Des pages internet s'ouvre tout a coup.
Résolu
psgman94450
-
psgman94450 -
psgman94450 -
Bonjour, Je commences a avoir un problème des pages internet s'ouvre j'avais ce problème mais depuis 1 mois il n'a avait aucune page qui s'ouvrait puis tout a coup il est revenu.Comment faire.Si vous avez besoin d'un rapport dite le moi.Merci cordialement.
Configuration: Windows XP Firefox 2.0.0.13
8 réponses
-
bonsoir
tu poste un rapport hijackthis http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis
= Clic-droit sur Hijackthis
= Extraire ici ( ou extraire sans confirmation ou tout ou unzip)
= clic droit sur Hijackthis ==> renommer ==> écrire : test.exe ( à la place de hijackthis.exe) <== Important
=Double-clic dessus
= Clic Do a system scan and save the log
=coller le rapport
si problème voir l'aide
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm-
Salut tien mon rapport et au faite la je suis en train de faire une recherche avec Spybot
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:54:57, on 28/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iPod\Bin\iPodSrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\service.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hercules\WiFi Station\WifiStation.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Popup Manager - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - (no file)
O2 - BHO: (no name) - {0D3E9C78-8CE2-4222-AFA7-E9D8974D0B4C} - (no file)
O2 - BHO: (no name) - {0E229538-9841-4BE7-069A-5DBB0A201667} - (no file)
O2 - BHO: (no name) - {110D6444-9CC7-47B6-AAE5-A9AA52823346} - (no file)
O2 - BHO: (no name) - {179A54AE-9F7D-48C5-AF77-641FAA2F5CCD} - (no file)
O2 - BHO: (no name) - {29E5DB24-B5C2-471B-A3A3-8E248A720B20} - (no file)
O2 - BHO: (no name) - {3533728E-1A85-42F3-8F29-57CFA72F66AF} - (no file)
O2 - BHO: (no name) - {37C47C14-CD8E-4752-AE58-BAB481ECEEC5} - (no file)
O2 - BHO: (no name) - {47E14067-1267-49A3-BC18-8C937B02825F} - (no file)
O2 - BHO: (no name) - {4F5A1E7F-5388-44DC-93BB-66A155CE5E1F} - (no file)
O2 - BHO: (no name) - {510247af-ff8b-44ed-921b-84108885a4d0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {61210148-0170-4A26-A2A1-E71B66FC9F3C} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: (no name) - {65876774-B17A-4A90-966F-1CCB3C4F2BD6} - (no file)
O2 - BHO: (no name) - {67602201-1254-40F6-9565-208BFDF794FB} - (no file)
O2 - BHO: (no name) - {69af0e78-a36a-4083-a11f-2bef7e39b3d9} - (no file)
O2 - BHO: (no name) - {6EC4E01B-DBDD-4FED-AC84-C0F4FA06E329} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7B89E8C0-04E0-4EF8-BD8B-8D306305E65E} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {86034AC2-9E33-4B0A-1285-E55448EA80B4} - (no file)
O2 - BHO: (no name) - {8D1B6220-7A6B-4706-8410-A15CDE7B3B18} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: GNX Bingo - {903AD98D-8A91-4FBB-B5E1-4FFCA9003E6A} - C:\WINDOWS\kdftlboeorn.dll
O2 - BHO: Mirar - {9A9C9B69-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\version69ie7fix.dll
O2 - BHO: (no name) - {9BC5681C-0BA7-421E-97BB-E5602E2203CA} - (no file)
O2 - BHO: (no name) - {A083FD98-285A-4FC2-81A1-52CEFB8C44FF} - (no file)
O2 - BHO: (no name) - {A1DBB56C-2CF2-49F2-9440-AAFDF0027944} - (no file)
O2 - BHO: (no name) - {B1B20837-6EBB-4B3C-B893-0F436FE5FD2A} - (no file)
O2 - BHO: (no name) - {B35DFFFF-53CF-4B07-981F-278710B5C6FA} - (no file)
O2 - BHO: (no name) - {B813124D-B958-4354-8DEA-DBF5A6C2B752} - (no file)
O2 - BHO: (no name) - {BC8EE999-540D-4DEE-B2F9-A5092CC1881D} - (no file)
O2 - BHO: (no name) - {C085F10A-8F8A-430D-2EB3-A40AF26FFE89} - (no file)
O2 - BHO: (no name) - {CEA1D74E-7384-4A41-90A9-48C7B0E1527B} - (no file)
O2 - BHO: (no name) - {D1DD36C6-511E-4CEC-BC90-69CC8DBC5A29} - (no file)
O2 - BHO: (no name) - {D3F9CE4E-2354-4973-AACA-383E87632F99} - (no file)
O2 - BHO: (no name) - {DD6922E7-87E6-4128-8AFD-7DBA107B072D} - (no file)
O2 - BHO: (no name) - {E3D46394-0854-4511-9D76-98D3E385D47B} - (no file)
O2 - BHO: NavigationAdvisor - {E60A8FF7-B9B4-8ABC-10E8-10F2461DFA50} - C:\Program Files\NavigationAdvisor\NavigationAdvisor-2.dll
O2 - BHO: (no name) - {E758A8FB-FD4C-4380-A1B4-6DF73E39271F} - (no file)
O2 - BHO: (no name) - {F0DF92C7-738A-4302-9F16-DE8A2B60F855} - (no file)
O2 - BHO: (no name) - {f1fe1f4a-6fec-4c31-b261-cff85b56a4dd} - (no file)
O2 - BHO: (no name) - {F4102828-150B-47D3-A126-D30D768D37CF} - (no file)
O2 - BHO: (no name) - {f85cdad1-73b5-4b72-ba38-450ebf64d3cb} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Mirar - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\system32\version69ie7fix.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [MDNS] C:\WINDOWS\system32\service.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - S-1-5-18 Startup: La Solution Ciel.lnk = C:\CIEL\STARTER.EXE (User 'SYSTEM')
O4 - .DEFAULT Startup: La Solution Ciel.lnk = C:\CIEL\STARTER.EXE (User 'Default user')
O4 - Startup: La Solution Ciel.lnk = C:\CIEL\STARTER.EXE
O4 - Global Startup: WiFi Station.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O20 - Winlogon Notify: vtstq - C:\WINDOWS\
O20 - Winlogon Notify: xxyyayx - xxyyayx.dll (file missing)
O22 - SharedTaskScheduler: {874443fe-aa33-4ebf-a6ac-73208787e62d} - bestreak - (no file)
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodSrv - Unknown owner - C:\Program Files\iPod\Bin\iPodSrv.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\WindowsUpdate\profsybywuus.html
O24 - Desktop Component 1: (no name) - http://www.psg.fr/images/photo_content/cp_44c296aaa36b934AC1534papier.jpg
-
-
bonjour
pas d'antivirus résultat très infectés.
