:12] C:\Program Files\Smart Panel
[02/09/2005|13:25] C:\Program Files\Sonic
[02/09/2005|12:50] C:\Program Files\Synaptics
[16/08/2004|17:19] C:\Program Files\Uninstall Information
[06/12/2006|00:07] C:\Program Files\VideoLAN
[02/09/2005|13:15] C:\Program Files\Viewpoint
[13/02/2008|16:54] C:\Program Files\Windows Live Toolbar
[16/12/2006|14:55] C:\Program Files\Windows Media Connect 2
[16/12/2006|15:09] C:\Program Files\Windows Media Player
[16/08/2004|17:03] C:\Program Files\Windows NT
[16/08/2004|17:07] C:\Program Files\WindowsUpdate
[16/08/2004|17:11] C:\Program Files\xerox
------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------
[11/10/2006|19:28] C:\Program Files\Fichiers communs\.
[11/10/2006|19:28] C:\Program Files\Fichiers communs\..
[24/09/2006|11:59] C:\Program Files\Fichiers communs\Adobe
[02/09/2005|13:15] C:\Program Files\Fichiers communs\AOL
[02/09/2005|13:15] C:\Program Files\Fichiers communs\aolshare
[02/09/2005|13:01] C:\Program Files\Fichiers communs\InstallShield
[02/09/2005|13:03] C:\Program Files\Fichiers communs\Java
[30/09/2006|20:52] C:\Program Files\Fichiers communs\Microsoft Shared
[16/08/2004|17:06] C:\Program Files\Fichiers communs\MSSoap
[02/09/2005|13:15] C:\Program Files\Fichiers communs\Nullsoft
[16/08/2004|16:57] C:\Program Files\Fichiers communs\ODBC
[02/09/2005|13:22] C:\Program Files\Fichiers communs\Real
[16/08/2004|17:06] C:\Program Files\Fichiers communs\Services
[02/09/2005|13:25] C:\Program Files\Fichiers communs\Sonic Shared
[16/08/2004|16:56] C:\Program Files\Fichiers communs\SpeechEngines
[02/09/2005|13:12] C:\Program Files\Fichiers communs\SureThing Shared
[14/06/2007|11:11] C:\Program Files\Fichiers communs\System
[02/09/2005|13:22] C:\Program Files\Fichiers communs\xing shared
----------------------[ Recherche avec S_Lop ]---------------------
Aucun fichier / dossier Lop trouvé !
-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------
C:\Program Files\Adverts
----------------------[ Verification du Registre ]----------------------
..... OK !
--------------------[ Verification du fichier Hosts ]---------------------
Fichier Hosts MODIFIE
127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 www.drivecleaner.com ## added by CiD
127.0.0.1 www.errorprotector.com ## added by CiD
127.0.0.1 www.errorsafe.com ## added by CiD
127.0.0.1 www.systemdoctor.com ## added by CiD
127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
127.0.0.1 www.win-virus-pro.com ## added by CiD
127.0.0.1 www.winantispam.com ## added by CiD
127.0.0.1 www.winantispy.com ## added by CiD
127.0.0.1 www.winantispyware.com ## added by CiD
127.0.0.1 www.winantivirus.com ## added by CiD
127.0.0.1 www.winantiviruspro.com ## added by CiD
127.0.0.1 www.windrivecleaner.com ## added by CiD
127.0.0.1 www.windrivesafe.com ## added by CiD
127.0.0.1 www.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 www.utils.winfixer.com ## added by CiD
127.0.0.1 www.winfixer2006.com ## added by CiD
127.0.0.1 www.winsoftware.com ## added by CiD
-> 72 ( 70 ## added by CiD )
/!\ 1 Not 127.0.0.1 !!
----------------[ Recherche de fichiers avec Catchme ]-----------------
catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-14 09:57:16
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden files ...
scan completed successfully
hidden files: 0
--------------------[ Recherche d'autres infections ]---------------------
Aucune autre infection trouvée !
