Rapport hijackthis a l'aide plein de virus
micka62
-
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,
voici un rapport hijackthis
qui pourrais me dire sequi ne va pas
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:59:25, on 14/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\INCRED~1\bin\ImApp.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\SysCleaner\SysCleaner.exe
C:\HiJackThis[1]\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
F3 - REG:win.ini: run=C:\WINDOWS\mmhren1.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\c++.exe,
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SystemSv121] C:\WINDOWS\system32\n2ewma1xxsv234.exe
O4 - HKLM\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SysCleaner] "C:\Program Files\SysCleaner\SysCleaner.exe" hide
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe (User 'Default user')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F2C240B-05E9-4406-B466-9C852805A152}: NameServer = 81.253.149.1 80.10.246.3
O21 - SSODL: SrvKernel - {828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b} - C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll
O21 - SSODL: BootSetup - {0722d7f2-118b-437e-ba7d-ce06ccd2c104} - C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
O21 - SSODL: zip - {f50214f6-03f7-4996-9488-019f8f4a5705} - C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll
O22 - SharedTaskScheduler: JKhfj3ofgfgdtj - {B5AF0562-94F3-42BD-F434-2604812C797D} - (no file)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
voici un rapport hijackthis
qui pourrais me dire sequi ne va pas
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:59:25, on 14/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\INCRED~1\bin\ImApp.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\SysCleaner\SysCleaner.exe
C:\HiJackThis[1]\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
F3 - REG:win.ini: run=C:\WINDOWS\mmhren1.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\c++.exe,
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SystemSv121] C:\WINDOWS\system32\n2ewma1xxsv234.exe
O4 - HKLM\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SysCleaner] "C:\Program Files\SysCleaner\SysCleaner.exe" hide
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe (User 'Default user')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\supp ort.htm (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F2C240B-05E9-4406-B466-9C852805A152}: NameServer = 81.253.149.1 80.10.246.3
O21 - SSODL: SrvKernel - {828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b} - C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll
O21 - SSODL: BootSetup - {0722d7f2-118b-437e-ba7d-ce06ccd2c104} - C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
O21 - SSODL: zip - {f50214f6-03f7-4996-9488-019f8f4a5705} - C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll
O22 - SharedTaskScheduler: JKhfj3ofgfgdtj - {B5AF0562-94F3-42BD-F434-2604812C797D} - (no file)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
Configuration: Windows XP Internet Explorer 6.0
17 réponses
-
slt,
desactive le tea timer de spybot le temps des desinfections
____________
Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".
F3 - REG:win.ini: run=C:\WINDOWS\mmhren1.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SystemSv121] C:\WINDOWS\system32\n2ewma1xxsv234.exe
O4 - HKLM\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe
O4 - HKCU\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [SysCleaner] "C:\Program Files\SysCleaner\SysCleaner.exe" hide
O4 - HKUS\S-1-5-18\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Microsoft hren1] C:\WINDOWS\mmhren1.exe (User 'Default user')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O21 - SSODL: SrvKernel - {828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b} - C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll
O21 - SSODL: BootSetup - {0722d7f2-118b-437e-ba7d-ce06ccd2c104} - C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
O21 - SSODL: zip - {f50214f6-03f7-4996-9488-019f8f4a5705} - C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll
O22 - SharedTaskScheduler: JKhfj3ofgfgdtj - {B5AF0562-94F3-42BD-F434-2604812C797D} - (no file)
___________________
Télécharge Combofix sUBs : combofix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
DESACTIVE LA PROTECTION avast DURANT LA PROCEDURE
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
file::
C:\WINDOWS\system32\n2ewma1xxsv234.exe
C:\WINDOWS\mmhren1.exe
C:\WINDOWS\mmhren1.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll
Enregistre ce fichier sous le nom CFScript
[*]Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture suivante:
http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif
colle le rapport combofix et un nouveau hiajckthis -
-
-
tu les supprime avec combofix
C:\WINDOWS\system32\n2ewma1xxsv234.exe
C:\WINDOWS\mmhren1.exe
C:\WINDOWS\mmhren1.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
voila le rapport combo fix
ComboFix 08-02-14.3 - HP_Propriétaire 2008-02-14 17:47:12.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.232 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Propriétaire\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
FILE
C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll
C:\WINDOWS\mmhren1.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\n2ewma1xxsv234.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll
C:\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll
.
