Sujet Précédent Sujet Suivant

Rapport hijackthis a l'aide plein de virus

micka62 -  
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,
voici un rapport hijackthis
qui pourrais me dire sequi ne va pas

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:59:25, on 14/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\INCRED~1\bin\ImApp.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\SysCleaner\SysCleaner.exe
C:\HiJackThis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
F3 - REG:win.ini: run=C:\WINDOWS\mmhren1.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\c++.exe,
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SystemSv121] C:\WINDOWS\system32\n2ewma1xxsv234.exe
O4 - HKLM\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SysCleaner] "C:\Program Files\SysCleaner\SysCleaner.exe" hide
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe (User 'Default user')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F2C240B-05E9-4406-B466-9C852805A152}: NameServer = 81.253.149.1 80.10.246.3
O21 - SSODL: SrvKernel - {828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b} - C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll
O21 - SSODL: BootSetup - {0722d7f2-118b-437e-ba7d-ce06ccd2c104} - C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
O21 - SSODL: zip - {f50214f6-03f7-4996-9488-019f8f4a5705} - C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll
O22 - SharedTaskScheduler: JKhfj3ofgfgdtj - {B5AF0562-94F3-42BD-F434-2604812C797D} - (no file)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
A voir également:

17 réponses

Réponse 1 / 17
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
slt,
desactive le tea timer de spybot le temps des desinfections

____________

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

F3 - REG:win.ini: run=C:\WINDOWS\mmhren1.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe

O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SystemSv121] C:\WINDOWS\system32\n2ewma1xxsv234.exe
O4 - HKLM\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe
O4 - HKCU\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [SysCleaner] "C:\Program Files\SysCleaner\SysCleaner.exe" hide
O4 - HKUS\S-1-5-18\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe (User 'Default user')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')

O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O21 - SSODL: SrvKernel - {828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b} - C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll
O21 - SSODL: BootSetup - {0722d7f2-118b-437e-ba7d-ce06ccd2c104} - C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
O21 - SSODL: zip - {f50214f6-03f7-4996-9488-019f8f4a5705} - C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll
O22 - SharedTaskScheduler: JKhfj3ofgfgdtj - {B5AF0562-94F3-42BD-F434-2604812C797D} - (no file)

___________________

Télécharge Combofix sUBs : combofix.exe

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et sauvegarde le sur ton bureau et pas ailleurs!

DESACTIVE LA PROTECTION avast DURANT LA PROCEDURE

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

file::
C:\WINDOWS\system32\n2ewma1xxsv234.exe
C:\WINDOWS\mmhren1.exe
C:\WINDOWS\mmhren1.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll

Enregistre ce fichier sous le nom CFScript

[*]Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture suivante:

http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif

colle le rapport combofix et un nouveau hiajckthis
0
Réponse 2 / 17
micka62
 
je fait comment pour desactive le tea timer de spybot
merci de ton aide
0
Réponse 3 / 17
micka62
 
je les supprimer directement
0
Réponse 4 / 17
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
tu les supprime avec combofix

C:\WINDOWS\system32\n2ewma1xxsv234.exe
C:\WINDOWS\mmhren1.exe
C:\WINDOWS\mmhren1.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 17
micka62
 
voila le rapport combo fix

ComboFix 08-02-14.3 - HP_Propriétaire 2008-02-14 17:47:12.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.232 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Propriétaire\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

FILE
C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll
C:\WINDOWS\mmhren1.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\n2ewma1xxsv234.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll
.
---- Previous Run -------
.
C:\WINDOWS\system32\config\45580504.Evt
C:\WINDOWS\system32\drivers\symavc32.sys
C:\Documents and Settings\HP_Propriétaire\Application Data\Install.dat
C:\Documents and Settings\HP_Propriétaire\Application Data\printer.exe
C:\Program Files\ucleaner_setup.exe
C:\WINDOWS\system32\config\45580504.Evt
C:\WINDOWS\system32\dllgh8jkd1q8.exe
C:\WINDOWS\system32\drivers\asc3550p.sys
C:\WINDOWS\system32\drivers\CPB46.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_ASC3550P
-------\LEGACY_CPB46
-------\asc3550p

((((((((((((((((((((((((((((( Fichiers créés 2008-01-14 to 2008-02-14 ))))))))))))))))))))))))))))))))))))
.