/!\ [Fich:1][Doss:0] C:\DOCUME~1\MLANIE~1\LOCALS~1\Temp
/!\ [Fich:157][Doss:0] C:\DOCUME~1\MLANIE~1\Cookies
/!\ [Fich:1][Doss:0] C:\DOCUME~1\MLANIE~1\LOCALS~1\TEMPOR~1\content.IE5
--------------------[ Fin du rapport a 9:57:38,65 ]---------------------- -
Salut sabinop`
fais ceci :
Vide tes fichiers temporaires avec ceci:
->Clean Up 40:
http://pageperso.aol.fr/balltrap34/CleanUp40.exe
->aide en image:(merci a Balltrap34)
http://pageperso.aol.fr/balltrap34/democleanup.htm
click sur option et décoche la case devant : delete prefect files
vide le manuellement :
:: Le contenu du dossier prefetch ::
* C:\WINDOWS\Prefetch <= sauf le fichier layout.ini
* Ne pas oublier de vider la corbeille !
supprime ceci :
C:\Program Files\Adverts
par le panneau de configuration/ ajoue et suppression de programme
puis
Télécharge Zeb-Restore http://telechargement.zebulon.fr/zeb-restore.html enregistre ce fichier sur le bureau.
-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.
-Ouvre le dossier ZR_1.0.0.37 ==> double clic sur Zeb-Restore.exe
- Coche la case devant : Réinitialiser Fichier Hosts
- Ne coche aucune autre case
-Clique sur Restaurer
-Redémarre ton PC
repost le rapport de l´option 1 de lop sd
ainsi qu´un nouveau hijack this stp.
@+ -
re salut
voici le premier rapport de l'option 1 de lop sd + Hijackthis
Merci
-----------------------------[ Lop S&D 2.3.4 ]---------------------------
[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : M‚lanie Cravo ] [ "C:\Program Files\Lop SD" ]
[ 14/02/2008 | 18:14:18,42 ] [ PC : MLANIE ]
[ MAJ : 12-02-2008 | 21:52 ]
-------------[ Listing des dossiers dans Application Data ]------------
[08/12/2007|15:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.
[08/12/2007|15:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\..
[02/09/2005|13:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[23/09/2006|12:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
[14/02/2008|10:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg7
[27/09/2006|17:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[16/08/2004|16:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[29/10/2006|10:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[13/02/2008|13:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[16/11/2006|21:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[01/02/2008|13:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[02/09/2005|13:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[16/08/2004|17:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[11/10/2006|19:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[08/12/2007|15:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
[02/09/2005|13:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
[24/09/2006|11:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[09/10/2006|19:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[02/09/2005|13:22] C:\DOCUME~1\DEFAUL~1\APPLIC~1\.
[02/09/2005|13:22] C:\DOCUME~1\DEFAUL~1\APPLIC~1\..
[16/08/2004|16:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[16/08/2004|17:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[02/09/2005|13:35] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[02/09/2005|13:22] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
[02/09/2005|13:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
[02/09/2005|13:18] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[02/09/2005|13:15] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver
[29/10/2006|18:33] C:\DOCUME~1\LOCALS~1\APPLIC~1\.
[29/10/2006|18:33] C:\DOCUME~1\LOCALS~1\APPLIC~1\..
[07/12/2006|18:41] C:\DOCUME~1\LOCALS~1\APPLIC~1\AVG7
[29/10/2006|18:33] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[13/02/2008|13:21] C:\DOCUME~1\MLANIE~1\APPLIC~1\.
[13/02/2008|13:21] C:\DOCUME~1\MLANIE~1\APPLIC~1\..