je te conseille comme antivirus plutot antivir
http://www.commentcamarche.net/telecharger/telecharger 55 antivir
bien régler antivir
https://forum.malekal.com/viewtopic.php?f=45&t=4192
tu installe avg antispyware
http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware#description
tu installe MalwareByte's Anti-Malware
,
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
tu nettoie ce qui trouve et colle le rapport.
tu as du travail
a plus tard-
-
-
Tiens voici mon rapport
AntiVir PersonalEdition Classic
Report file date: samedi 29 mars 2008 11:35
Scanning for 1169688 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: yanis
Computer name: TITANIUM
Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 10:28:33
ANTIVIR2.VDF : 7.0.3.85 434176 Bytes 27/03/2008 10:28:33
ANTIVIR3.VDF : 7.0.3.92 20480 Bytes 28/03/2008 10:28:33
AVEWIN32.DLL : 7.6.0.78 3408384 Bytes 29/03/2008 10:28:35
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 29/03/2008 10:28:36
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21
Configuration settings for the scan:
Jobname..........................: Local Hard Disks
Configuration file...............: c:\program files\avira\antivir personaledition classic\alldiscs.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: samedi 29 mars 2008 11:35
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'service.exe' - '1' Module(s) have been scanned
Module is infected -> 'C:\WINDOWS\system32\service.exe'
Scan process 'LimeWire.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'WgaTray.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'mdm.exe' - '1' Module(s) have been scanned
Scan process 'iPodSrv.exe' - '1' Module(s) have been scanned
Scan process 'WiFiStation.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
Process 'service.exe' has been terminated
C:\WINDOWS\system32\service.exe
[DETECTION] Is the Trojan horse TR/Agent.90112.G
[INFO] TR/Agent.90112.G:[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN]:<MDNS>=sz:service.exe
[INFO] The file was moved to '48601bde.qua'!
29 processes with 28 modules were scanned
Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Starting to scan the registry.
The registry was scanned ( '33' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\yanis\Local Settings\Temp\Mirar_V57_876933_LOG_IES_NoDMY_AFF_ATD_MDNS_RPT.exe
[DETECTION] Is the Trojan horse TR/Agent.90112.G
[INFO] The file was moved to '486020bb.qua'!
C:\Documents and Settings\yanis\Local Settings\Temp\mit4B.tmp
[0] Archive type: CAB (Microsoft)
--> Mirar_V57_876933_LOG_IES_NoDMY_AFF_ATD_MDNS_RPT.exe
[DETECTION] Is the Trojan horse TR/Agent.90112.G
[INFO] The file was moved to '486220bc.qua'!
C:\Documents and Settings\yanis\Local Settings\Temp\mit4B.tmp.cab
[0] Archive type: CAB (Microsoft)
--> Mirar_V57_876933_LOG_IES_NoDMY_AFF_ATD_MDNS_RPT.exe
[DETECTION] Is the Trojan horse TR/Agent.90112.G
[INFO] The file was moved to '491d2915.qua'!
C:\Documents and Settings\yanis\Local Settings\Temp\nup6B.tmp
[DETECTION] Is the Trojan horse TR/Agent.BRU
[INFO] The file was moved to '485e20c9.qua'!
C:\Documents and Settings\yanis\Local Settings\Temp\tem40.tmp.exe
[DETECTION] Contains detection pattern of the dropper DR/Agent.JB
[INFO] The file was moved to '485b20ba.qua'!
C:\Program Files\Mozilla Firefox\crack.exe
[DETECTION] Is the Trojan horse TR/Dldr.Zlob.jbe
[INFO] The file was moved to '484f25d3.qua'!
C:\Program Files\Navilog1\Backupnavi\nqaypwu.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[INFO] The file was moved to '484f2607.qua'!
C:\Program Files\Sudoku\Sudoku.exe
[WARNING] The file could not be opened!
C:\Program Files\Sudoku\SudokunDll.dll
[WARNING] The file could not be opened!
C:\Program Files\Sudoku\UnInstall_17863.exe
[WARNING] The file could not be opened!
C:\WINDOWS\dwnrpofk.dll
[DETECTION] Is the Trojan horse TR/Zlob.249856
[INFO] The file was moved to '485c26c7.qua'!
C:\WINDOWS\kdftlboeorn.dll
[DETECTION] Is the Trojan horse TR/Zlob.286720
[INFO] The file was moved to '485426b6.qua'!
C:\WINDOWS\norlatmx.exe
[DETECTION] Is the Trojan horse TR/Zlob.98304
[INFO] The file was moved to '486026c3.qua'!
C:\WINDOWS\qvdntlmw.dll
[DETECTION] Is the Trojan horse TR/Zlob.184320
[INFO] The file was moved to '485226cb.qua'!
C:\WINDOWS\system32\version69ie7fix.dll
[DETECTION] Is the Trojan horse TR/Agent.BRU
[INFO] The file was moved to '48602bbe.qua'!
End of the scan: samedi 29 mars 2008 12:46
Used time: 1:11:38 min
The scan has been done completely.
5799 Scanning directories
151284 Files were scanned
14 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
13 files were moved to quarantine
0 files were renamed
4 Files cannot be scanned
151270 Files not concerned
2030 Archives were scanned
4 Warnings
0 Notes
- Voici mon rapport AVG
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------
+ Créé à: 18:19:31 29/03/2008
+ Résultat de l'analyse:
C:\Documents and Settings\yanis\Local Settings\Temp\tem48.tmp.exe -> Adware.Mirar : Nettoyé.
C:\System Volume Information\_restore{27C67FE7-11EF-4EE6-9F14-79BACA089A51}\RP10\A0004643.exe -> Not-A-Virus.Adware.Agent : Nettoyé.
C:\Documents and Settings\yanis\Local Settings\Temp\mit50.tmp/NN_Bar57_876933.dll -> Not-A-Virus.Adware.Mirar : Nettoyé.