---- Previous Run -------
.
C:\WINDOWS\system32\config\45580504.Evt
C:\WINDOWS\system32\drivers\symavc32.sys
C:\Documents and Settings\HP_Propriétaire\Application Data\Install.dat
C:\Documents and Settings\HP_Propriétaire\Application Data\printer.exe
C:\Program Files\ucleaner_setup.exe
C:\WINDOWS\system32\config\45580504.Evt
C:\WINDOWS\system32\dllgh8jkd1q8.exe
C:\WINDOWS\system32\drivers\asc3550p.sys
C:\WINDOWS\system32\drivers\CPB46.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_ASC3550P
-------\LEGACY_CPB46
-------\asc3550p
((((((((((((((((((((((((((((( Fichiers créés 2008-01-14 to 2008-02-14 ))))))))))))))))))))))))))))))))))))
.
2008-02-14 15:55 . 2008-02-14 15:55 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\SysCleaner
2008-02-14 15:54 . 2008-02-13 13:22 <REP> d-------- C:\SDFix
2008-02-14 15:47 . 2005-06-15 10:30 18,944 --a------ C:\Documents and Settings\HP_Propriétaire\Application Data\nvsvc1024.dll
2008-02-14 12:56 . 2008-02-14 13:30 <REP> d-------- C:\Program Files\Lavasoft
2008-02-14 12:56 . 2008-02-14 12:56 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-02-14 12:56 . 2008-02-14 12:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-14 12:21 . 2008-02-14 12:47 <REP> d-------- C:\Program Files\a-squared Free
2008-02-13 22:31 . 2008-02-14 15:51 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-02-13 18:23 . 2008-02-13 18:23 43,691 --a------ C:\Program Files\tmp1164859.exe
2008-02-13 18:23 . 2008-02-13 18:23 11,031 --a------ C:\Program Files\tmp1159906.exe
2008-02-13 18:23 . 2008-02-13 18:23 9,611 --a------ C:\Program Files\tmp1160000.exe
2008-02-13 17:03 . 2008-02-14 17:16 <REP> d-------- C:\HiJackThis[1]
2008-02-13 16:52 . 2008-02-14 16:05 <REP> d-------- C:\Program Files\Navilog1
2008-02-13 16:38 . 2008-02-13 16:38 45,061 --a------ C:\Program Files\tmp9652875.exe
2008-02-13 11:13 . 2008-02-13 11:13 6,771 --a------ C:\Program Files\tmp3494515.exe
2008-02-13 10:59 . 2008-02-13 13:57 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2008-02-13 10:10 . 2008-02-13 10:10 169 --a------ C:\WINDOWS\wininit.ini
2008-02-13 09:36 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
2008-02-13 09:36 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-02-13 09:36 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-02-13 09:36 . 2008-02-11 18:12 <REP> d-------- C:\Documents and Settings\Administrateur\Modèles
2008-02-13 09:36 . 2005-01-02 05:07 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-02-13 09:36 . 2004-11-25 04:26 <REP> d-------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-02-13 09:36 . 2008-02-11 12:04 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-02-13 09:36 . 2005-01-02 04:42 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-02-13 09:36 . 2005-01-02 04:57 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-02-13 09:36 . 2005-01-02 04:49 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\SampleView
2008-02-13 09:36 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
2008-02-13 08:43 . 2008-02-13 09:32 10,240 --a------ C:\Program Files\tmp145921.exe
2008-02-13 08:43 . 2008-02-13 09:32 10,240 --a------ C:\Program Files\tmp145875.exe
2008-02-13 08:42 . 2008-02-13 09:32 10,240 --a------ C:\Program Files\tmp113187.exe
2008-02-13 08:37 . 2008-02-13 08:37 <REP> d-------- C:\Program Files\CleanUp!