[01/02/2008|20:23] C:\DOCUME~1\MLANIE~1\APPLIC~1\Adobe
[24/09/2006|11:59] C:\DOCUME~1\MLANIE~1\APPLIC~1\AdobeUM
[07/12/2006|18:49] C:\DOCUME~1\MLANIE~1\APPLIC~1\AVG7
[28/02/2007|21:03] C:\DOCUME~1\MLANIE~1\APPLIC~1\COOL DOG BALM
[27/09/2006|17:15] C:\DOCUME~1\MLANIE~1\APPLIC~1\CyberLink
[16/08/2004|16:55] C:\DOCUME~1\MLANIE~1\APPLIC~1\desktop.ini
[23/09/2006|12:49] C:\DOCUME~1\MLANIE~1\APPLIC~1\Google
[13/02/2008|13:21] C:\DOCUME~1\MLANIE~1\APPLIC~1\Grisoft
[24/09/2006|10:17] C:\DOCUME~1\MLANIE~1\APPLIC~1\Help
[16/08/2004|17:19] C:\DOCUME~1\MLANIE~1\APPLIC~1\Identities
[01/02/2008|13:55] C:\DOCUME~1\MLANIE~1\APPLIC~1\Lavasoft
[27/09/2006|17:20] C:\DOCUME~1\MLANIE~1\APPLIC~1\Leadertech
[24/09/2006|13:44] C:\DOCUME~1\MLANIE~1\APPLIC~1\Macromedia
[01/02/2008|14:01] C:\DOCUME~1\MLANIE~1\APPLIC~1\Microsoft
[24/09/2006|10:38] C:\DOCUME~1\MLANIE~1\APPLIC~1\Mozilla
[24/09/2006|11:28] C:\DOCUME~1\MLANIE~1\APPLIC~1\MSNInstaller
[27/01/2008|15:13] C:\DOCUME~1\MLANIE~1\APPLIC~1\OpenOffice.org2
[02/09/2005|13:22] C:\DOCUME~1\MLANIE~1\APPLIC~1\Real
[27/09/2006|17:20] C:\DOCUME~1\MLANIE~1\APPLIC~1\Sonic
[02/09/2005|13:03] C:\DOCUME~1\MLANIE~1\APPLIC~1\Sun
[24/09/2006|00:18] C:\DOCUME~1\MLANIE~1\APPLIC~1\Symantec
[30/09/2006|20:55] C:\DOCUME~1\MLANIE~1\APPLIC~1\Template
[06/12/2006|00:09] C:\DOCUME~1\MLANIE~1\APPLIC~1\vlc
[01/02/2008|15:45] C:\DOCUME~1\MLANIE~1\APPLIC~1\wklnhst.dat
[02/09/2005|13:15] C:\DOCUME~1\MLANIE~1\APPLIC~1\You've Got Pictures Screensaver
[16/08/2004|17:18] C:\DOCUME~1\NETWOR~1\APPLIC~1\.
[16/08/2004|17:18] C:\DOCUME~1\NETWOR~1\APPLIC~1\..
[29/10/2006|18:33] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[23/09/2006|12:58] C:\DOCUME~1\PROPRI~1\APPLIC~1\.
[23/09/2006|12:58] C:\DOCUME~1\PROPRI~1\APPLIC~1\..
[23/09/2006|12:58] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver
----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------
[14/02/2008 17:41][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job [--272--]
[14/02/2008 17:35][--ah-----] C:\WINDOWS\tasks\SA.DAT [--6--]
[05/08/2004 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini [--65--]
---------------[ Listing des dossiers dans C:\Program Files ]--------------
[14/02/2008|09:55] C:\Program Files\.
[14/02/2008|09:55] C:\Program Files\..
