ads served bye dcads

Question

Bonjour,
je suis toujours   au prises avec ads served by dcads , j'ai fait ce que disais olivier à quelqu'un  d'aller enlever browser optimiser et ça revient quand même et je ne trouve pas superioads pouvez-vous m'aider svp merci

geoffrey5 · Answer

rapport hijackthis stp

geoffrey5 · Answer

Télécharge sur le bureau hijackthis : http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

-une fois installé sur le bureau, le renommer scan.exe
-Double-clic dessus 
- Clic sur "Do a system scan and save the log" 
- copier le rapport, le coller dans la réponse

geoffrey5 · Answer

Télécharger sur le bureau malware bytes : https://www.besttechie.com/resources/malwarebytes/
 

= double-clic sur mbam-setup pour lancer l'installation 
= Installer simplement sans rien modifier 
= Quand le programme lancé ==> cocher Exécuter un examen complet 
= Clic Rechercher 
= Eventuellement décocher les disque à ne pas analyser 
= Clic Lancer l'examen 
= En fin de scan , si infection trouvée 
==> Clic Afficher résultat 
= Fermer vos applications en cours 
= Vérifier si tout est coché et clic Supprimer la sélection 

un rapport s'ouvre le copier et le coller dans la réponse 

Puis redémarrer le pc !!

Et refais un rapport hijackthis

linda · Answer

je n'ai pas eu de suivi au sujet de mon problème de ads servedby dcads j'ai tout copier coller de la conversation si quelqu'un est disponible je vous en serai très reconnaissante 

un gros merci à l'avance 



copier coller de conversation 
Bonjour, 
je suis toujours au prises avec ads served by dcads , j'ai fait ce que disais olivier à quelqu'un d'aller enlever browser optimiser et ça revient quand même et je ne trouve pas superioads pouvez-vous m'aider svp merciConfiguration: Windows XP
Internet Explorer 7.0
Répondre à linda  Signaler ce message aux modérateurs Aller au dernier message1

Ce message vous semble utile, votez !Signaler ce message aux modérateurs Par geoffrey5, le mercredi 4 juin 2008 à 16:11:35    
rapport hijackthis stp
   Répondre à geoffrey52

Ce message vous semble utile, votez !Signaler ce message aux modérateurs Par linda, le mercredi 4 juin 2008 à 16:21:28    
salut je fais comment ???? merci
   Répondre à linda 
 
3

Ce message vous semble utile, votez !Signaler ce message aux modérateurs Par geoffrey5, le mercredi 4 juin 2008 à 16:25:30    
Télécharge sur le bureau hijackthis : http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe 

-une fois installé sur le bureau, le renommer scan.exe 
-Double-clic dessus 
- Clic sur "Do a system scan and save the log" 
- copier le rapport, le coller dans la réponse
   Répondre à geoffrey54

Ce message vous semble utile, votez !Signaler ce message aux modérateurs Par linda, le mercredi 4 juin 2008 à 16:31:38    
voilà merci 

Logfile of Trend Micro HijackThis v2.0.2 
Scan saved at 10:30:32, on 2008-06-04 
Platform: Windows XP SP3 (WinNT 5.01.2600) 
MSIE: Internet Explorer v7.00 (7.00.6000.16640) 
Boot mode: Normal 

Running processes: 
C:\WINDOWS\System32\smss.exe 
C:\WINDOWS\system32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\system32\Ati2evxx.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\WINDOWS\system32\Ati2evxx.exe 
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
C:\WINDOWS\system32\spoolsv.exe 
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe 
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe 
C:\WINDOWS\system32\cisvc.exe 
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe 
C:\WINDOWS\system32	cpsvcs.exe 
C:\Program Files\PDF Complete\pdfsvc.exe 
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 
C:\WINDOWS\system32\cidaemon.exe 
C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe 
C:\Program Files\PDF Complete\pdfsty.exe 
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe 
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 
C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
C:\WINDOWS\system32\ctfmon.exe 
C:\WINDOWS\System32\svchost.exe 
C:\Anzio\anzio32r.exe 
C:\WINDOWS\explorer.exe 
C:\Program Files\Windows Live\Messenger\usnsvc.exe 
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe 
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 
C:\Program Files\internet explorer\iexplore.exe 
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\Q4RD1HT4\HiJackThis[1].exe 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.canoe.qc.ca 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens 
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 
O2 - BHO: (no name) - {1D8282E6-BC4F-469B-AAED-7E4FF077AD93} - (no file) 
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll 
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll 
O2 - BHO: dcads - {733716E1-76D2-4003-AC39-845281C0EF85} - C:\WINDOWS\system32
stD.dll 
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll 
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll 
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll 
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll 
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll 
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll 
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe 
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe" 
O4 - HKLM\..\Run: [SDMSSplash] "C:\Program Files\HP_SDMS\SDMSSplash\launcher.exe" "launchdir=C:\Program Files\HP_SDMS\SDMSSplash" 
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe 
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe 
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe 
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" 
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" 
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot 
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background 
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO 
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe 
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user') 
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm 
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites 
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll 
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll 
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL 
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll 
O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} - http://h20278.www2.hp.com/HPDesktopSecurity/portal/cabs/HPISDataManager.CAB 
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPDesktopSecurity/portal/cabs/HPISDataManager.CAB 
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab 
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
O17 - HKLM\System\CCS\Services\Tcpip\..\{E088E321-96D6-492A-B2EB-F58B4D0D14A8}: NameServer = 192.2.0.254 
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe 
O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe 
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe 
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe 
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE 
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe 
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe 
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe 
End of file - 9612 bytes
   Répondre à linda 
 