C:\WINDOWS\system32\WinNB57.dll -> Not-A-Virus.Adware.Mirar : Nettoyé.
C:\System Volume Information\_restore{27C67FE7-11EF-4EE6-9F14-79BACA089A51}\RP8\A0002467.exe -> Not-A-Virus.PUP.Takedawnload.a : Nettoyé.
C:\Documents and Settings\yanis\Cookies\yanis@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\zizou\Cookies\zizou@2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\zizou\Cookies\zizou@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\yanis\Cookies\yanis@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\zizou\Cookies\zizou@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\zizou\Cookies\zizou@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\zizou\Cookies\zizou@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\zizou\Cookies\zizou@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\zizou\Cookies\zizou@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\yanis\Cookies\yanis@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\yanis\Cookies\yanis@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\zizou\Cookies\zizou@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\zizou\Cookies\zizou@m.webtrends[2].txt -> TrackingCookie.Webtrends : Nettoyé.
Fin du rapport
- Voivi le dernier rapport
Malwarebytes' Anti-Malware 1.09
Version de la base de données: 566
Type de recherche: Examen complet (C:\|)
Eléments examinés: 108073
Temps écoulé: 34 minute(s), 50 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 18
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 7
Fichier(s) infecté(s): 14
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
c:\program files\fbrowsingadvisor\xpcomevents.dll (Trojan.FBrowsingAdvisor) -> Unloaded module successfully.
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Mirar (AdWare.Mirar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fbrowsingadvisor_is1 (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\xInsIDE (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\xInsiDERexe (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\TrafficEngine (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\CAC (Malware.Trace) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
C:\Program Files\WinAntiSpyware 2006 Free (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.
C:\Program Files\Temporary (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\MapEDC (Adware.Maxifiles) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Delete on reboot.
C:\Program Files\FBrowserAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Documents and Settings\yanis\Application Data\WinAntiSpyware 2006 (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.
C:\Documents and Settings\yanis\Application Data\WinAntiSpyware 2006\Logs (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
c:\program files\fbrowsingadvisor\xpcomevents.dll (Trojan.FBrowsingAdvisor) -> Delete on reboot.
C:\Documents and Settings\yanis\Local Settings\Temp\GLK75.tmp (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
C:\Documents and Settings\yanis\Local Settings\Temp\tem49.tmp.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Documents and Settings\yanis\Local Settings\Temp\upd2.tmp.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Documents and Settings\yanis\Local Settings\Temp\upd3.tmp.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\WINDOWS\vbgtorfd.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\WinAntiSpyware 2006 Free\scanlog.xml (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\IXPCOMEvents.xpt (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\Logo.png (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\main.db (Trojan.FBrowsingAdvisor) -> Delete on reboot.
C:\Program Files\FBrowsingAdvisor\unins000.dat (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\unins000.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Documents and Settings\yanis\Application Data\WinAntiSpyware 2006\Logs\update.log (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.
-
-
tu télécharge navilog1
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Fais un clic droit sur navilog1.zip et choisis "tout extraire"
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).
Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)
Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)-
re tiens le rapport
Search Navipromo version 3.5.1 commencé le 29/03/2008 à 21:02:32,23
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "yanis"
Mise à jour le 23.03.2008 à 22h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13
Système de fichiers : NTFS
Executé en mode normal
*** Recherche Programmes installés ***
*** Recherche dossiers dans C:\WINDOWS ***
*** Recherche dossiers dans C:\Program Files ***
*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1 ***
*** Recherche dossiers dans "C:\Documents and Settings\yanis\application data" ***
*** Recherche dossiers dans "C:\Documents and Settings\yanis\local settings\application data" ***
*** Recherche dossiers dans "C:\Documents and Settings\yanis\menu dÚmarrer\programmes" ***
*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1.WIN\MENUDM~1\PROGRA~1 ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Aucun Fichier trouvé
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans C:\WINDOWS\system32 *
* Recherche dans "C:\Documents and Settings\yanis\local settings\application data" *
* Recherche dans "C:\docume~1\Administrateur\local settings\application data" *
gnc.exe absent, Recherche non effectuee dans "C:\docume~1\Administrateur\local settings\application data" !
* Recherche dans "C:\docume~1\Boomscud\local settings\application data" *
gnc.exe absent, Recherche non effectuee dans "C:\docume~1\Boomscud\local settings\application data" !
* Recherche dans "C:\docume~1\zizou\local settings\application data" *
gnc.exe absent, Recherche non effectuee dans "C:\docume~1\zizou\local settings\application data" !
*** Recherche fichiers ***
*** Recherche clés spécifiques dans le Registre ***
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans C:\WINDOWS\system32 :
* Dans "C:\Documents and Settings\yanis\local settings\application data" :
* Dans "C:\docume~1\Administrateur\local settings\application data" :
* Dans "C:\docume~1\Boomscud\local settings\application data" :
* Dans "C:\docume~1\zizou\local settings\application data" :
3)Recherche Certificats :
Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche fichiers connus :
C:\WINDOWS\system32\qtstv.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\qtstv.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\qtstv.bak2 trouvé ! infection Vundo possible non traitée par cet outil !
*** Analyse terminée le 29/03/2008 à 21:05:49,53 ***
-
-
Télécharge VundoFix (par Atribune) de ce lien :
http://www.atribune.org/ccount/click.php?id=4
* Sauvegarde-le sur ton Bureau.
* Double-clique VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est complété, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.
Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer.