[02/09/2005|13:13] C:\Program Files\Adobe
[01/03/2007|21:36] C:\Program Files\Adverts
[02/09/2005|13:01] C:\Program Files\AMD
[23/09/2006|12:43] C:\Program Files\AOL 9.0
[02/09/2005|13:15] C:\Program Files\AOL Compagnon
[13/02/2008|11:20] C:\Program Files\a-squared Free
[02/09/2005|13:02] C:\Program Files\ATI Technologies
[16/08/2004|17:05] C:\Program Files\ComPlus Applications
[07/12/2006|17:13] C:\Program Files\COOL DOG BALM
[02/09/2005|13:23] C:\Program Files\CyberLink
[30/12/2007|11:26] C:\Program Files\eMule
[08/12/2007|15:15] C:\Program Files\EPSON
[11/10/2006|19:28] C:\Program Files\Fichiers communs
[29/10/2006|10:17] C:\Program Files\Google
[13/02/2008|13:20] C:\Program Files\Grisoft
[14/02/2008|09:41] C:\Program Files\Hijackthis Version Fran‡aise
[08/12/2007|15:15] C:\Program Files\InstallShield Installation Information
[14/02/2008|10:30] C:\Program Files\Internet Explorer
[29/11/2007|22:57] C:\Program Files\Java
[01/02/2008|13:55] C:\Program Files\Lavasoft
[02/09/2005|13:15] C:\Program Files\Learn2.com
[14/02/2008|18:14] C:\Program Files\Lop SD
[01/02/2008|15:22] C:\Program Files\Macrogaming
[16/08/2004|17:03] C:\Program Files\Messenger
[07/12/2006|17:13] C:\Program Files\Messenger Plus! Live
[10/05/2007|19:41] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[16/08/2004|17:11] C:\Program Files\microsoft frontpage
[30/09/2006|20:52] C:\Program Files\Microsoft Office
[30/09/2006|20:52] C:\Program Files\Microsoft Works
[16/08/2004|17:06] C:\Program Files\Movie Maker
[14/02/2008|18:10] C:\Program Files\Mozilla Firefox
[11/10/2006|19:55] C:\Program Files\MSECACHE
[24/09/2006|11:27] C:\Program Files\MSN
[16/08/2004|17:03] C:\Program Files\MSN Gaming Zone
[22/09/2007|13:45] C:\Program Files\MSN Messenger
[15/10/2006|13:13] C:\Program Files\MSXML 4.0
[16/08/2004|17:06] C:\Program Files\NetMeeting
[16/08/2004|17:03] C:\Program Files\Online Services
[29/11/2007|22:57] C:\Program Files\OpenOffice.org 2.3
[14/06/2007|11:11] C:\Program Files\Outlook Express
[02/09/2005|13:15] C:\Program Files\QuickTime
[02/09/2005|13:15] C:\Program Files\Real
[16/08/2004|17:07] C:\Program Files\Services en ligne
[08/12/2007|15:12] C:\Program Files\Smart Panel
[02/09/2005|13:25] C:\Program Files\Sonic
[02/09/2005|12:50] C:\Program Files\Synaptics
[16/08/2004|17:19] C:\Program Files\Uninstall Information
[06/12/2006|00:07] C:\Program Files\VideoLAN
[02/09/2005|13:15] C:\Program Files\Viewpoint
[13/02/2008|16:54] C:\Program Files\Windows Live Toolbar
[16/12/2006|14:55] C:\Program Files\Windows Media Connect 2
[16/12/2006|15:09] C:\Program Files\Windows Media Player
[16/08/2004|17:03] C:\Program Files\Windows NT
[16/08/2004|17:07] C:\Program Files\WindowsUpdate
[16/08/2004|17:11] C:\Program Files\xerox
------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------
[11/10/2006|19:28] C:\Program Files\Fichiers communs\.
[11/10/2006|19:28] C:\Program Files\Fichiers communs\..
[24/09/2006|11:59] C:\Program Files\Fichiers communs\Adobe
[02/09/2005|13:15] C:\Program Files\Fichiers communs\AOL
[02/09/2005|13:15] C:\Program Files\Fichiers communs\aolshare
[02/09/2005|13:01] C:\Program Files\Fichiers communs\InstallShield
[02/09/2005|13:03] C:\Program Files\Fichiers communs\Java
[30/09/2006|20:52] C:\Program Files\Fichiers communs\Microsoft Shared
[16/08/2004|17:06] C:\Program Files\Fichiers communs\MSSoap
[02/09/2005|13:15] C:\Program Files\Fichiers communs\Nullsoft
[16/08/2004|16:57] C:\Program Files\Fichiers communs\ODBC
[02/09/2005|13:22] C:\Program Files\Fichiers communs\Real
[16/08/2004|17:06] C:\Program Files\Fichiers communs\Services
[02/09/2005|13:25] C:\Program Files\Fichiers communs\Sonic Shared
[16/08/2004|16:56] C:\Program Files\Fichiers communs\SpeechEngines
[02/09/2005|13:12] C:\Program Files\Fichiers communs\SureThing Shared
[14/06/2007|11:11] C:\Program Files\Fichiers communs\System
[02/09/2005|13:22] C:\Program Files\Fichiers communs\xing shared
----------------------[ Recherche avec S_Lop ]---------------------
Aucun fichier / dossier Lop trouvé !