5

Ce message vous semble utile, votez !Signaler ce message aux modérateurs Par geoffrey5, le mercredi 4 juin 2008 à 16:33:40    
Télécharger sur le bureau malware bytes : https://www.besttechie.com/resources/malwarebytes/ 


= double-clic sur mbam-setup pour lancer l'installation 
= Installer simplement sans rien modifier 
= Quand le programme lancé ==> cocher Exécuter un examen complet 
= Clic Rechercher 
= Eventuellement décocher les disque à ne pas analyser 
= Clic Lancer l'examen 
= En fin de scan , si infection trouvée 
==> Clic Afficher résultat 
= Fermer vos applications en cours 
= Vérifier si tout est coché et clic Supprimer la sélection 

un rapport s'ouvre le copier et le coller dans la réponse 

Puis redémarrer le pc !! 

Et refais un rapport hijackthis
   Répondre à geoffrey56

Ce message vous semble utile, votez !Signaler ce message aux modérateurs Par linda, le mercredi 4 juin 2008 à 17:31:00    
ce fut long mais voici le rapport tel que demandé 


alwarebytes' Anti-Malware 1.14 
Version de la base de données: 821 

11:10:31 2008-06-04 
mbam-log-6-4-2008 (11-10-31).txt 

Type de recherche: Examen complet (C:\|D:\|) 
Eléments examinés: 106520 
Temps écoulé: 30 minute(s), 18 second(s) 

Processus mémoire infecté(s): 0 
Module(s) mémoire infecté(s): 1 
Clé(s) du Registre infectée(s): 17 
Valeur(s) du Registre infectée(s): 2 
Elément(s) de données du Registre infecté(s): 0 
Dossier(s) infecté(s): 20 
Fichier(s) infecté(s): 21 

Processus mémoire infecté(s): 
(Aucun élément nuisible détecté) 

Module(s) mémoire infecté(s): 
C:\WINDOWS\system32
stD.dll (Trojan.BHO) -> Unloaded module successfully. 

Clé(s) du Registre infectée(s): 
HKEY_CLASSES_ROOT\AppID\{8d71eeb8-a1a7-4733-8fa2-1cac015c967d} (Adware.BHO) -> Quarantined and deleted successfully. 
HKEY_CLASSES_ROOT\Interface\{ceb9c60d-f0ad-4b73-a3ab-4fc822e38d66} (Adware.BHO) -> Quarantined and deleted successfully. 
HKEY_CLASSES_ROOT\Interface\{1601d447-7424-4866-8dcc-acf98a2a41e1} (Adware.BHO) -> Quarantined and deleted successfully. 
HKEY_CLASSES_ROOT\Typelib\{c3c0ec2c-2c1c-495c-9ad0-1f0ef833d7b5} (Adware.BHO) -> Quarantined and deleted successfully. 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1d8282e6-bc4f-469b-aaed-7e4ff077ad93} (Adware.RightOnAds) -> Quarantined and deleted successfully. 
HKEY_CLASSES_ROOT\Interface\{c1a6d8b8-93c3-4186-9dd1-13983f9f1d9b} (Adware.RightOnAds) -> Quarantined and deleted successfully. 
HKEY_CLASSES_ROOT\Typelib\{3160f356-e8c3-4de2-a698-92eeeb3d3400} (Adware.RightOnAds) -> Quarantined and deleted successfully. 
HKEY_CLASSES_ROOT\dc_ads.ads (Trojan.BHO) -> Quarantined and deleted successfully. 
HKEY_CLASSES_ROOT\CLSID\{733716e1-76d2-4003-ac39-845281c0ef85} (Trojan.BHO) -> Quarantined and deleted successfully. 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{733716e1-76d2-4003-ac39-845281c0ef85} (Trojan.BHO) -> Quarantined and deleted successfully. 
HKEY_CLASSES_ROOT\dc_ads.ads.1 (Trojan.BHO) -> Quarantined and deleted successfully. 
HKEY_CLASSES_ROOT\CLSID\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
HKEY_CLASSES_ROOT\AppID\Sidebar.DLL (Adware.BHO) -> Quarantined and deleted successfully. 
HKEY_CURRENT_USER\Software\Microsoft\AdvRemoteDbg (Adware.Agent) -> Quarantined and deleted successfully. 
HKEY_CURRENT_USER\Software\AdwareAlert (Rogue.AdwareAlert) -> Quarantined and deleted successfully. 
HKEY_CURRENT_USER\Software\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully. 