Si tel est le cas, l'outil se lancera au prochain redémarrage;
il faut simplement suivre les instructions ci-haut,
à partir de "clique sur le bouton Scan for Vundo" -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)et aussi msn
Télécharge Combofix sUBs :
---> http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
Tuto : https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic
Copie/colle un nouveau rapport HiJackThis avec.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt-
-
tiens le rapport ComboFix
ComboFix 08-03-29.1 - yanis 2008-03-29 23:09:23.1 - NTFSx86
Endroit: C:\Documents and Settings\yanis\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\uusee
C:\Program Files\uusee\Uninstal.exe
C:\Program Files\uusee\UUTV_MY.xml
C:\Program Files\uusee\UUUpgrade.exe
C:\Program Files\uusee\UUUpgrade.ocx
C:\Program Files\WindowsUpdate\profsybywuus.html
C:\WINDOWS\BM9f9dde38.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\cvosofup.ini
C:\WINDOWS\system32\ddxvoavj.ini
C:\WINDOWS\system32\dlnetuoq.ini
C:\WINDOWS\system32\fumuqmhq.ini
C:\WINDOWS\system32\hpkpvgso.ini
C:\WINDOWS\system32\lwgdypiv.ini
C:\WINDOWS\system32\qtstv.bak1
C:\WINDOWS\system32\qtstv.bak2
C:\WINDOWS\system32\qtstv.ini
C:\WINDOWS\system32\qtstv.ini2
C:\WINDOWS\system32\sgrlmuaq.ini
C:\WINDOWS\system32\xsjjtyvw.ini
C:\WINDOWS\system32\xsmgdrpf.ini
C:\WINDOWS\system32\ydgmcwyf.ini
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_CORE
-------\Legacy_TNIDRIVER
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-28 to 2008-03-29 ))))))))))))))))))))))))))))))))))))
.
2008-03-29 19:14 . 2008-03-29 19:14 <REP> d-------- C:\Documents and Settings\yanis\Application Data\Malwarebytes
2008-03-29 19:14 . 2008-03-29 19:14 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-03-29 11:19 . 2008-03-29 11:19 <REP> d-------- C:\Program Files\Avira
2008-03-28 22:48 . 2008-03-28 23:20 <REP> d-------- C:\Program Files\Steam
2008-03-28 18:17 . 2008-03-28 18:17 <REP> d-------- C:\Valve
2008-03-27 18:23 . 2008-03-28 16:50 <REP> d-------- C:\Program Files\NavigationAdvisor
2008-03-26 17:55 . 2008-03-26 17:55 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Azureus
2008-03-26 17:54 . 2008-03-26 18:30 <REP> d-------- C:\Documents and Settings\yanis\Application Data\Azureus
2008-03-25 20:26 . 2008-03-25 22:32 <REP> d-------- C:\Program Files\DivX
2008-03-25 17:52 . 2008-03-29 11:19 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Avira
2008-03-23 20:08 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-23 20:05 . 2008-03-23 20:05 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-03-22 17:08 . 2008-03-22 17:08 <REP> d-------- C:\Program Files\Sunbelt Software
2008-03-21 18:17 . 2008-03-21 18:20 <REP> d-------- C:\Program Files\RegCleaner
2008-03-21 18:09 . 2008-03-21 18:10 <REP> d-------- C:\BackUpMSNCleaner
2008-03-20 17:45 . 2008-03-20 17:45 <REP> d-------- C:\Program Files\IZS.SMS
2008-03-20 17:36 . 2008-03-20 17:36 <REP> d-------- C:\Program Files\SMS
2008-03-20 17:36 . 2008-03-20 17:36 <REP> d-------- C:\HSF
2008-03-20 17:36 . 2008-03-20 17:36 26 --a------ C:\WINDOWS\WD.INI
2008-03-09 16:16 . 2008-03-09 16:16 115,920 --a------ C:\WINDOWS\system32\msinet.ocx
2008-03-08 18:08 . 2008-03-08 18:08 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-07 19:25 . 2008-03-09 19:03 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
2008-03-07 19:25 . 2008-03-07 19:25 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Logitech
2008-03-07 19:24 . 2008-03-09 18:59 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\LogiShrd
2008-03-07 13:19 . 2008-03-07 13:19 <REP> d-------- C:\Program Files\Philips_VLounge
2008-03-07 13:19 . 2008-03-07 13:19 <REP> d-------- C:\Program Files\Fichiers communs\ArcSoft
2008-03-07 13:18 . 2008-03-07 13:18 <REP> d-------- C:\Program Files\Philips
2008-03-07 13:18 . 2007-05-31 15:54 675,840 --a------ C:\WINDOWS\vspc1300.exe
2008-03-06 20:58 . 2008-03-06 20:58 <REP> d-------- C:\Documents and Settings\yanis\Application Data\ArcSoft
2008-03-06 20:52 . 1995-08-01 04:44 212,480 --a------ C:\WINDOWS\PCDLIB32.DLL
2008-03-06 00:29 . 2008-03-25 22:10 <REP> d-------- C:\Program Files\CCleaner
2008-03-05 20:57 . 2008-03-05 21:00 <REP> d-------- C:\Program Files\AVPersonal
2008-03-05 17:49 . 2008-03-06 14:56 <REP> d-------- C:\SDFix
2008-03-05 14:41 . 2008-03-06 13:24 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2008-03-05 13:31 . 2008-03-05 13:40 <REP> d-------- C:\Program Files\Windows Live
2008-03-05 12:44 . 2008-03-07 19:10 <REP> d-------- C:\VundoFix Backups
2008-03-05 12:11 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-03-05 12:11 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-03-05 12:11 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-03-04 22:49 . 2008-03-05 12:47 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Htm Support Bait Deaf
2008-03-04 21:28 . 2008-03-04 21:41 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-03-04 21:26 . 2008-03-21 18:41 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-03-04 12:09 . 2008-03-08 21:19 <REP> d-------- C:\WINDOWS\MaxTV
2008-03-04 12:09 . 2008-03-04 12:09 <REP> d-------- C:\Program Files\DMV
2008-03-04 11:07 . 2008-03-05 19:07 <REP> d-------- C:\Program Files\Popup Manager
2008-03-04 10:05 . 2008-03-04 10:05 <REP> d-------- C:\Program Files\AxBx
2008-03-03 20:09 . 2008-03-03 20:09 <REP> d-------- C:\WINDOWS\system32\PC Booster 5
2008-03-03 18:03 . 2008-03-03 18:03 <REP> d-------- C:\Documents and Settings\yanis\Application Data\TuneUp Software
2008-03-03 14:10 . 2008-03-04 20:16 <REP> d-------- C:\Program Files\Mozilla Firefox 3 Beta 2
2008-03-03 12:47 . 2008-03-03 12:50 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
2008-03-03 12:45 . 2008-03-03 12:45 <REP> d-------- C:\Program Files\Trend Micro
2008-03-03 12:34 . 2008-03-03 12:34 <REP> d-------- C:\Program Files\Lavasoft
2008-03-03 12:34 . 2008-03-06 23:29 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-03-03 12:16 . 2008-03-03 12:26 <REP> d-------- C:\Documents and Settings\yanis\Application Data\GlarySoft
2008-02-29 22:01 . 2008-02-29 22:01 <REP> d-------- C:\Documents and Settings\yanis\Application Data\InstallShield
2008-02-29 22:01 . 2006-03-09 11:33 366,080 --a------ C:\WINDOWS\system32\drivers\rt61.sys
2008-02-29 22:01 . 2006-03-09 11:33 365,440 --a------ C:\WINDOWS\system32\drivers\RT619x.sys
2008-02-29 22:01 . 2006-01-12 19:47 255,616 --a------ C:\WINDOWS\system32\drivers\rt73u98.sys
2008-02-29 22:01 . 2006-01-12 19:46 252,928 --a------ C:\WINDOWS\system32\drivers\rt73.sys
2008-02-29 22:01 . 2005-10-17 19:50 247,808 --a------ C:\WINDOWS\system32\drivers\rt25u98.sys
2008-02-29 22:01 . 2005-10-17 19:50 245,376 --a------ C:\WINDOWS\system32\drivers\rt2500usb.sys
2008-02-29 22:01 . 2005-10-20 15:00 244,608 --a------ C:\WINDOWS\system32\drivers\rt25009x.sys
2008-02-29 22:01 . 2005-10-20 15:00 243,328 --a------ C:\WINDOWS\system32\drivers\rt2500.sys
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-29 20:08 --------- d-----w C:\Program Files\Navilog1
2008-03-29 19:14 --------- d-----w C:\Documents and Settings\yanis\Application Data\LimeWire
2008-03-29 19:05 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-29 12:23 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-03-27 16:06 --------- d-----w C:\Program Files\Azureus