-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------
C:\Program Files\Adverts
----------------------[ Verification du Registre ]----------------------
..... OK !
--------------------[ Verification du fichier Hosts ]---------------------
Fichier Hosts MODIFIE
127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 www.drivecleaner.com ## added by CiD
127.0.0.1 www.errorprotector.com ## added by CiD
127.0.0.1 www.errorsafe.com ## added by CiD
127.0.0.1 www.systemdoctor.com ## added by CiD
127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
127.0.0.1 www.win-virus-pro.com ## added by CiD
127.0.0.1 www.winantispam.com ## added by CiD
127.0.0.1 www.winantispy.com ## added by CiD
127.0.0.1 www.winantispyware.com ## added by CiD
127.0.0.1 www.winantivirus.com ## added by CiD
127.0.0.1 www.winantiviruspro.com ## added by CiD
127.0.0.1 www.windrivecleaner.com ## added by CiD
127.0.0.1 www.windrivesafe.com ## added by CiD
127.0.0.1 www.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 www.utils.winfixer.com ## added by CiD
127.0.0.1 www.winfixer2006.com ## added by CiD
127.0.0.1 www.winsoftware.com ## added by CiD
-> 72 ( 70 ## added by CiD )
/!\ 1 Not 127.0.0.1 !!
----------------[ Recherche de fichiers avec Catchme ]-----------------
catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-14 18:15:02
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden files ...
scan completed successfully
hidden files: 0
--------------------[ Recherche d'autres infections ]---------------------
Aucune autre infection trouvée !
/!\ [Fich:2][Doss:1] C:\DOCUME~1\MLANIE~1\LOCALS~1\Temp
/!\ [Fich:157][Doss:0] C:\DOCUME~1\MLANIE~1\Cookies
/!\ [Fich:58][Doss:4] C:\DOCUME~1\MLANIE~1\LOCALS~1\TEMPOR~1\content.IE5
--------------------[ Fin du rapport a 18:15:23,93 ]----------------------
Logfile of HijackThis v1.99.1
Scan saved at 19:13:06, on 14/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [\\Cravo\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P34 "\\Cravo\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P58 "Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO" /O16 "\\CRAVO\AutoEPSO" /M "Stylus CX3600"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?d8b947208a7a4892adf5a945f6cc07db
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?d8b947208a7a4892adf5a945f6cc07db
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
-
-
Voit avec ceci s'il trouve des virus:http://www.drweb-online.com/en/cure_it.asp?rpid=
Puis supprimes les lignes suivantes de Hijackthis:
O2 - BHO: PBFRV2 - {4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} - C:\WINDOWS\system32\pbfrv2.dll (file missing) [Virus PBFRV2!!!]
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PBFRV2 - {4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D} - C:\WINDOWS\system32\pbfrv2.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
Refait un scan et repost ici!
Bonne chance -
Bonjour.
Télécharge Lop S&D (de Angeldark et Eric71) sur le Bureau :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7crPW-mouMdBfVK6f3sPUapdg4hQngU7HgbyFsjR1dD3-TqtdVs0SMRrdcdNC7rmqax1GJa3lMBhw4WnFlfv3Pv6p78xJeLuL7OAVVlKBRcdJRu0uFv1MpM3um1jegyBBCiIlb-2vFxKwIF_rTHq9-XXVjySFdSH_F1Pj_BExu-b9p26-am8ve-dqiTUXvzYlXDAT5GWnSimZIPHtF77f1BE1nLOHA%3D%3D&attredirects=3
[*]Double-clique sur Lop S&D.exe pour lancer l'installation,
[*]Puis double-clique sur le raccourci Lop S&D présent sur le Bureau.
[*]Séléctionne la langue souhaitée , puis choisis l'Option 1 (Recherche)
Le scan prend moins d'une minute.
[*]A l'issue du scan, le bloc-notes va s'ouvrir avec le résultat de la recherche.