2008-02-14 15:55 . 2008-02-14 15:55 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\SysCleaner
2008-02-14 15:54 . 2008-02-13 13:22 <REP> d-------- C:\SDFix
2008-02-14 15:47 . 2005-06-15 10:30 18,944 --a------ C:\Documents and Settings\HP_Propriétaire\Application Data\nvsvc1024.dll
2008-02-14 12:56 . 2008-02-14 13:30 <REP> d-------- C:\Program Files\Lavasoft
2008-02-14 12:56 . 2008-02-14 12:56 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-02-14 12:56 . 2008-02-14 12:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-14 12:21 . 2008-02-14 12:47 <REP> d-------- C:\Program Files\a-squared Free
2008-02-13 22:31 . 2008-02-14 15:51 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-02-13 18:23 . 2008-02-13 18:23 43,691 --a------ C:\Program Files\tmp1164859.exe
2008-02-13 18:23 . 2008-02-13 18:23 11,031 --a------ C:\Program Files\tmp1159906.exe
2008-02-13 18:23 . 2008-02-13 18:23 9,611 --a------ C:\Program Files\tmp1160000.exe
2008-02-13 17:03 . 2008-02-14 17:16 <REP> d-------- C:\HiJackThis[1]
2008-02-13 16:52 . 2008-02-14 16:05 <REP> d-------- C:\Program Files\Navilog1
2008-02-13 16:38 . 2008-02-13 16:38 45,061 --a------ C:\Program Files\tmp9652875.exe
2008-02-13 11:13 . 2008-02-13 11:13 6,771 --a------ C:\Program Files\tmp3494515.exe
2008-02-13 10:59 . 2008-02-13 13:57 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2008-02-13 10:10 . 2008-02-13 10:10 169 --a------ C:\WINDOWS\wininit.ini
2008-02-13 09:36 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2008-02-13 09:36 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-02-13 09:36 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-02-13 09:36 . 2008-02-11 18:12 <REP> d-------- C:\Documents and Settings\Administrateur\Modèles
2008-02-13 09:36 . 2005-01-02 05:07 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-02-13 09:36 . 2004-11-25 04:26 <REP> d-------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-02-13 09:36 . 2008-02-11 12:04 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-02-13 09:36 . 2005-01-02 04:42 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-02-13 09:36 . 2005-01-02 04:57 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-02-13 09:36 . 2005-01-02 04:49 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SampleView
2008-02-13 09:36 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2008-02-13 08:43 . 2008-02-13 09:32 10,240 --a------ C:\Program Files\tmp145921.exe
2008-02-13 08:43 . 2008-02-13 09:32 10,240 --a------ C:\Program Files\tmp145875.exe
2008-02-13 08:42 . 2008-02-13 09:32 10,240 --a------ C:\Program Files\tmp113187.exe
2008-02-13 08:37 . 2008-02-13 08:37 <REP> d-------- C:\Program Files\CleanUp!
2008-02-13 08:09 . 2008-02-13 21:21 14 --ah----- C:\WINDOWS\mmax_hren2.ini
2008-02-13 03:01 . 2008-02-13 03:01 <REP> d-------- C:\Program Files\MSXML 4.0
2008-02-13 00:09 . 2008-02-13 08:09 24 --a------ C:\WINDOWS\system32\svchost.t__
2008-02-12 20:49 . 2008-02-14 14:08 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-12 20:44 . 2008-02-14 17:25 <REP> d-------- C:\Program Files\SysCleaner
2008-02-12 17:06 . 2008-02-12 17:06 <REP> d-------- C:\WINDOWS\Sun
2008-02-12 12:27 . 2008-02-12 12:27 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-02-12 12:27 . 2008-02-12 12:31 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\AdobeUM
2008-02-12 09:28 . 2008-02-14 17:34 <REP> d---s---- C:\Documents and Settings\HP_Propriétaire\UserData
2008-02-12 09:28 . 2008-02-14 17:34 <REP> d---s---- C:\Documents and Settings\HP_Propriétaire\UserData
2008-02-12 03:03 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-02-11 18:12 . 2008-02-11 12:21 <REP> d-------- C:\WINDOWS\I386
2008-02-11 17:39 . 2008-02-11 17:40 <REP> d-------- C:\Program Files\IncrediMail
2008-02-11 17:33 . 2008-02-11 17:33 <REP> d-------- C:\Program Files\Alwil Software
2008-02-11 17:33 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-02-11 17:33 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-02-11 17:33 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-02-11 17:33 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-02-11 17:33 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-02-11 17:33 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-11 17:33 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-02-11 17:33 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-11 17:25 . 2008-02-12 13:08 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Contacts
2008-02-11 17:25 . 2008-02-12 13:08 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Contacts
2008-02-11 17:23 . 2008-02-11 17:23 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-02-11 17:19 . 2008-02-11 17:24 <REP> d-------- C:\Program Files\MSN Messenger
2008-02-11 16:35 . 2008-02-11 16:35 <REP> d-------- C:\Program Files\Convar
2008-02-11 16:35 . 2003-07-18 13:58 516,784 -ra------ C:\WINDOWS\system32\XceedCry.dll
2008-02-11 16:35 . 2002-02-28 09:46 217,088 --a------ C:\WINDOWS\system32\DartSock.dll
2008-02-11 16:35 . 2000-05-22 00:00 140,488 --a------ C:\WINDOWS\system32\COMDLG32.OCX
2008-02-11 16:35 . 2002-02-21 10:12 118,784 --a------ C:\WINDOWS\system32\DartWeb.dll
2008-02-11 16:35 . 1998-06-18 00:00 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL
2008-02-11 16:35 . 1998-06-13 22:53 44,544 --a------ C:\WINDOWS\system32\Gif89.dll
2008-02-11 16:35 . 2002-04-12 13:19 28,672 --a------ C:\WINDOWS\system32\DartWeb.oca
2008-02-11 13:55 . 2008-02-11 13:55 <REP> d-------- C:\Program Files\Micro Application
2008-02-11 12:19 . 2004-08-23 14:50 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2008-02-11 12:18 . 2008-02-11 12:18 <REP> d-------- C:\Program Files\SAGEM
2008-02-11 12:17 . 2008-02-14 17:41 <REP> d-------- C:\Program Files\Wanadoo
2008-02-11 12:17 . 2008-02-11 12:17 <REP> d-------- C:\Program Files\Securitoo
2008-02-11 12:10 . 2008-02-11 12:10 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Sonic
2008-02-11 12:10 . 2008-02-11 12:10 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Leadertech
2008-02-11 12:04 . 2004-08-05 19:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-02-11 12:04 . 2008-02-11 12:04 1,844 -rahs---- C:\WINDOWS\system32\drivers\103C_HP_CPC_EC639AA-ABF t3145.fr_YC_0Pavi_QCZB530_E53FRheBLU2_47_IAMETHYST-M_SMSI_V1.0_B3.18_T050609_WXH2_L40C_M511_J160_7AMD_8Athlon 64_91.99_#080211_N10EC8139_Z11C1048C_G10025B60_OLITE-ON DVDRW SOHW-1633S.MRK