2008-03-26 13:21 --------- d-----w C:\Program Files\eMule
2008-03-25 14:10 --------- d-----w C:\Program Files\LimeWire
2008-03-23 19:08 --------- d-----w C:\Program Files\Java
2008-03-22 16:33 --------- d-----w C:\Program Files\Alwil Software
2008-03-07 18:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-06 12:24 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7
2008-03-06 12:17 --------- d-----w C:\Documents and Settings\yanis\Application Data\AVG7
2008-03-06 11:53 --------- d-----w C:\Program Files\Kaspersky Lab
2008-03-05 19:22 --------- d-----w C:\Program Files\Yahoo!
2008-03-04 17:50 --------- d-----w C:\Program Files\MSN Messenger
2008-03-04 11:24 --------- d-----w C:\Program Files\adslTV
2008-03-04 11:24 --------- d-----w C:\Documents and Settings\yanis\Application Data\vlc
2008-03-03 18:00 --------- d-----w C:\Program Files\eoRezo
2008-03-03 18:00 --------- d-----w C:\Documents and Settings\yanis\Application Data\EoRezo
2008-03-03 11:50 --------- d-----w C:\Program Files\Hijackthis Version Française
2008-03-03 11:23 --------- d-----w C:\Program Files\ICQ6
2008-03-03 11:23 --------- d-----w C:\Documents and Settings\yanis\Application Data\Skype
2008-02-29 21:02 20,747 -c--a-w C:\WINDOWS\system32\drivers\AegisP.sys
2008-02-23 15:00 --------- d-----w C:\Program Files\Fichiers communs\Ciel
2008-02-23 15:00 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Ciel
2008-02-23 14:59 --------- d-----w C:\Program Files\Fichiers communs\Sage
2008-02-23 14:59 --------- d-----w C:\Program Files\Ciel
2008-02-06 17:43 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-02-06 17:38 --------- d-----w C:\Program Files\Fichiers communs\Adobe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D3E9C78-8CE2-4222-AFA7-E9D8974D0B4C}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0E229538-9841-4BE7-069A-5DBB0A201667}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{110D6444-9CC7-47B6-AAE5-A9AA52823346}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{179A54AE-9F7D-48C5-AF77-641FAA2F5CCD}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{29E5DB24-B5C2-471B-A3A3-8E248A720B20}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3533728E-1A85-42F3-8F29-57CFA72F66AF}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{37C47C14-CD8E-4752-AE58-BAB481ECEEC5}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{47E14067-1267-49A3-BC18-8C937B02825F}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F5A1E7F-5388-44DC-93BB-66A155CE5E1F}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{510247af-ff8b-44ed-921b-84108885a4d0}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{61210148-0170-4A26-A2A1-E71B66FC9F3C}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{65876774-B17A-4A90-966F-1CCB3C4F2BD6}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{67602201-1254-40F6-9565-208BFDF794FB}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69af0e78-a36a-4083-a11f-2bef7e39b3d9}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6EC4E01B-DBDD-4FED-AC84-C0F4FA06E329}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7B89E8C0-04E0-4EF8-BD8B-8D306305E65E}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86034AC2-9E33-4B0A-1285-E55448EA80B4}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D1B6220-7A6B-4706-8410-A15CDE7B3B18}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9BC5681C-0BA7-421E-97BB-E5602E2203CA}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A083FD98-285A-4FC2-81A1-52CEFB8C44FF}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A1DBB56C-2CF2-49F2-9440-AAFDF0027944}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B1B20837-6EBB-4B3C-B893-0F436FE5FD2A}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B35DFFFF-53CF-4B07-981F-278710B5C6FA}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B813124D-B958-4354-8DEA-DBF5A6C2B752}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC8EE999-540D-4DEE-B2F9-A5092CC1881D}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C085F10A-8F8A-430D-2EB3-A40AF26FFE89}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CEA1D74E-7384-4A41-90A9-48C7B0E1527B}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D1DD36C6-511E-4CEC-BC90-69CC8DBC5A29}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D3F9CE4E-2354-4973-AACA-383E87632F99}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DD6922E7-87E6-4128-8AFD-7DBA107B072D}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E3D46394-0854-4511-9D76-98D3E385D47B}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E60A8FF7-B9B4-8ABC-10E8-10F2461DFA50}]
2007-12-30 21:48 1019904 --a------ C:\Program Files\NavigationAdvisor\NavigationAdvisor-2.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E758A8FB-FD4C-4380-A1B4-6DF73E39271F}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0DF92C7-738A-4302-9F16-DE8A2B60F855}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f1fe1f4a-6fec-4c31-b261-cff85b56a4dd}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4102828-150B-47D3-A126-D30D768D37CF}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f85cdad1-73b5-4b72-ba38-450ebf64d3cb}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:54 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-11-06 15:03 5724184]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-02-20 15:15 816368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-29 11:28 249896]
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\[u]0[/u]]
Source= C:\Program Files\WindowsUpdate\profsybywuus.html
FriendlyName=
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtstq]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyyayx]
xxyyayx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SPC1300"=C:\WINDOWS\vspc1300.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-02-28 23:28]
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 18:08]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 18:11]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 18:11]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 18:13]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 18:15]
S3 PALLADIA;Palladia 300/400 Usb Adsl Modem;C:\WINDOWS\system32\DRIVERS\usbiad.sys [2004-07-14 18:52]
S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2004-11-10 03:35]
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-03-29 22:14:03 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
"2008-03-26 15:00:00 C:\WINDOWS\Tasks\{119A0236-033D-406D-A78A-77B0E00D1677}_TITANIUM_Administrateur.job"
- C:\WINDOWS\system32\mobsync.exeL /Schedule=
"2008-03-21 08:00:00 C:\WINDOWS\Tasks\{332DC88C-09FE-4970-A5B7-7E38726A4DCA}_TITANIUM_Administrateur.job"
- C:\WINDOWS\system32\mobsync.exeL /Schedule=
"2008-03-21 15:00:00 C:\WINDOWS\Tasks\{4C4DF697-218E-4AE0-BEB3-C74E5C35681D}_TITANIUM_Administrateur.job"
- C:\WINDOWS\system32\mobsync.exeL /Schedule=
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-29 23:14:49
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\iPod\Bin\iPodSrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Hercules\WiFi Station\WifiStation.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-29 23:18:39 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-29 22:18:34
Pre-Run: 19,243,085,824 octets libres
Post-Run: 19,185,278,976 octets libres
.