[*]Enregistre le rapport LopR.txt sur le Bureau pour le retrouver facilement, sinon il sauvegardé à la racine de la partition système : C:\LopR.txt
[*]Pour nettoyer ce qui a été trouvé, relancer LopSD et choisir l'option "2" (Suppression)
NB : Un backup des suppressions sera créé dans le dossier de Lop S&D.
Tutoriel par Eric71
https://sites.google.com/site/eric71mespages/lop.sd.exe -
Charly,
dans les lignes que tu demande de cocher et de fixer, la plupart peuvent etre fixés mais pas toutes ! Et puis ca ne sert a rien de fixer et de ne pas supprimer les fichiers...
puis tu as vu ca? O4 - HKCU\..\Run: [Bintype] C:\DOCUME~1\MLANIE~1\APPLIC~1\COOLDO~1\Win Part Lite.exe
@+ -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
Salut Nardino,
Ca va comme tu veux ;-)
Tiens un logiciel que je connais pas ?!
@+ -
Si il peut, a condition de tué les programmes auparavant!
Léger oubli lol...
Mais sinon c'est que j'aurais prit trop d'amaretto dans mon café xD -
-
Re,
c´est mieux ;-)
Oui avg doit voir lop sd comme un intru, mais c´est pas grave...
post un nouveau hijack this stp
@+-
Logfile of HijackThis v1.99.1
Scan saved at 00:02:22, on 15/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [\\Cravo\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P34 "\\Cravo\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P58 "Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO" /O16 "\\CRAVO\AutoEPSO" /M "Stylus CX3600"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?d8b947208a7a4892adf5a945f6cc07db
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?d8b947208a7a4892adf5a945f6cc07db
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
-
-
Re,
Maintenant instales un par feu :
par feu : kerio
http://www.malekal.com/kerio_firewall.php#mozTocId721480
https://www.vulgarisation-informatique.com/kerio.php
https://kerio.probb.fr/f2-sunbelt-kerio-personal-firewall
ou zone alarm plus facil a configurer mais moins performant
https://www.malekal.com/tutoriel-zonealarm-firewall/
puis fais un scan en ligne :
Scan en ligne bitdefender :
https://www.bitdefender.com/toolbox/
Clicker sur " I agree " et suivre les indications
A faire imperativement sous internet explorer, en acceptant l´activ x
tutoriel en image :
http://pageperso.aol.fr/rginformatique/mapage/defender.htm
Post le rapport quand tu l´auras passé.
Bonne fin de soirée ;-)
@+-
salut
J'ai fait le scan en ligne ( très très long ) car je rame de plus en plus , j'espère que je ne dois pas formater le disque dur car je n'ai pas de Cd d'installation car il ne le donne plus Ce pc à 1 an et demi
Je n'ai pas su enrregistrer le rapport du scan en ligne mais il indiquer qu'il n'y avait aucune infection du cout j'ai refait un Hijackthis
les pages ont du mal à souvrir environ 30 s sinon +
A+ et merci
Logfile of HijackThis v1.99.1
Scan saved at 13:50:36, on 15/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [\\Cravo\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P34 "\\Cravo\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P58 "Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO" /O16 "\\CRAVO\AutoEPSO" /M "Stylus CX3600"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?d8b947208a7a4892adf5a945f6cc07db
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?d8b947208a7a4892adf5a945f6cc07db
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
-
-
re salut
je suis en train de refaire un scan en ligne
petite question : ( pause scan) est en surbrillance cela veut dire que cela n'est pas fini ? car cela fait 1Heure 40 que cela tourne et les fichiers scanés ne deffiles pas dans (show all scaneds files ), car au début cela montrait les fichiers scanés .