2008-02-13 08:09 . 2008-02-13 21:21 14 --ah----- C:\WINDOWS\mmax_hren2.ini
2008-02-13 03:01 . 2008-02-13 03:01 <REP> d-------- C:\Program Files\MSXML 4.0
2008-02-13 00:09 . 2008-02-13 08:09 24 --a------ C:\WINDOWS\system32\svchost.t__
2008-02-12 20:49 . 2008-02-14 14:08 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-12 20:44 . 2008-02-14 17:25 <REP> d-------- C:\Program Files\SysCleaner
2008-02-12 17:06 . 2008-02-12 17:06 <REP> d-------- C:\WINDOWS\Sun
2008-02-12 12:27 . 2008-02-12 12:27 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-02-12 12:27 . 2008-02-12 12:31 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\AdobeUM
2008-02-12 09:28 . 2008-02-14 17:34 <REP> d---s---- C:\Documents and Settings\HP_Propriétaire\UserData
2008-02-12 09:28 . 2008-02-14 17:34 <REP> d---s---- C:\Documents and Settings\HP_Propriétaire\UserData
2008-02-12 03:03 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-02-11 18:12 . 2008-02-11 12:21 <REP> d-------- C:\WINDOWS\I386
2008-02-11 17:39 . 2008-02-11 17:40 <REP> d-------- C:\Program Files\IncrediMail
2008-02-11 17:33 . 2008-02-11 17:33 <REP> d-------- C:\Program Files\Alwil Software
2008-02-11 17:33 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-02-11 17:33 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-02-11 17:33 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-02-11 17:33 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-02-11 17:33 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-02-11 17:33 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-11 17:33 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-02-11 17:33 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-11 17:25 . 2008-02-12 13:08 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Contacts
2008-02-11 17:25 . 2008-02-12 13:08 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Contacts
2008-02-11 17:23 . 2008-02-11 17:23 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-02-11 17:19 . 2008-02-11 17:24 <REP> d-------- C:\Program Files\MSN Messenger
2008-02-11 16:35 . 2008-02-11 16:35 <REP> d-------- C:\Program Files\Convar
2008-02-11 16:35 . 2003-07-18 13:58 516,784 -ra------ C:\WINDOWS\system32\XceedCry.dll
2008-02-11 16:35 . 2002-02-28 09:46 217,088 --a------ C:\WINDOWS\system32\DartSock.dll
2008-02-11 16:35 . 2000-05-22 00:00 140,488 --a------ C:\WINDOWS\system32\COMDLG32.OCX
2008-02-11 16:35 . 2002-02-21 10:12 118,784 --a------ C:\WINDOWS\system32\DartWeb.dll
2008-02-11 16:35 . 1998-06-18 00:00 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL
2008-02-11 16:35 . 1998-06-13 22:53 44,544 --a------ C:\WINDOWS\system32\Gif89.dll
2008-02-11 16:35 . 2002-04-12 13:19 28,672 --a------ C:\WINDOWS\system32\DartWeb.oca
2008-02-11 13:55 . 2008-02-11 13:55 <REP> d-------- C:\Program Files\Micro Application
2008-02-11 12:19 . 2004-08-23 14:50 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2008-02-11 12:18 . 2008-02-11 12:18 <REP> d-------- C:\Program Files\SAGEM
2008-02-11 12:17 . 2008-02-14 17:41 <REP> d-------- C:\Program Files\Wanadoo
2008-02-11 12:17 . 2008-02-11 12:17 <REP> d-------- C:\Program Files\Securitoo
2008-02-11 12:10 . 2008-02-11 12:10 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Sonic
2008-02-11 12:10 . 2008-02-11 12:10 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Leadertech
2008-02-11 12:04 . 2004-08-05 19:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-02-11 12:04 . 2008-02-11 12:04 1,844 -rahs---- C:\WINDOWS\system32\drivers\103C_HP_CPC_EC639AA-ABF t3145.fr_YC_0Pavi_QCZB530_E53FRheBLU2_47_IAMETHYST-M_SMSI_V1.0_B3.18_T050609_WXH2_L40C_M511_J160_7AMD_8Athlon 64_91.99_#080211_N10EC8139_Z11C1048C_G10025B60_OLITE-ON DVDRW SOHW-1633S.MRK
2008-02-11 12:03 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\WINDOWS
2008-02-11 12:03 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\WINDOWS
2008-02-11 12:03 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Voisinage réseau
2008-02-11 12:03 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Voisinage réseau
2008-02-11 12:03 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Voisinage d'impression
2008-02-11 12:03 . 2004-11-24 02:37 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Voisinage d'impression
2008-02-11 12:03 . 2008-02-11 18:12 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Modèles
2008-02-11 12:03 . 2008-02-11 18:12 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Modèles
2008-02-11 12:03 . 2008-02-14 12:49 <REP> dr------- C:\Documents and Settings\HP_Propriétaire\Mes documents