2008-03-12 21:32:44 --- E O F ---
-
-
relance hijackthis
selectionne do a system scan only
et coches les lignes suivantes:
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Popup Manager - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - (no file)
O2 - BHO: (no name) - {0D3E9C78-8CE2-4222-AFA7-E9D8974D0B4C} - (no file)
O2 - BHO: (no name) - {0E229538-9841-4BE7-069A-5DBB0A201667} - (no file)
O2 - BHO: (no name) - {110D6444-9CC7-47B6-AAE5-A9AA52823346} - (no file)
O2 - BHO: (no name) - {179A54AE-9F7D-48C5-AF77-641FAA2F5CCD} - (no file)
O2 - BHO: (no name) - {29E5DB24-B5C2-471B-A3A3-8E248A720B20} - (no file)
O2 - BHO: (no name) - {3533728E-1A85-42F3-8F29-57CFA72F66AF} - (no file)
O2 - BHO: (no name) - {37C47C14-CD8E-4752-AE58-BAB481ECEEC5} - (no file)
O2 - BHO: (no name) - {47E14067-1267-49A3-BC18-8C937B02825F} - (no file)
O2 - BHO: (no name) - {4F5A1E7F-5388-44DC-93BB-66A155CE5E1F} - (no file)
O2 - BHO: (no name) - {510247af-ff8b-44ed-921b-84108885a4d0} - (no file)
O2 - BHO: (no name) - {61210148-0170-4A26-A2A1-E71B66FC9F3C} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: (no name) - {65876774-B17A-4A90-966F-1CCB3C4F2BD6} - (no file)
O2 - BHO: (no name) - {67602201-1254-40F6-9565-208BFDF794FB} - (no file)
O2 - BHO: (no name) - {69af0e78-a36a-4083-a11f-2bef7e39b3d9} - (no file)
O2 - BHO: (no name) - {6EC4E01B-DBDD-4FED-AC84-C0F4FA06E329} - (no file)
O2 - BHO: (no name) - {7B89E8C0-04E0-4EF8-BD8B-8D306305E65E} - (no file)
O2 - BHO: (no name) - {86034AC2-9E33-4B0A-1285-E55448EA80B4} - (no file)
O2 - BHO: (no name) - {8D1B6220-7A6B-4706-8410-A15CDE7B3B18} - (no file)
O2 - BHO: (no name) - {9BC5681C-0BA7-421E-97BB-E5602E2203CA} - (no file)
O2 - BHO: (no name) - {A083FD98-285A-4FC2-81A1-52CEFB8C44FF} - (no file)
O2 - BHO: (no name) - {A1DBB56C-2CF2-49F2-9440-AAFDF0027944} - (no file)
O2 - BHO: (no name) - {B1B20837-6EBB-4B3C-B893-0F436FE5FD2A} - (no file)
O2 - BHO: (no name) - {B35DFFFF-53CF-4B07-981F-278710B5C6FA} - (no file)
O2 - BHO: (no name) - {B813124D-B958-4354-8DEA-DBF5A6C2B752} - (no file)
O2 - BHO: (no name) - {BC8EE999-540D-4DEE-B2F9-A5092CC1881D} - (no file)
O2 - BHO: (no name) - {C085F10A-8F8A-430D-2EB3-A40AF26FFE89} - (no file)
O2 - BHO: (no name) - {CEA1D74E-7384-4A41-90A9-48C7B0E1527B} - (no file)
O2 - BHO: (no name) - {D1DD36C6-511E-4CEC-BC90-69CC8DBC5A29} - (no file)
O2 - BHO: (no name) - {D3F9CE4E-2354-4973-AACA-383E87632F99} - (no file)
O2 - BHO: (no name) - {DD6922E7-87E6-4128-8AFD-7DBA107B072D} - (no file)
O2 - BHO: (no name) - {E3D46394-0854-4511-9D76-98D3E385D47B} - (no file)
O2 - BHO: NavigationAdvisor - {E60A8FF7-B9B4-8ABC-10E8-10F2461DFA50} - C:\Program Files\NavigationAdvisor\NavigationAdvisor-2.dll
O2 - BHO: (no name) - {E758A8FB-FD4C-4380-A1B4-6DF73E39271F} - (no file)
O2 - BHO: (no name) - {F0DF92C7-738A-4302-9F16-DE8A2B60F855} - (no file)
O2 - BHO: (no name) - {f1fe1f4a-6fec-4c31-b261-cff85b56a4dd} - (no file)
O2 - BHO: (no name) - {F4102828-150B-47D3-A126-D30D768D37CF} - (no file)
O2 - BHO: (no name) - {f85cdad1-73b5-4b72-ba38-450ebf64d3cb} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O20 - Winlogon Notify: vtstq - C:\WINDOWS\
O20 - Winlogon Notify: xxyyayx - xxyyayx.dll (file missing)
O22 - SharedTaskScheduler: {874443fe-aa33-4ebf-a6ac-73208787e62d} - bestreak - (no file)
O24 - Desktop Component 0: (no name) - C:\Program Files\WindowsUpdate\profsybywuus.html
O24 - Desktop Component 1: (no name) - http://www.psg.fr/images/photo_content/cp_44c296aaa36b934AC1534papier.jpg
puis clic sur le bouton "Fix Checked"
puis tu me repost un rapport hijackthis.