2008-02-11 12:03 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\WINDOWS
2008-02-11 12:03 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\WINDOWS
2008-02-11 12:03 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Voisinage réseau
2008-02-11 12:03 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Voisinage réseau
2008-02-11 12:03 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Voisinage d'impression
2008-02-11 12:03 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Voisinage d'impression
2008-02-11 12:03 . 2008-02-11 18:12 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Modèles
2008-02-11 12:03 . 2008-02-11 18:12 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Modèles
2008-02-11 12:03 . 2008-02-14 12:49 <REP> dr------- C:\Documents and Settings\HP_Propriétaire\Mes documents
2008-02-11 12:03 . 2008-02-14 12:49 <REP> dr------- C:\Documents and Settings\HP_Propriétaire\Mes documents
2008-02-11 12:03 . 2008-02-11 12:17 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Menu Démarrer
2008-02-11 12:03 . 2008-02-11 12:17 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Menu Démarrer
2008-02-11 12:03 . 2008-02-14 15:52 <REP> dr------- C:\Documents and Settings\HP_Propriétaire\Favoris
2008-02-11 12:03 . 2008-02-14 15:52 <REP> dr------- C:\Documents and Settings\HP_Propriétaire\Favoris
2008-02-11 12:03 . 2008-02-14 17:47 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Bureau
2008-02-11 12:03 . 2008-02-14 17:47 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Bureau
2008-02-11 12:03 . 2005-01-02 04:57 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Symantec
2008-02-11 12:03 . 2005-01-02 04:49 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\SampleView
2008-02-11 12:03 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Apple Computer
2008-02-11 10:20 . 2005-01-02 04:38 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\WINDOWS
2008-02-11 10:20 . 2005-01-02 04:57 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec
2008-02-11 10:20 . 2005-01-02 04:49 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\SampleView
2008-02-11 10:20 . 2005-01-02 04:38 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Apple Computer
2008-02-11 10:20 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\Default User\WINDOWS
2008-02-11 10:20 . 2008-02-11 10:20 <REP> d-------- C:\Documents and Settings\All Users\Menu D‚marrer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-14 14:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-12 02:24 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-02-12 02:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-11 16:07 --------- d-----w C:\Program Files\Symantec
2008-02-11 11:18 31 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-02-11 11:14 --------- d-----w C:\Program Files\Easy Internet signup
2008-02-11 11:04 1,844 --sha-r C:\WINDOWS\system32\drivers\103C_HP_CPC_EC639AA-ABF t3145.fr_YC_0Pavi_QCZB530_E53FRheBLU2_47_IAMETHYST-M_SMSI_V1.0_B3.18_T050609_WXH2_L40C_M511_J160_7AMD_8Athlon 64_91.99_#080211_N10EC8139_Z11C1048C_G10025B60_OLITE-ON DVDRW SOHW-1633S.MRK
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 14:37 3,080,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-07 01:07 96,768 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll
2007-12-07 01:07 663,552 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-07 01:07 663,552 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-12-07 01:07 617,472 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-12-07 01:07 55,808 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-12-07 01:07 532,480 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-12-07 01:07 474,624 ----a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-12-07 01:07 449,024 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-12-07 01:07 39,424 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-12-07 01:07 357,888 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-07 01:07 251,392 ----a-w C:\WINDOWS\system32\dllcache\iepeers.dll
2007-12-07 01:07 205,312 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-12-07 01:07 16,384 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-12-07 01:07 152,064 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll
2007-12-07 01:07 146,432 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-12-07 01:07 1,495,040 ----a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-12-07 01:07 1,056,768 ----a-w C:\WINDOWS\system32\dllcache\danim.dll
2007-12-07 01:07 1,024,000 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll
2007-12-06 13:07 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-11-14 07:28 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOKIT"="C:\Program Files\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2008-02-03 15:04 214456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 17:04 52736]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 18:06 88363 C:\WINDOWS\AGRSMMSG.exe]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 19:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 19:43 659456]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 23:44 61440]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 21:43 233472]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-13 04:05 339968]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2004-10-25 22:17 90112]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 21:54 253952]
"autoclk"="autoclk.exe" []
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-02-11 12:18:46 839680]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-05 02:28:24 258048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SrvKernel"= {828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b} - C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll [2008-02-12 20:32 14374]
"zip"= {c21c48ef-fbd9-4d8a-acdb-7227c55ed562} - C:\WINDOWS\Installer\{c21c48ef-fbd9-4d8a-acdb-7227c55ed562}\zip.dll [2008-02-13 16:38 38438]
"BootSetup"= {0722d7f2-118b-437e-ba7d-ce06ccd2c104} - C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll [ ]