2008-02-11 12:03 . 2008-02-14 12:49 <REP> dr------- C:\Documents and Settings\HP_Propriétaire\Mes documents
2008-02-11 12:03 . 2008-02-11 12:17 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Menu Démarrer
2008-02-11 12:03 . 2008-02-11 12:17 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Menu Démarrer
2008-02-11 12:03 . 2008-02-14 15:52 <REP> dr------- C:\Documents and Settings\HP_Propriétaire\Favoris
2008-02-11 12:03 . 2008-02-14 15:52 <REP> dr------- C:\Documents and Settings\HP_Propriétaire\Favoris
2008-02-11 12:03 . 2008-02-14 17:47 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Bureau
2008-02-11 12:03 . 2008-02-14 17:47 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Bureau
2008-02-11 12:03 . 2005-01-02 04:57 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Symantec
2008-02-11 12:03 . 2005-01-02 04:49 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\SampleView
2008-02-11 12:03 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Apple Computer
2008-02-11 10:20 . 2005-01-02 04:38 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\WINDOWS
2008-02-11 10:20 . 2005-01-02 04:57 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec
2008-02-11 10:20 . 2005-01-02 04:49 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\SampleView
2008-02-11 10:20 . 2005-01-02 04:38 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Apple Computer
2008-02-11 10:20 . 2005-01-02 04:38 <REP> d-------- C:\Documents and Settings\Default User\WINDOWS
2008-02-11 10:20 . 2008-02-11 10:20 <REP> d-------- C:\Documents and Settings\All Users\Menu D‚marrer
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-14 14:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-12 02:24 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-02-12 02:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-11 16:07 --------- d-----w C:\Program Files\Symantec
2008-02-11 11:18 31 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-02-11 11:14 --------- d-----w C:\Program Files\Easy Internet signup
2008-02-11 11:04 1,844 --sha-r C:\WINDOWS\system32\drivers\103C_HP_CPC_EC639AA-ABF t3145.fr_YC_0Pavi_QCZB530_E53FRheBLU2_47_IAMETHYST-M_SMSI_V1.0_B3.18_T050609_WXH2_L40C_M511_J160_7AMD_8Athlon 64_91.99_#080211_N10EC8139_Z11C1048C_G10025B60_OLITE-ON DVDRW SOHW-1633S.MRK
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 14:37 3,080,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-07 01:07 96,768 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll
2007-12-07 01:07 663,552 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-07 01:07 663,552 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-12-07 01:07 617,472 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-12-07 01:07 55,808 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-12-07 01:07 532,480 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-12-07 01:07 474,624 ----a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-12-07 01:07 449,024 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-12-07 01:07 39,424 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-12-07 01:07 357,888 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-07 01:07 251,392 ----a-w C:\WINDOWS\system32\dllcache\iepeers.dll
2007-12-07 01:07 205,312 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-12-07 01:07 16,384 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-12-07 01:07 152,064 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll
2007-12-07 01:07 146,432 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-12-07 01:07 1,495,040 ----a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-12-07 01:07 1,056,768 ----a-w C:\WINDOWS\system32\dllcache\danim.dll
2007-12-07 01:07 1,024,000 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll
2007-12-06 13:07 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-11-14 07:28 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOKIT"="C:\Program Files\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2008-02-03 15:04 214456]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 17:04 52736]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 18:06 88363 C:\WINDOWS\AGRSMMSG.exe]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 19:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 19:43 659456]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 23:44 61440]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 21:43 233472]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-13 04:05 339968]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2004-10-25 22:17 90112]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 21:54 253952]
"autoclk"="autoclk.exe" []
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-02-11 12:18:46 839680]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-05 02:28:24 258048]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SrvKernel"= {828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b} - C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll [2008-02-12 20:32 14374]
"zip"= {c21c48ef-fbd9-4d8a-acdb-7227c55ed562} - C:\WINDOWS\Installer\{c21c48ef-fbd9-4d8a-acdb-7227c55ed562}\zip.dll [2008-02-13 16:38 38438]
"BootSetup"= {0722d7f2-118b-437e-ba7d-ce06ccd2c104} - C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll [ ]
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-04 18:50]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 06:08]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-02 19:25]
S4 Google Online Search Service;Google Online Search Service;C:\WINDOWS\system32\winlagons.exe []
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2005-01-02 03:59:45 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
"2008-02-14 11:17:20 C:\WINDOWS\Tasks\WebReg psc 1500 series.job"
- c:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-14 17:48:22
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-02-14 17:48:43
ComboFix-quarantined-files.txt 2008-02-14 16:48:35
.
2008-02-13 19:41:24 --- E O F --- -
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:55:47, on 14/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\PROGRA~1\INCRED~1\bin\ImApp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HiJackThis[1]\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F2C240B-05E9-4406-B466-9C852805A152}: NameServer = 80.10.246.130 81.253.149.10
O21 - SSODL: SrvKernel - {828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b} - C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll
O21 - SSODL: zip - {c21c48ef-fbd9-4d8a-acdb-7227c55ed562} - C:\WINDOWS\Installer\{c21c48ef-fbd9-4d8a-acdb-7227c55ed562}\zip.dll
O21 - SSODL: BootSetup - {0722d7f2-118b-437e-ba7d-ce06ccd2c104} - C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
-
remplace avast par antivir et colle le rapport
et surtout dis moi quels sont tes soucis actuels!!!
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal) -
ben fete je me suis choper le virus msn "c'est toi sur la photo?"
et maintenant j'ai un tas de virus que je n'arrive pas a faire partir
je suis entrain de desinstaller avast -
ok
Télécharge MSNFix de Laurent
http://sosvirus.changelog.fr/MSNFix.zip
Décompresse-le et double clic sur le fichier MSNFix.bat.
- Exécute l'option R.
--Si l'infection est détectée, exécute l'option N
- Sauvegarde ce rapport puis fais un copier/coller de ce rapport sur le forum.
Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal
Sauvegarder et fermer le rapport pour que Windows termine de se lancer normalement.
----------------------
puis colle le rapport antivir -
-
ok
j'attends antivir
______________
mets a jour JAVA: DEMARRRER puis PANNEAU DE CONFIGURATION puis JAVa puis MISE A JOUR
________________
mets a jour interent explorer ici:
https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html
______________
puis recolle un rapport hiajkchtis et dis tes soucis -
AntiVir PersonalEdition Classic
Report file date: jeudi 14 février 2008 18:55
Scanning for 1109165 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: AURELIE
Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 17:48:05
ANTIVIR2.VDF : 7.0.2.113 1673728 Bytes 08/02/2008 17:48:05
ANTIVIR3.VDF : 7.0.2.139 181760 Bytes 14/02/2008 17:48:05
AVEWIN32.DLL : 7.6.0.65 3240448 Bytes 14/02/2008 17:48:06
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 14/02/2008 17:48:06
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: jeudi 14 février 2008 18:55
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'IncMail.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ImApp.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'SymWSC.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'dslmon.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Scan process 'KBD.exe' - '1' Module(s) have been scanned
Scan process 'hphmon06.exe' - '1' Module(s) have been scanned
Scan process 'AGRSMMSG.exe' - '1' Module(s) have been scanned
Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
45 processes with 45 modules were scanned
Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!
Starting to scan the registry.
The registry was scanned ( '40' files ).
Starting the file scan:
Begin scan in 'C:\' <HP_PAVILION>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Program Files\tmp1159906.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '48248235.qua'!
C:\Program Files\tmp1164859.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '495fdb0e.qua'!
C:\Program Files\tmp9652875.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '48248236.qua'!
C:\QooBox\Quarantine\catchme2008-02-14_173153.34.zip
[0] Archive type: ZIP
--> 45580504.Evt
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was moved to '48288361.qua'!
C:\QooBox\Quarantine\C\Documents and Settings\HP_Propriétaire\Application Data\printer.exe.vir
[DETECTION] Is the Trojan horse TR/Qhost.Aes.15
[INFO] The file was moved to '481d8372.qua'!
C:\QooBox\Quarantine\C\Program Files\ucleaner_setup.exe.vir
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '48208364.qua'!
C:\QooBox\Quarantine\C\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.feh.6
[INFO] The file was moved to '48238370.qua'!
C:\QooBox\Quarantine\C\WINDOWS\Installer\{f50214f6-03f7-4996-9488-019f8f4a5705}\zip.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824836a.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\asc3550p.sys.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was moved to '48178375.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\Cpb46.sys.vir
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was moved to '48168372.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004824.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e48338.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004825.exe
[DETECTION] Is the Trojan horse TR/Qhost.Aes.15
[INFO] The file was moved to '47e48339.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004842.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was moved to '4699e772.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004851.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e4833a.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004853.exe
[DETECTION] Is the Trojan horse TR/Downloader.Gen
[INFO] The file was moved to '4699e773.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004855.exe
[DETECTION] Is the Trojan horse TR/Dldr.Adload.MA.3
[INFO] The file was moved to '47e4833b.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004867.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47e4833f.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004877.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '4699e708.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP10\A0004879.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e48340.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP11\A0004986.dll
[DETECTION] Is the Trojan horse TR/Agent.feh.6
[INFO] The file was moved to '47e48344.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP11\A0004987.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4699e70d.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP11\A0005043.dll
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e48346.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005251.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47e4834c.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005252.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e4834d.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005253.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '4699e706.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0001401.exe
[DETECTION] Is the Trojan horse TR/Drop.Agent.elj
[INFO] The file was moved to '47e48379.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0001407.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '4699e732.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0002439.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e4837c.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0002517.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e4837d.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0002556.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e4837e.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0003643.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[INFO] The file was moved to '47e48384.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0004793.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '47e48389.qua'!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP9\A0004794.exe
[DETECTION] Contains detection pattern of the worm WORM/Zhelatin.Gen
[INFO] The file was moved to '47e4838a.qua'!
C:\WINDOWS\Installer\{16b30ccd-9fec-4b6a-9b52-c62d0f18bdc7}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824854c.qua'!
C:\WINDOWS\Installer\{1b04eb1e-8487-4276-aa9c-5e8b4a31f190}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e105.qua'!
C:\WINDOWS\Installer\{1b96784e-1797-4781-bc88-b6668de426d5}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824854e.qua'!
C:\WINDOWS\Installer\{2204d9fc-256e-4fdd-822d-b02cdf5711ba}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824854d.qua'!
C:\WINDOWS\Installer\{267cd549-a02b-4d13-86de-33098cf8f758}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e106.qua'!
C:\WINDOWS\Installer\{2eb1b942-714c-4aba-8cf2-f7bb1b43695c}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e107.qua'!
C:\WINDOWS\Installer\{3837672b-3801-4b56-ab3d-76f520ceff6d}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '48248540.qua'!
C:\WINDOWS\Installer\{4eb2e0b0-64ad-42e9-8531-213a5f231c45}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e109.qua'!
C:\WINDOWS\Installer\{5981974a-2019-48ac-a046-1d63f334034f}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824854f.qua'!
C:\WINDOWS\Installer\{604e2386-3d54-4a5d-a501-f7fcb8442a36}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e118.qua'!
C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll
[DETECTION] Is the Trojan horse TR/Agent.feh.6
[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
[WARNING] The file could not be deleted!
C:\WINDOWS\Installer\{93e50958-880a-4e0e-8668-49ffaf59c73c}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '48248569.qua'!
C:\WINDOWS\Installer\{a785b0a3-d4e9-4d39-8b8e-73a62ca5d401}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959ecc2.qua'!
C:\WINDOWS\Installer\{af8fd45d-5de7-4a7c-b90c-ee5bee4b95b2}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824856a.qua'!
C:\WINDOWS\Installer\{c21c48ef-fbd9-4d8a-acdb-7227c55ed562}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
[WARNING] The file could not be deleted!
C:\WINDOWS\Installer\{cf08737d-beab-4e5f-a3d4-00770784e3a5}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4824856c.qua'!
C:\WINDOWS\Installer\{e185fac0-5bd6-4228-a5a4-d1fa037445e8}\zip.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was moved to '4959e915.qua'!
Begin scan in 'D:\' <HP_RECOVERY>
End of the scan: jeudi 14 février 2008 19:24
Used time: 28:51 min
The scan has been done completely.
5003 Scanning directories
283476 Files were scanned
47 viruses and/or unwanted programs were found
3 Files were classified as suspicious:
0 files were deleted
0 files were repaired
48 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
283429 Files not concerned
14238 Archives were scanned
4 Warnings
0 Notes -
vire ce qui est dans le dossier quarantine:
en allant dans poste de travail puis:
C:\QooBox\Quarantine
_________________
mets a jour JAVA: DEMARRRER puis PANNEAU DE CONFIGURATION puis JAVa puis MISE A JOUR
________________
mets a jour internet explorer ici:
https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html
_________________
vire ce qui est en quarantaine dans antivir
___________________
AVG antispyware
https://www.01net.com/telecharger/
http://free.grisoft.com/doc/download-free-anti-spyware/us/frt/0
Tuto :
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html
->Relance AVG AS -> "Analyse" ->"Paramètres"
Sous la question "Comment réagir ?" :
-> clique sur "Actions recommandées" et choisis "Quarantaines"
-> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système"
Si un fichier est infecté en fin d'analyse
->Clique sur "Appliquer toutes les actions "
->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous".
->Enregistre ce fichier texte sur ton bureau ensuite colle le rapport ici
____________________
désactive la restauration système pour purger les virus qui sont dedans
puis redemarre ton ordi
puis réactive là
(dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)
__________________
recolle un rapport antivir et hijakchits et dis tes soucis
a plus -
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------
+ Créé à: 23:36:24 14/02/2008
+ Résultat de l'analyse:
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@adtech[1].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@m.webtrends[1].txt -> TrackingCookie.Webtrends : Nettoyé.
Fin du rapport -
-
pour l'instant les virus ne se declare plus toute les 2 minuteset je n'est plus de fenetre qui s'ouvre sur un site de rencontre quand je change de page
voila les rapports
sont ils bons?
AntiVir PersonalEdition Classic
Report file date: vendredi 15 février 2008 10:27
Scanning for 1109165 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: AURELIE
Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 17:48:05
ANTIVIR2.VDF : 7.0.2.113 1673728 Bytes 08/02/2008 17:48:05
ANTIVIR3.VDF : 7.0.2.139 181760 Bytes 14/02/2008 17:48:05
AVEWIN32.DLL : 7.6.0.65 3240448 Bytes 14/02/2008 17:48:06
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 14/02/2008 17:48:06
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: vendredi 15 février 2008 10:27
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'hh.exe' - '1' Module(s) have been scanned
Scan process 'Filerecovery.exe' - '1' Module(s) have been scanned
Scan process 'IncMail.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'WOOBrowser.exe' - '1' Module(s) have been scanned
Scan process 'Watch.exe' - '1' Module(s) have been scanned
Scan process 'ALERTM~1.EXE' - '1' Module(s) have been scanned
Scan process 'PollingModule.exe' - '1' Module(s) have been scanned
Scan process 'Inactivity.exe' - '1' Module(s) have been scanned
Scan process 'Toaster.exe' - '1' Module(s) have been scanned
Scan process 'ComComp.exe' - '1' Module(s) have been scanned
Scan process 'GestionnaireInternet.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'ImApp.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'dslmon.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'KBD.exe' - '1' Module(s) have been scanned
Scan process 'hphmon06.exe' - '1' Module(s) have been scanned
Scan process 'AGRSMMSG.exe' - '1' Module(s) have been scanned
Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'SymWSC.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
55 processes with 55 modules were scanned
Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!
Starting to scan the registry.
The registry was scanned ( '34' files ).
Starting the file scan:
Begin scan in 'C:\' <HP_PAVILION>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005256.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005257.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005258.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005259.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005260.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005261.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005262.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005263.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005264.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005267.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0005268.dll
[DETECTION] Is the Trojan horse TR/Dldr.BHO.CT
[INFO] The file was deleted!
Begin scan in 'D:\' <HP_RECOVERY>
End of the scan: vendredi 15 février 2008 12:47
Used time: 2:20:33 min
The scan has been done completely.
5145 Scanning directories
310918 Files were scanned
11 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
11 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
310907 Files not concerned
14289 Archives were scanned
2 Warnings
0 Notes
______________________________________________________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:33:21, on 15/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\INCRED~1\bin\ImApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\PC Inspector File Recovery\filerecovery.exe
C:\WINDOWS\hh.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\INCRED~1\bin\ImNotfy.exe
C:\WINDOWS\system32\notepad.exe
C:\HiJackThis[1]\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F2C240B-05E9-4406-B466-9C852805A152}: NameServer = 80.10.246.130 81.253.149.10
O21 - SSODL: SrvKernel - {828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b} - C:\WINDOWS\Installer\{828bd38d-8dc2-4a6b-a5b1-2c8f15958b9b}\SrvKernel.dll (file missing)
O21 - SSODL: zip - {c21c48ef-fbd9-4d8a-acdb-7227c55ed562} - C:\WINDOWS\Installer\{c21c48ef-fbd9-4d8a-acdb-7227c55ed562}\zip.dll (file missing)
O21 - SSODL: BootSetup - {0722d7f2-118b-437e-ba7d-ce06ccd2c104} - C:\WINDOWS\Installer\{0722d7f2-118b-437e-ba7d-ce06ccd2c104}\BootSetup.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
-
ok hiajkchtis est bon:
fix juste ces deux lignes:
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
_____________________
antivir a trouvé des virus dans la restauration : pour les virer c'est pas dur:
désactive la restauration système pour purger les virus qui seraient dedans
puis redemarre ton ordi
puis réactive là (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)
------------------
verife ensuite qu'antivir ne toruve plus rizen
si plus de virus c'est bon pour toi!!!
pour protéger gratos ton ordi
http://www.commentcamarche.net/telecharger/logiciel 4 securite
mettre un antivirus
AVAST en français ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
AD AWARE + SPYBOT +/- si tea timer non active de spybot: WINDOWS DEFENDER ou SPYWARE TERMINATOR
+/-
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...
Rq : spybot et ad-aware on sorti de nouvelles versions cette année vérifiez que vous avez la dernière version
--------
un pare feu :
celui de Windows ou mieux KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm
-----------
CCLEANER pour effacer les traces de surf