Utilises tu des jeux de boonty games depuis longtemps ?
Voici une petite information sur Boonty games
Leur politique :
"Il se peut que nous partageons aussi des informations payantes avec des tiers
qui fournissent ds services payants et partage des données regroupées montrant le type
et le nombre de jeux videos que vous téléchargez, votre age, votre sexe, vos occupations,
niveau d'éducation, localité géographique, données sur l'équipement de votre ordinateur,
internet et intérêts pour les jeux videos, activités et entrainement des jeux édités.
De plus, nous partageons les adresses email avec des tiers fournisseurs de compte mails
qui nous assistent en envoyant nos mails a de nombreux clients en même temps..."
pour le suprimer
tu fais
-> Démarrer
-> Exécuter...
Tape Services.msc puis valide
Double clique sur " Boonty Games "
Clique en bas sur " Arrêter "
Valide les changements.
-----
Ouvre Hijackthis puis:
-> Open the Misc Tools Section
-> Delete a NT Service
Tape " BOONTY " puis valide.
bonne nuit-
tiens le nouveau rapport de HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:48, on 29/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\yanis\Bureau\HiJackThis.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
-
-
J'ai essayé de faire ce que tu m'a dit dans Executer puis Services.msc puis clique sur Boonty Games je ne peux pas cocher la case Arreter et en + il est désactivé et sinon pour Hijackthis quand je fais ce que tu m'a dit ca me fait ca " Service 'BOONTY' was not found in the registry. Make sure you entered the name of the service correctly."
-
-
ok tu as bien bossé
reposte un nouveau rapport hijackthis stp-
Voici le rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:24:41, on 29/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\iPod\Bin\iPodSrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hercules\WiFi Station\WifiStation.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\yanis\Bureau\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Popup Manager - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - (no file)
O2 - BHO: (no name) - {0D3E9C78-8CE2-4222-AFA7-E9D8974D0B4C} - (no file)
O2 - BHO: (no name) - {0E229538-9841-4BE7-069A-5DBB0A201667} - (no file)
O2 - BHO: (no name) - {110D6444-9CC7-47B6-AAE5-A9AA52823346} - (no file)
O2 - BHO: (no name) - {179A54AE-9F7D-48C5-AF77-641FAA2F5CCD} - (no file)
O2 - BHO: (no name) - {29E5DB24-B5C2-471B-A3A3-8E248A720B20} - (no file)
O2 - BHO: (no name) - {3533728E-1A85-42F3-8F29-57CFA72F66AF} - (no file)
O2 - BHO: (no name) - {37C47C14-CD8E-4752-AE58-BAB481ECEEC5} - (no file)
O2 - BHO: (no name) - {47E14067-1267-49A3-BC18-8C937B02825F} - (no file)
O2 - BHO: (no name) - {4F5A1E7F-5388-44DC-93BB-66A155CE5E1F} - (no file)
O2 - BHO: (no name) - {510247af-ff8b-44ed-921b-84108885a4d0} - (no file)
O2 - BHO: (no name) - {61210148-0170-4A26-A2A1-E71B66FC9F3C} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: (no name) - {65876774-B17A-4A90-966F-1CCB3C4F2BD6} - (no file)
O2 - BHO: (no name) - {67602201-1254-40F6-9565-208BFDF794FB} - (no file)
O2 - BHO: (no name) - {69af0e78-a36a-4083-a11f-2bef7e39b3d9} - (no file)
O2 - BHO: (no name) - {6EC4E01B-DBDD-4FED-AC84-C0F4FA06E329} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7B89E8C0-04E0-4EF8-BD8B-8D306305E65E} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {86034AC2-9E33-4B0A-1285-E55448EA80B4} - (no file)
O2 - BHO: (no name) - {8D1B6220-7A6B-4706-8410-A15CDE7B3B18} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9BC5681C-0BA7-421E-97BB-E5602E2203CA} - (no file)
O2 - BHO: (no name) - {A083FD98-285A-4FC2-81A1-52CEFB8C44FF} - (no file)
O2 - BHO: (no name) - {A1DBB56C-2CF2-49F2-9440-AAFDF0027944} - (no file)
O2 - BHO: (no name) - {B1B20837-6EBB-4B3C-B893-0F436FE5FD2A} - (no file)
O2 - BHO: (no name) - {B35DFFFF-53CF-4B07-981F-278710B5C6FA} - (no file)
O2 - BHO: (no name) - {B813124D-B958-4354-8DEA-DBF5A6C2B752} - (no file)
O2 - BHO: (no name) - {BC8EE999-540D-4DEE-B2F9-A5092CC1881D} - (no file)
O2 - BHO: (no name) - {C085F10A-8F8A-430D-2EB3-A40AF26FFE89} - (no file)
O2 - BHO: (no name) - {CEA1D74E-7384-4A41-90A9-48C7B0E1527B} - (no file)
O2 - BHO: (no name) - {D1DD36C6-511E-4CEC-BC90-69CC8DBC5A29} - (no file)
O2 - BHO: (no name) - {D3F9CE4E-2354-4973-AACA-383E87632F99} - (no file)
O2 - BHO: (no name) - {DD6922E7-87E6-4128-8AFD-7DBA107B072D} - (no file)
O2 - BHO: (no name) - {E3D46394-0854-4511-9D76-98D3E385D47B} - (no file)
O2 - BHO: NavigationAdvisor - {E60A8FF7-B9B4-8ABC-10E8-10F2461DFA50} - C:\Program Files\NavigationAdvisor\NavigationAdvisor-2.dll
O2 - BHO: (no name) - {E758A8FB-FD4C-4380-A1B4-6DF73E39271F} - (no file)
O2 - BHO: (no name) - {F0DF92C7-738A-4302-9F16-DE8A2B60F855} - (no file)
O2 - BHO: (no name) - {f1fe1f4a-6fec-4c31-b261-cff85b56a4dd} - (no file)