A++ -
salut sabinop`
oui ca me parait long... arrete le scan...
je te propose de proceder autrement...
avg antivirus > celui que tu as d´installé sur ta machine n´est pas tres performant, alors ce que je te propose de faire c´est de le remplacer par antivir qui lui est plus a la hauteur.
je te laisse regarder ceci pour te faire une idée des performences :
http://www.matbe.com
desinstalles avg et remplace le par antivir
Telecharge et instal l'antivirus Antivir Personal Edition Classic :
->https://www.malekal.com/avira-free-security-antivirus-gratuit/
https://www.avira.com/en/prime
http://mickael.barroux.free.fr/securite/antivir.php
http://speedweb1.free.fr/frames2.php?page=tuto5
<- tutoriel configuration du scanner...
une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
puis sur la droite coche les case suivantes :
scan boot sectors of selected drives
scan master boot sectors
scan memory
search foe rootkit before scan
decoche :
ignore off line files
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level
une fois fais, performes un scan complet de ta machine a l´aide de celui ci avec les reglages stipulé ci dessus et post le rapport generé ici stp
bon courrage `
@+-
bonsoir
j'ai fait le scan, mais je ne suis pas sur que mes réglages sont bon car à partir de décoche: macrovirus heuristic et win 32 heuristic je les ai décochés mais je vais refaire un nouveau scan en les cochant et je reposterais un nouveau rapport
a+ et merci
AntiVir PersonalEdition Classic
Report file date: vendredi 15 février 2008 19:53
Scanning for 1110498 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: MÉLANIE
Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 18:09:07
ANTIVIR2.VDF : 7.0.2.113 1673728 Bytes 08/02/2008 18:09:08
ANTIVIR3.VDF : 7.0.2.147 199168 Bytes 15/02/2008 18:09:08
AVEWIN32.DLL : 7.6.0.67 3293696 Bytes 15/02/2008 18:09:11
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 15/02/2008 18:09:11
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: off
File heuristic...................: off
Start of the scan: vendredi 15 février 2008 19:53
Starting search for hidden objects.
'45267' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'CLSched.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'E_FATI9BE.EXE' - '1' Module(s) have been scanned
Scan process 'PCMService.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Scan process 'SynTPLpr.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'slserv.exe' - '1' Module(s) have been scanned
Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
Scan process 'HidService.exe' - '1' Module(s) have been scanned
Scan process 'CLMLService.exe' - '1' Module(s) have been scanned
Scan process 'CLMLServer.exe' - '1' Module(s) have been scanned
Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'AOLacsd.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
39 processes with 39 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[NOTE] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Starting to scan the registry.
The registry was scanned ( '27' files ).
Starting the file scan:
Begin scan in 'C:\' <HDD>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
End of the scan: vendredi 15 février 2008 20:32
Used time: 39:21 min
The scan has been done completely.
5229 Scanning directories
299668 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
299668 Files not concerned
7070 Archives were scanned
2 Warnings
0 Notes
45267 Objects were scanned with rootkit scan
0 Hidden objects were found
-
-
re,
bon, tu n´as pas vraiment reglé le scanner comme je te l´avais precisé, mais...
comment va ton pc mainrtenant?
@+
-
re,
le pc pas trop bien mais je peux ouvrir les fichiers (trop de temps pour qu'ils s'ouvrent ) environ 15 à 20 s et pour me connecter à
internet, entre le moment ou je clique sur l'icône et le moment ou la page d'accueil arrive il se passe ~ 30s puis cela va vite quand je clique
sur l'adresse de commentcamarche dans les marque pages .
évidement pour moi cela ne me dit rien car je ne suis pas doué en informatique , je ne sais pas si tu as une idée de +
je te remercie encore pour ta patience
-
-
mais il ya du mieux apparament
le firewall Kerio est à l'éssai pour 30 Jours ? -
re,
as tu fais une defragmentation ressament?
kerio est gratuit apres les 30 jours d´essaie, seules quelques fonctions vont etre desactivés
que tu peux deja desactiver d´ailleur, ca te permettra sans doute de gagner en temps de reponse sur le net.
suis les indications de ninix ici :
Le samedi 25 mars 2006 à 12:32, par NiNiX
http://www.libellules.ch/dotclear/index.php?2005/12/26/719-sunbelt-kerio-firewall
dis moi quoi
@+-
re
pour la defragmentation environ 1 mois et à l'heure ou je t'écris tout va pour le mieux sur le Pc
pourtant toute à l'heure cela ramait je ni comprends rien mais je te remercie beaucoup
est -tu informaticien pour maitriser autant ?