Valeur(s) du Registre infectée(s): 
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> Quarantined and deleted successfully. 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\AdwareAlert\ (Rogue.AdwareAlert) -> Quarantined and deleted successfully. 

Elément(s) de données du Registre infecté(s): 
(Aucun élément nuisible détecté) 

Dossier(s) infecté(s): 
C:\Documents and Settings\Administrateur\Application Data\AdwareAlert (Rogue.AdwareAlert) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\AdwareAlert\Log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\AdwareAlert\Settings (Rogue.AdwareAlert) -> Quarantined and deleted successfully. 
C:\Program Files\AdwareAlert (Rogue.AdwareAlert) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cs\db (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cseport (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cses1 (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Program Files\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Program Files\ShoppingReport\Bin (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Program Files\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Program Files\ShoppingReport\Bin\2.0.24 (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\LocalService\Application Data\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\db (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cseport (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cses1 (Adware.Shopping.Report) -> Quarantined and deleted successfully. 

Fichier(s) infecté(s): 
C:\WINDOWS\system32
stD.dll (Trojan.BHO) -> Delete on reboot. 
C:\System Volume Information\_restore{FEEA537F-4E78-4814-A60F-A7A8BE8C9F38}\RP146\A0020972.dll (Adware.BHO) -> Quarantined and deleted successfully. 
C:\WINDOWS\system32\myss_sb_uninstall.exe (Adware.BHO) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\AdwareAlerts.dat (Rogue.AdwareAlert) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\AdwareAlert\Log\2008 Jan 07 - 01_33_44 PM_984.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\AdwareAlert\Log\2008 Jan 07 - 01_33_48 PM_890.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\AdwareAlert\Settings\IgnoreList.stg (Rogue.AdwareAlert) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\AdwareAlert\Settings\ScanResults.pie (Rogue.AdwareAlert) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cseport\aggr_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cseport\send_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\ShoppingReport\cses1\WhiteList.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cseport\aggr_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cseport\send_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cses1\WhiteList.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully. 
C:\Documents and Settings\Administrateur\Application Data\urlredir.cfg (Adware.RightOnAds) -> Quarantined and deleted successfully.
   Répondre à linda 
7

Ce message vous semble utile, votez !Signaler ce message aux modérateurs Par linda, le mercredi 4 juin 2008 à 17:33:53     
excuse moi j'avais oublier le Hijack merci 



Logfile of Trend Micro HijackThis v2.0.2 
Scan saved at 11:32:23, on 2008-06-04 
Platform: Windows XP SP3 (WinNT 5.01.2600) 
MSIE: Internet Explorer v7.00 (7.00.6000.16640) 
Boot mode: Normal 

Running processes: 
C:\WINDOWS\System32\smss.exe 
C:\WINDOWS\system32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\system32\Ati2evxx.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\WINDOWS\system32\Ati2evxx.exe 
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
C:\WINDOWS\system32\spoolsv.exe 
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe 
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe 
C:\WINDOWS\system32\cisvc.exe 
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe 
C:\WINDOWS\system32	cpsvcs.exe 
C:\Program Files\PDF Complete\pdfsvc.exe 
C:\WINDOWS\Explorer.EXE 
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 
C:\Program Files\PDF Complete\pdfsty.exe 
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe 
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 
C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
C:\WINDOWS\system32\ctfmon.exe 
C:\Program Files\internet explorer\iexplore.exe 
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe 
C:\Anzio\anzio32r.exe 
C:\WINDOWS\system32\cidaemon.exe 
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe 
C:\WINDOWS\system32\NOTEPAD.EXE 
C:\Program Files\Symantec\LiveUpdate\LUALL.EXE 
C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE 
C:\Program Files\Windows Live Toolbar\msn_sl.exe 
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\3A6AE8VX\HiJackThis[1].exe 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.canoe.qc.ca 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens 
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll 
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\FICHIE~1\SYMANT~1\IDS\IPSBHO.dll 
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll 
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll 
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll 
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll 
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll 
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll 
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe 
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe" 
O4 - HKLM\..\Run: [SDMSSplash] "C:\Program Files\HP_SDMS\SDMSSplash\launcher.exe" "launchdir=C:\Program Files\HP_SDMS\SDMSSplash" 
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe 
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe 
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe 
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" 
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" 
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot 
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background 
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO 
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe 
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user') 
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm 
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites 
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll 
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll 
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL 
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll 
O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} - http://h20278.www2.hp.com/HPDesktopSecurity/portal/cabs/HPISDataManager.CAB 
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPDesktopSecurity/portal/cabs/HPISDataManager.CAB 
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab 
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
O17 - HKLM\System\CCS\Services\Tcpip\..\{E088E321-96D6-492A-B2EB-F58B4D0D14A8}: NameServer = 192.2.0.254 
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe 
O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe 
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe 
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe 
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE 
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe 
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe 
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe 
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

geoffrey5 · Answer

Je ne vois plus d infection dans ton rapport, tout semble etre bon.

Si tu n as plus de problemes, tu peux mettre résolu en haut de ton topic

Ads served bye dcads

5 réponses

Votre réponse

Discussions similaires

Newsletters