R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-04 18:50]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 06:08]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-02 19:25]
S4 Google Online Search Service;Google Online Search Service;C:\WINDOWS\system32\winlagons.exe []

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2005-01-02 03:59:45 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
"2008-02-14 11:17:20 C:\WINDOWS\Tasks\WebReg psc 1500 series.job"
- c:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-14 17:48:22
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-02-14 17:48:43
ComboFix-quarantined-files.txt 2008-02-14 16:48:35
.
2008-02-13 19:41:24 --- E O F ---
0
Réponse 6 / 17
micka62
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:55:47, on 14/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\PROGRA~1\INCRED~1\bin\ImApp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HiJackThis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F2C240B-05E9-4406-B466-9C852805A152}: NameServer = 80.10.246.130 81.253.149.10
O21 - SSODL: SrvKernel - {828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b} - C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll
O21 - SSODL: zip - {c21c48ef-fbd9-4d8a-acdb-7227c55ed562} - C:\WINDOWS\Installer\{c21c48ef-fbd9-4d8a-acdb-7227c55ed562}\zip.dll
O21 - SSODL: BootSetup - {0722d7f2-118b-437e-ba7d-ce06ccd2c104} - C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
0
Réponse 7 / 17
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
remplace avast par antivir et colle le rapport
et surtout dis moi quels sont tes soucis actuels!!!

https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
0
Réponse 8 / 17
micka62
 
ben fete je me suis choper le virus msn "c'est toi sur la photo?"
et maintenant j'ai un tas de virus que je n'arrive pas a faire partir
je suis entrain de desinstaller avast
0
Réponse 9 / 17
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
ok

Télécharge MSNFix de Laurent
http://sosvirus.changelog.fr/MSNFix.zip

Décompresse-le et double clic sur le fichier MSNFix.bat.
- Exécute l'option R.
--Si l'infection est détectée, exécute l'option N
- Sauvegarde ce rapport puis fais un copier/coller de ce rapport sur le forum.