O2 - BHO: (no name) - {F4102828-150B-47D3-A126-D30D768D37CF} - (no file)
O2 - BHO: (no name) - {f85cdad1-73b5-4b72-ba38-450ebf64d3cb} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - Startup: La Solution Ciel.lnk = C:\CIEL\STARTER.EXE
O4 - Global Startup: WiFi Station.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O20 - Winlogon Notify: vtstq - C:\WINDOWS\
O20 - Winlogon Notify: xxyyayx - xxyyayx.dll (file missing)
O22 - SharedTaskScheduler: {874443fe-aa33-4ebf-a6ac-73208787e62d} - bestreak - (no file)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodSrv - Unknown owner - C:\Program Files\iPod\Bin\iPodSrv.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\WindowsUpdate\profsybywuus.html
O24 - Desktop Component 1: (no name) - http://www.psg.fr/images/photo_content/cp_44c296aaa36b934AC1534papier.jpg
-
-
-
tiens voivi le rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:24, on 29/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\iPod\Bin\iPodSrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Hercules\WiFi Station\WifiStation.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\yanis\Bureau\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Popup Manager - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - (no file)
O2 - BHO: (no name) - {0D3E9C78-8CE2-4222-AFA7-E9D8974D0B4C} - (no file)
O2 - BHO: (no name) - {0E229538-9841-4BE7-069A-5DBB0A201667} - (no file)
O2 - BHO: (no name) - {110D6444-9CC7-47B6-AAE5-A9AA52823346} - (no file)
O2 - BHO: (no name) - {179A54AE-9F7D-48C5-AF77-641FAA2F5CCD} - (no file)
O2 - BHO: (no name) - {29E5DB24-B5C2-471B-A3A3-8E248A720B20} - (no file)
O2 - BHO: (no name) - {3533728E-1A85-42F3-8F29-57CFA72F66AF} - (no file)
O2 - BHO: (no name) - {37C47C14-CD8E-4752-AE58-BAB481ECEEC5} - (no file)
O2 - BHO: (no name) - {47E14067-1267-49A3-BC18-8C937B02825F} - (no file)
O2 - BHO: (no name) - {4F5A1E7F-5388-44DC-93BB-66A155CE5E1F} - (no file)
O2 - BHO: (no name) - {510247af-ff8b-44ed-921b-84108885a4d0} - (no file)
O2 - BHO: (no name) - {61210148-0170-4A26-A2A1-E71B66FC9F3C} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: (no name) - {65876774-B17A-4A90-966F-1CCB3C4F2BD6} - (no file)
O2 - BHO: (no name) - {67602201-1254-40F6-9565-208BFDF794FB} - (no file)
O2 - BHO: (no name) - {69af0e78-a36a-4083-a11f-2bef7e39b3d9} - (no file)
O2 - BHO: (no name) - {6EC4E01B-DBDD-4FED-AC84-C0F4FA06E329} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7B89E8C0-04E0-4EF8-BD8B-8D306305E65E} - (no file)
O2 - BHO: (no name) - {86034AC2-9E33-4B0A-1285-E55448EA80B4} - (no file)
O2 - BHO: (no name) - {8D1B6220-7A6B-4706-8410-A15CDE7B3B18} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9BC5681C-0BA7-421E-97BB-E5602E2203CA} - (no file)
O2 - BHO: (no name) - {A083FD98-285A-4FC2-81A1-52CEFB8C44FF} - (no file)
O2 - BHO: (no name) - {A1DBB56C-2CF2-49F2-9440-AAFDF0027944} - (no file)
O2 - BHO: (no name) - {B1B20837-6EBB-4B3C-B893-0F436FE5FD2A} - (no file)
O2 - BHO: (no name) - {B35DFFFF-53CF-4B07-981F-278710B5C6FA} - (no file)
O2 - BHO: (no name) - {B813124D-B958-4354-8DEA-DBF5A6C2B752} - (no file)
O2 - BHO: (no name) - {BC8EE999-540D-4DEE-B2F9-A5092CC1881D} - (no file)
O2 - BHO: (no name) - {C085F10A-8F8A-430D-2EB3-A40AF26FFE89} - (no file)
O2 - BHO: (no name) - {CEA1D74E-7384-4A41-90A9-48C7B0E1527B} - (no file)
O2 - BHO: (no name) - {D1DD36C6-511E-4CEC-BC90-69CC8DBC5A29} - (no file)
O2 - BHO: (no name) - {D3F9CE4E-2354-4973-AACA-383E87632F99} - (no file)
O2 - BHO: (no name) - {DD6922E7-87E6-4128-8AFD-7DBA107B072D} - (no file)
O2 - BHO: (no name) - {E3D46394-0854-4511-9D76-98D3E385D47B} - (no file)
O2 - BHO: NavigationAdvisor - {E60A8FF7-B9B4-8ABC-10E8-10F2461DFA50} - C:\Program Files\NavigationAdvisor\NavigationAdvisor-2.dll
O2 - BHO: (no name) - {E758A8FB-FD4C-4380-A1B4-6DF73E39271F} - (no file)
O2 - BHO: (no name) - {F0DF92C7-738A-4302-9F16-DE8A2B60F855} - (no file)
O2 - BHO: (no name) - {f1fe1f4a-6fec-4c31-b261-cff85b56a4dd} - (no file)
O2 - BHO: (no name) - {F4102828-150B-47D3-A126-D30D768D37CF} - (no file)
O2 - BHO: (no name) - {f85cdad1-73b5-4b72-ba38-450ebf64d3cb} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - Startup: La Solution Ciel.lnk = C:\CIEL\STARTER.EXE
O4 - Global Startup: WiFi Station.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O20 - Winlogon Notify: vtstq - C:\WINDOWS\
O20 - Winlogon Notify: xxyyayx - xxyyayx.dll (file missing)
O22 - SharedTaskScheduler: {874443fe-aa33-4ebf-a6ac-73208787e62d} - bestreak - (no file)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodSrv - Unknown owner - C:\Program Files\iPod\Bin\iPodSrv.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\WindowsUpdate\profsybywuus.html
O24 - Desktop Component 1: (no name) - http://www.psg.fr/images/photo_content/cp_44c296aaa36b934AC1534papier.jpg
-