Comme je ne suis pas un expert je voulais savoir si tu peux avoir acces a mon profil
Bonsoir a++
-
-
re,
ta version de acrobat reader n´est pas a jour, tu veux la version 8.1 derniere en date alors desinstale ta version par le panneau de configuration / ajoue et suppression de programme
et instale la derniere :
https://get2.adobe.com/reader/otherversions/
ou foxit plus léger :
https://www.clubic.com/telecharger-fiche13808-foxit-reader.html
puis
fais ceci pour nettoyer et le booster un peu :
Ccleaner:
-> Télécharge Ccleaner (n'installe pas la barre d'outil Yahoo):
http://www.commentcamarche.net/telecharger/telechargement 168 ccleaner
-> L´installer.
-> Une fois installé et lancé :
Dans la colonne de gauche, click sur :
->"erreurs" :
Coches toutes les cases sous"l´integrité du registre", puis click en bas sur "chercher des erreurs" une fois terminé, clic sur "reparer les erreurs", tu auras un message pour sauvegarder ta base de registre, tu click "oui" puis tu recommence jusqu'à ce qu'il ne trouve plus rien.
ps : les sauvegardes que tu auras faites, pourront etre supprimées ulterieurement si tout va bien.
->"nettoyeur"
quitte ton navigateur avant de le lancer, dans les propriétés du nettoyeur de l´onglet "windows" et "applications"décoche la derniere case (Avancé si elle est cochée) puis click sur "lancer le nettoyage" qunand il aura terminé le scan click en bas a droite sur "lancer le nettoyage" et accepte par oui.
-> Tutoriel en image :
https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php
-> Pour ceux qui voudraient aller plus loin en compagnie de jesses (fonctions avancés) :
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm
pour la defragmentation fais le surtout quand tu deplaces ou effaces des fichiers ou dossier sur ton pc .
non je ne suis pas informaticienne; j´ai appris ici ;-)
pour mon profile en faite, je parle de mon myspace : si ca t´interresse ?
https://myspace.com/periwigs
pour supprimer les outils utilisés :
Télécharge ToolsCleaner sur ton bureau.
--> http://www.commentcamarche.net/telecharger/telechargement 34055291 toolsclean(...)
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
@+ -
re
J'ai installer Foxit-Pdf-reader et Tools Cleaner et fait le scan
je n'ai trouver que cela
-->- Recherche:
Le pc rame un moins mais pas normalement
A+ et merci d'être patiente -
-
Bonjour,
apparament oui et non ce n'est pas évident pour mais pour toi peut être : il ya des moments par exemple,quand je clique sur menu demarrer puis tous les programes le déroulement est en blanc ~ 5 s mais pas à chaque fois et quand j'ouvre un des programmes , il faut conter ~ 15s sinon cela marche beaucoup mieux avec tous les conseils que tu m'a gentiement et patiemment donnés .
Je joint un nouveau rapport si c'est ok dis me le et je cocherai problème résolu .
Merci et bon Dimanche
Au fait j'ai fait un tour sur ton myspace c'est vraiment cool
par contre La musique d' Histoire sans paroles ne me rajeunit pas .
Logfile of HijackThis v1.99.1
Scan saved at 12:54:40, on 17/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [\\Cravo\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P34 "\\Cravo\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P58 "Auto Auto EPSON Stylus CX3600 Series sur MÉLANIE sur CRAVO" /O16 "\\CRAVO\AutoEPSO" /M "Stylus CX3600"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?d8b947208a7a4892adf5a945f6cc07db
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?d8b947208a7a4892adf5a945f6cc07db
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe -
Salut sabinop;
oui histoire sans parole ca commence a dater ;-)
on va faire ceci :
telecharge et instal regcleaner:
http://www.01net.com/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/4894.html
tutorial :
http://www.softastuces.com/tuto/maint/regcleaner/
reviens me dire ci il y a ne serait-ce qu´une petite amelioration.
Bon dimanche soir ;-) -
Bonsoir à toi .
Je t'annonce qu'il ya beaucoup qu'une petite amélioration .
Pour moi le problème est entièrement résolu , et une fois de plus je t'en remercie .
A bientôt et bonne soirée
- 1
- 2
Suivant