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal
Sauvegarder et fermer le rapport pour que Windows termine de se lancer normalement.

----------------------

puis colle le rapport antivir
0
Réponse 10 / 17
micka62
 
j'ai deja fait avant mais il n'a rien detecter
la antivir est entrain d'analyser
0
Réponse 11 / 17
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
ok

j'attends antivir

______________

mets a jour JAVA: DEMARRRER puis PANNEAU DE CONFIGURATION puis JAVa puis MISE A JOUR

________________

mets a jour interent explorer ici:

https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html

______________

puis recolle un rapport hiajkchtis et dis tes soucis
0
Réponse 12 / 17
micka62
 
AntiVir PersonalEdition Classic
Report file date: jeudi 14 février 2008 18:55

Scanning for 1109165 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: AURELIE

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 17:48:05
ANTIVIR2.VDF : 7.0.2.113 1673728 Bytes 08/02/2008 17:48:05
ANTIVIR3.VDF : 7.0.2.139 181760 Bytes 14/02/2008 17:48:05
AVEWIN32.DLL : 7.6.0.65 3240448 Bytes 14/02/2008 17:48:06
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 14/02/2008 17:48:06
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 14 février 2008 18:55

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'IncMail.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ImApp.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'SymWSC.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'dslmon.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Scan process 'KBD.exe' - '1' Module(s) have been scanned
Scan process 'hphmon06.exe' - '1' Module(s) have been scanned
Scan process 'AGRSMMSG.exe' - '1' Module(s) have been scanned
Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
45 processes with 45 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '40' files ).

Starting the file scan:

Begin scan in 'C:\' <HP_PAVILION>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Program Files\tmp1159906.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '48248235.qua'!
C:\Program Files\tmp1164859.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '495fdb0e.qua'!
C:\Program Files\tmp9652875.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '48248236.qua'!
C:\QooBox\Quarantine\catchme2008-02-14_173153.34.zip
[0] Archive type: ZIP
--> 45580504.Evt
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was moved to '48288361.qua'!
C:\QooBox\Quarantine\C\Documents and Settings\HP_Propriétaire\Application Data\printer.exe.vir
[DETECTION] Is the Trojan horse TR/Qhost.Aes.15
[INFO] The file was moved to '481d8372.qua'!
C:\QooBox\Quarantine\C\Program Files\ucleaner_setup.exe.vir
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '48208364.qua'!
C:\QooBox\Quarantine\C\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.feh.6
[INFO] The file was moved to '48238370.qua'!
C:\QooBox\Quarantine\C\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824836a.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\asc3550p.sys.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was moved to '48178375.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\Cpb46.sys.vir
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was moved to '48168372.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004824.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e48338.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004825.exe
[DETECTION] Is the Trojan horse TR/Qhost.Aes.15
[INFO] The file was moved to '47e48339.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004842.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was moved to '4699e772.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004851.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e4833a.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004853.exe
[DETECTION] Is the Trojan horse TR/Downloader.Gen
[INFO] The file was moved to '4699e773.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004855.exe
[DETECTION] Is the Trojan horse TR/Dldr.Adload.MA.3
[INFO] The file was moved to '47e4833b.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004867.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47e4833f.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004877.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '4699e708.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004879.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e48340.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP11\A0004986.dll
[DETECTION] Is the Trojan horse TR/Agent.feh.6
[INFO] The file was moved to '47e48344.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP11\A0004987.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4699e70d.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP11\A0005043.dll
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e48346.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005251.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47e4834c.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005252.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e4834d.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005253.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '4699e706.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0001401.exe
[DETECTION] Is the Trojan horse TR/Drop.Agent.elj
[INFO] The file was moved to '47e48379.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0001407.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '4699e732.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0002439.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e4837c.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0002517.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e4837d.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0002556.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e4837e.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0003643.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e48384.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0004793.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '47e48389.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0004794.exe
[DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
[INFO] The file was moved to '47e4838a.qua'!
C:\WINDOWS\Installer\{16b30ccd-9fec-4b6a-9b52-c62d0f18bdc7}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824854c.qua'!
C:\WINDOWS\Installer\{1b04eb1e-8487-4276-aa9c-5e8b4a31f190}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e105.qua'!
C:\WINDOWS\Installer\{1b96784e-1797-4781-bc88-b6668de426d5}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824854e.qua'!
C:\WINDOWS\Installer\{2204d9fc-256e-4fdd-822d-b02cdf5711ba}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824854d.qua'!
C:\WINDOWS\Installer\{267cd549-a02b-4d13-86de-33098cf8f758}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e106.qua'!
C:\WINDOWS\Installer\{2eb1b942-714c-4aba-8cf2-f7bb1b43695c}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e107.qua'!
C:\WINDOWS\Installer\{3837672b-3801-4b56-ab3d-76f520ceff6d}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '48248540.qua'!
C:\WINDOWS\Installer\{4eb2e0b0-64ad-42e9-8531-213a5f231c45}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e109.qua'!
C:\WINDOWS\Installer\{5981974a-2019-48ac-a046-1d63f334034f}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824854f.qua'!
C:\WINDOWS\Installer\{604e2386-3d54-4a5d-a501-f7fcb8442a36}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e118.qua'!
C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll
[DETECTION] Is the Trojan horse TR/Agent.feh.6
[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
[WARNING] The file could not be deleted!
C:\WINDOWS\Installer\{93e50958-880a-4e0e-8668-49ffaf59c73c}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '48248569.qua'!
C:\WINDOWS\Installer\{a785b0a3-d4e9-4d39-8b8e-73a62ca5d401}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959ecc2.qua'!
C:\WINDOWS\Installer\{af8fd45d-5de7-4a7c-b90c-ee5bee4b95b2}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824856a.qua'!
C:\WINDOWS\Installer\{c21c48ef-fbd9-4d8a-acdb-7227c55ed562}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
[WARNING] The file could not be deleted!
C:\WINDOWS\Installer\{cf08737d-beab-4e5f-a3d4-00770784e3a5}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824856c.qua'!
C:\WINDOWS\Installer\{e185fac0-5bd6-4228-a5a4-d1fa037445e8}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e915.qua'!
Begin scan in 'D:\' <HP_RECOVERY>

End of the scan: jeudi 14 février 2008 19:24
Used time: 28:51 min

The scan has been done completely.

5003 Scanning directories
283476 Files were scanned
47 viruses and/or unwanted programs were found
3 Files were classified as suspicious:
0 files were deleted
0 files were repaired
48 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
283429 Files not concerned
14238 Archives were scanned
4 Warnings
0 Notes
0
Réponse 13 / 17
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
vire ce qui est dans le dossier quarantine:
en allant dans poste de travail puis:

C:\QooBox\Quarantine

_________________

mets a jour JAVA: DEMARRRER puis PANNEAU DE CONFIGURATION puis JAVa puis MISE A JOUR

________________

mets a jour internet explorer ici:

https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html

_________________

vire ce qui est en quarantaine dans antivir

___________________

AVG antispyware
https://www.01net.com/telecharger/
http://free.grisoft.com/doc/download-free-anti-spyware/us/frt/0

Tuto :
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html

->Relance AVG AS -> "Analyse" ->"Paramètres"

Sous la question "Comment réagir ?" :

-> clique sur "Actions recommandées" et choisis "Quarantaines"
-> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système"

Si un fichier est infecté en fin d'analyse

->Clique sur "Appliquer toutes les actions "

->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous".

->Enregistre ce fichier texte sur ton bureau ensuite colle le rapport ici

____________________

désactive la restauration système pour purger les virus qui sont dedans
puis redemarre ton ordi
puis réactive là
(dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)

__________________

recolle un rapport antivir et hijakchits et dis tes soucis

a plus
0
Réponse 14 / 17
micka62
 
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 23:36:24 14/02/2008

+ Résultat de l'analyse:

C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@adtech[1].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@m.webtrends[1].txt -> TrackingCookie.Webtrends : Nettoyé.

Fin du rapport
0
Réponse 15 / 17
micka62
 
la restauration systeme va t'elle me fair perdre toute les infos sur mon ordinateur?
0
Réponse 16 / 17
aureli62
 
pour l'instant les virus ne se declare plus toute les 2 minuteset je n'est plus de fenetre qui s'ouvre sur un site de rencontre quand je change de page

voila les rapports
sont ils bons?
AntiVir PersonalEdition Classic
Report file date: vendredi 15 février 2008 10:27

Scanning for 1109165 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: AURELIE

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 17:48:05
ANTIVIR2.VDF : 7.0.2.113 1673728 Bytes 08/02/2008 17:48:05
ANTIVIR3.VDF : 7.0.2.139 181760 Bytes 14/02/2008 17:48:05
AVEWIN32.DLL : 7.6.0.65 3240448 Bytes 14/02/2008 17:48:06
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 14/02/2008 17:48:06
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: vendredi 15 février 2008 10:27

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'hh.exe' - '1' Module(s) have been scanned
Scan process 'Filerecovery.exe' - '1' Module(s) have been scanned
Scan process 'IncMail.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'WOOBrowser.exe' - '1' Module(s) have been scanned
Scan process 'Watch.exe' - '1' Module(s) have been scanned
Scan process 'ALERTM~1.EXE' - '1' Module(s) have been scanned
Scan process 'PollingModule.exe' - '1' Module(s) have been scanned
Scan process 'Inactivity.exe' - '1' Module(s) have been scanned
Scan process 'Toaster.exe' - '1' Module(s) have been scanned
Scan process 'ComComp.exe' - '1' Module(s) have been scanned
Scan process 'GestionnaireInternet.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'ImApp.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'dslmon.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'KBD.exe' - '1' Module(s) have been scanned
Scan process 'hphmon06.exe' - '1' Module(s) have been scanned
Scan process 'AGRSMMSG.exe' - '1' Module(s) have been scanned
Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'SymWSC.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
55 processes with 55 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '34' files ).

Starting the file scan:

Begin scan in 'C:\' <HP_PAVILION>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005256.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005257.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005258.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005259.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005260.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005261.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005262.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005263.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005264.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005267.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005268.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
Begin scan in 'D:\' <HP_RECOVERY>

End of the scan: vendredi 15 février 2008 12:47
Used time: 2:20:33 min

The scan has been done completely.

5145 Scanning directories
310918 Files were scanned
11 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
11 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
310907 Files not concerned
14289 Archives were scanned
2 Warnings
0 Notes

______________________________________________________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:33:21, on 15/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\INCRED~1\bin\ImApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\PC Inspector File Recovery\filerecovery.exe
C:\WINDOWS\hh.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\INCRED~1\bin\ImNotfy.exe
C:\WINDOWS\system32\notepad.exe
C:\HiJackThis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F2C240B-05E9-4406-B466-9C852805A152}: NameServer = 80.10.246.130 81.253.149.10
O21 - SSODL: SrvKernel - {828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b} - C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll (file missing)
O21 - SSODL: zip - {c21c48ef-fbd9-4d8a-acdb-7227c55ed562} - C:\WINDOWS\Installer\{c21c48ef-fbd9-4d8a-acdb-7227c55ed562}\zip.dll (file missing)
O21 - SSODL: BootSetup - {0722d7f2-118b-437e-ba7d-ce06ccd2c104} - C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
0
Réponse 17 / 17
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
ok hiajkchtis est bon:

fix juste ces deux lignes:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

_____________________

antivir a trouvé des virus dans la restauration : pour les virer c'est pas dur:

désactive la restauration système pour purger les virus qui seraient dedans
puis redemarre ton ordi
puis réactive là (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)
------------------

verife ensuite qu'antivir ne toruve plus rizen

si plus de virus c'est bon pour toi!!!

pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

AVAST en français ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
AD AWARE + SPYBOT +/- si tea timer non active de spybot: WINDOWS DEFENDER ou SPYWARE TERMINATOR

+/-
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware on sorti de nouvelles versions cette année vérifiez que vous avez la dernière version
--------
un pare feu :
celui de Windows ou mieux KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------

CCLEANER pour effacer les traces de surf
0

Discussions similaires

Impossible d'afficher le rapport de tableau croisé dynamique sur un rapport
Utilisateur anonyme -
TomH. -

13 réponses
écrire un rapport de travail
asi -
REGINALD -

3 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
virus Artemis!
mabiche37 -
Malekal_morte- -

14 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses