Sujet Précédent Sujet Suivant

QUELQU UN POUR ME TAPER VITUMONDE

Résolu
romanza Messages postés 263 Statut Membre -  
sKe69 Messages postés 21955 Statut Contributeur sécurité -
Bonjour,

Je suis infeste par VIRTUMONDE . Ci joint un rapport HIJACK. AU SECOURS!!!!

Logfile of HijackThis v1.99.1
Scan saved at 19:04, on 08-06-07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\PASCAL\Bureau\Utilitares résolution virus\VundoFix.exe
C:\Documents and Settings\PASCAL\Bureau\Utilitares résolution virus\CCM.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {166BCB27-FCFD-4588-9BDB-44FC6A02EF35} - C:\WINDOWS\system32\mlJBRLbC.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: {e35c7f15-c824-7d3a-36d4-74d9357f4697} - {7964f753-9d47-4d63-a3d7-428c51f7c53e} - C:\WINDOWS\system32\iblgybjj.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: (no name) - {DD195312-12AF-4775-8A79-BA3AF7EFF26C} - C:\WINDOWS\system32\tuvUMgde.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_SDF2.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [10a6e849] rundll32.exe "C:\WINDOWS\system32\bfupbaid.dll",b
O4 - HKLM\..\Run: [BM1395dbd5] Rundll32.exe "C:\WINDOWS\system32\dxwenmra.dll",s
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: (no name) - {A4F64D63-3576-4754-8DD5-4D0A49345FD5} - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - Winlogon Notify: mlJBRLbC - C:\WINDOWS\SYSTEM32\mlJBRLbC.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: app_filter - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

59 réponses

Précédent
Réponse 41 / 59
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Salut les gas ^^
Merci pour le soutient ... Que le scipt que j'ai proposer ne soit pas complet , très bien mais je pense qu'au premier passage de Combo , la majeur partie de celui-ci ( sauf pour Crawler ) aurrait du être supprimer ... c'est la première fois que je vois ce-ci sur un rapport Combo :

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\Program Files\ICROSO~1

Je pense que romanza ne désactive pas ces défences avant le passage de combofix ...
0
romanza Messages postés 263 Statut Membre 2
 
OK j'avais zappé la désactivation des défenses. Voilà avec le script combo qu'il fallait à priori corriger:

ComboFix 08-06-15.1 - PASCAL 2008-06-15 22:01:14.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.500 [GMT 2:00]
Endroit: C:\Documents and Settings\PASCAL\Bureau\combofix.exe
Command switches used :: C:\Documents and Settings\PASCAL\Bureau\CFScript.doc
* Création d'un nouveau point de restauration
* Resident AV is active


[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\swlegwin.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-15 to 2008-06-15 ))))))))))))))))))))))))))))))))))))
.

2008-06-10 23:17 . 2008-06-10 23:18 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-06-10 20:47 . 2008-04-14 17:52 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-10 20:47 . 2008-04-14 17:52 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-09 20:07 . 2008-06-10 19:57 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-09 20:07 . 2008-06-09 20:07 <REP> d----c--- C:\Documents and Settings\PASCAL\Application Data\Malwarebytes
2008-06-09 20:07 . 2008-06-09 20:07 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-09 20:07 . 2008-06-09 20:13 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-09 20:07 . 2008-06-09 20:13 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-07 19:49 . 2008-06-07 19:49 <REP> d-------- C:\Program Files\XoftSpySE
2008-06-07 19:30 . 2008-06-07 19:30 <REP> d-------- C:\Program Files\Trend Micro
2008-06-07 14:19 . 2008-06-07 14:59 <REP> d-------- C:\Program Files\Spyware Terminator
2008-06-07 14:19 . 2008-06-07 14:19 <REP> d-------- C:\Program Files\Crawler
2008-06-07 14:19 . 2008-06-07 14:22 <REP> d----c--- C:\Documents and Settings\PASCAL\Application Data\Spyware Terminator
2008-06-07 14:19 . 2008-06-07 14:59 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-06-07 14:19 . 2008-06-07 14:19 141,312 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-06-01 12:59 . 2008-06-01 12:59 <REP> d----c--- C:\tmp
2008-06-01 09:57 . 2008-06-01 10:00 <REP> d-------- C:\Program Files\Free FLV Converter
2008-06-01 09:57 . 2007-06-19 01:22 364,544 --a------ C:\WINDOWS\system32\PropertyGrid.ocx
2008-06-01 09:57 . 2008-05-15 11:30 208,896 --a------ C:\WINDOWS\system32\TubeFinder.exe
2008-06-01 09:57 . 2005-10-13 15:42 208,500 --a------ C:\WINDOWS\system32\ReyXpBasics.tlb
2008-06-01 09:57 . 2004-03-09 02:00 84,512 --a------ C:\WINDOWS\system32\PICCLP32.OCX
2008-06-01 09:57 . 1998-07-12 21:00 32,768 --a------ C:\WINDOWS\system32\CMDLGFR.DLL
2008-06-01 09:57 . 2005-09-28 03:31 24,576 --a------ C:\WINDOWS\system32\ControlSubX.ocx
2008-06-01 09:57 . 1998-07-13 02:00 9,728 --a------ C:\WINDOWS\system32\PCCLPFR.DLL
2008-06-01 09:07 . 2008-06-01 09:07 <REP> d----c--- C:\YoutubeGet
2008-06-01 08:48 . 2008-06-01 09:51 <REP> d-------- C:\Program Files\Replay Converter
2008-05-31 20:47 . 2008-05-31 20:47 <REP> d----c--- C:\Downloaded Videos
2008-05-31 20:44 . 2005-08-27 03:38 1,435,272 --a------ C:\WINDOWS\system32\Flash.ocx
2008-05-31 20:44 . 2004-03-09 00:00 131,856 --a------ C:\WINDOWS\system32\MSADODC.ocx
2008-05-30 20:59 . 2008-05-30 21:00 <REP> d-------- C:\Program Files\Pet Soccer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-15 18:49 --------- dc----w C:\Documents and Settings\PASCAL\Application Data\Azureus
2008-06-15 17:27 --------- d-----w C:\Program Files\Steam
2008-06-10 21:06 --------- dc----w C:\Documents and Settings\PASCAL\Application Data\AdobeUM
2008-06-01 07:50 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-06-01 06:55 --------- d-----w C:\Program Files\eMule
2008-05-31 12:51 2,414,080 ----a-w C:\WINDOWS\Internet Logs\xDB3B.tmp
2008-05-31 12:51 135,168 ----a-w C:\WINDOWS\Internet Logs\xDB3A.tmp
2008-05-29 18:21 1,767,936 ----a-w C:\WINDOWS\Internet Logs\xDB39.tmp
2008-05-26 18:07 17,781,379 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2008_05_26_08_24_48_full.dmp.zip
2008-05-24 13:07 32,768 ----a-w C:\WINDOWS\Internet Logs\xDB37.tmp
2008-05-24 13:07 2,404,864 ----a-w C:\WINDOWS\Internet Logs\xDB38.tmp
2008-05-24 12:49 37,888 ----a-w C:\WINDOWS\Internet Logs\xDB35.tmp
2008-05-24 12:49 2,404,864 ----a-w C:\WINDOWS\Internet Logs\xDB36.tmp
2008-05-24 12:44 3,127,808 ----a-w C:\WINDOWS\Internet Logs\xDB34.tmp
2008-05-19 06:04 6,820,197 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-05-09 11:50 35,328 ----a-w C:\WINDOWS\Internet Logs\xDB32.tmp
2008-05-09 11:50 2,391,040 ----a-w C:\WINDOWS\Internet Logs\xDB33.tmp
2008-05-09 11:33 2,716,672 ----a-w C:\WINDOWS\Internet Logs\xDB30.tmp
2008-05-09 11:33 2,390,528 ----a-w C:\WINDOWS\Internet Logs\xDB31.tmp
2008-05-08 16:24 2,955,264 ----a-w C:\WINDOWS\Internet Logs\xDB2E.tmp
2008-05-08 16:24 2,388,992 ----a-w C:\WINDOWS\Internet Logs\xDB2F.tmp
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 08:44 672,256 ----a-w C:\WINDOWS\Internet Logs\xDB2C.tmp
2008-05-08 08:44 2,388,480 ----a-w C:\WINDOWS\Internet Logs\xDB2D.tmp
2008-05-08 08:26 3,148,288 ----a-w C:\WINDOWS\Internet Logs\xDB2A.tmp
2008-05-08 08:26 2,388,480 ----a-w C:\WINDOWS\Internet Logs\xDB2B.tmp
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-03 10:54 34,816 ----a-w C:\WINDOWS\Internet Logs\xDB28.tmp
2008-05-03 10:54 2,382,848 ----a-w C:\WINDOWS\Internet Logs\xDB29.tmp
2008-05-03 10:36 28,672 ----a-w C:\WINDOWS\Internet Logs\xDB27.tmp
2008-05-03 10:33 3,333,120 ----a-w C:\WINDOWS\Internet Logs\xDB25.tmp
2008-05-03 10:33 2,382,336 ----a-w C:\WINDOWS\Internet Logs\xDB26.tmp
2008-04-21 07:02 663,552 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-19 09:04 --------- d-----w C:\Program Files\Azureus
2008-04-09 18:12 2,976,768 ----a-w C:\WINDOWS\Internet Logs\xDB23.tmp
2008-04-09 18:12 2,356,224 ----a-w C:\WINDOWS\Internet Logs\xDB24.tmp
2008-03-30 18:23 2,344,960 ----a-w C:\WINDOWS\Internet Logs\xDB22.tmp
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-01-08 20:02 35,560 -c--a-w C:\Documents and Settings\PASCAL\Application Data\GDIPFONTCACHEV1.DAT
2006-02-05 15:31 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
1995-09-20 14:16 456,976 ----a-w C:\Program Files\Fichiers communs\dao3032.dll
2005-11-26 15:58 8,192 --sha-w C:\WINDOWS\o2cLicStore.bin
2006-12-10 13:41 56 --sh--r C:\WINDOWS\system32\18D9FD8534.sys
2004-08-05 12:00 65,024 --sha-w C:\WINDOWS\system32\asycfilt.dll
2005-07-14 19:31 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
2006-08-25 15:51 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
2005-06-26 22:32 616,448 --sha-r C:\WINDOWS\system32\cygwin1.dll
2004-08-05 12:00 16,384 --sha-w C:\WINDOWS\system32\ds32gt.dll
2004-08-05 12:00 380,957 --sha-w C:\WINDOWS\system32\expsrv.dll
2006-12-10 13:41 11,270 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2004-08-05 12:00 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2004-08-05 12:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
1999-05-05 20:22 1,056,768 --sha-w C:\WINDOWS\system32\msjet35.dll
1999-12-13 09:20 163,840 --sha-w C:\WINDOWS\system32\msjint35.dll
1999-12-12 19:20 36,864 --sha-w C:\WINDOWS\system32\msjter35.dll
2004-08-05 12:00 54,784 --sha-w C:\WINDOWS\system32\msvcirt.dll
2004-08-05 12:00 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2004-08-05 12:00 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll
2004-08-05 12:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
2004-08-05 12:00 61,440 --sha-w C:\WINDOWS\system32\msvcrt40.dll
2004-08-05 12:00 20,480 --sha-w C:\WINDOWS\system32\mtxdm.dll
2004-08-05 12:00 26,224 --sha-w C:\WINDOWS\system32\odbc16gt.dll
2004-08-05 12:00 249,856 --sha-w C:\WINDOWS\system32\odbc32.dll
2004-08-05 12:00 16,384 --sha-w C:\WINDOWS\system32\odbc32gt.dll
2004-08-05 12:00 32,768 --sha-w C:\WINDOWS\system32\odbcad32.exe
2004-08-05 12:00 69,632 --sha-w C:\WINDOWS\system32\odbcconf.exe
2004-08-05 12:00 106,496 --sha-w C:\WINDOWS\system32\odbccp32.dll
2004-08-05 12:00 65,536 --sha-w C:\WINDOWS\system32\odbccr32.dll
2004-08-05 12:00 65,536 --sha-w C:\WINDOWS\system32\odbccu32.dll
2004-08-05 12:00 98,304 --sha-w C:\WINDOWS\system32\odbcint.dll
2004-08-05 12:00 61,712 --sha-w C:\WINDOWS\system32\odbcji32.dll
2004-08-05 12:00 278,559 --sha-w C:\WINDOWS\system32\odbcjt32.dll
2004-08-05 12:00 147,456 --sha-w C:\WINDOWS\system32\odbctrac.dll
2004-08-05 12:00 20,511 --sha-w C:\WINDOWS\system32\oddbse32.dll
2004-08-05 12:00 20,510 --sha-w C:\WINDOWS\system32\odexl32.dll
2004-08-05 12:00 20,510 --sha-w C:\WINDOWS\system32\odfox32.dll
2004-08-05 12:00 20,510 --sha-w C:\WINDOWS\system32\odpdx32.dll
2004-08-05 12:00 20,511 --sha-w C:\WINDOWS\system32\odtext32.dll
2007-12-04 18:41 550,912 --sha-w C:\WINDOWS\system32\oleaut32.dll
2004-08-05 12:00 83,456 --sha-w C:\WINDOWS\system32\olepro32.dll
2004-08-05 12:00 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2007-03-03 15:16 160832]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-12-28 20:01 16384]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Services"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2004-11-20 06:02 266240]
"NVRTCLK"="C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe" [2003-12-30 11:44 24576]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-08-25 11:14 4554752]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-02-15 22:46 917504]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02 919280]
"nwiz"="nwiz.exe" [2004-08-25 11:14 921600 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-08-25 11:14 86016]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-08-20 16:36 6731312]
"Vade Retro Outlook Express"="C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2006-02-16 16:46 295936]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2003-06-30 21:56 188416]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2003-06-30 22:00 65536]
"LogitechGalleryRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2003-06-30 21:56 188416]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-12-28 20:01:33 169472]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^PASCAL^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=C:\Documents and Settings\PASCAL\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DllRunning]
C:\WINDOWS\system32\vgcsfmst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\flockbox]
--a------ 2007-04-17 23:52 1070448 C:\Program Files\My Lockbox\flockbox.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Piolet]
C:\Program Files\Piolet\Piolet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VGAUtil]
--a------ 2004-09-09 12:04 552960 C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wdokbye.dll]
C:\Documents and Settings\PASCAL\Local Settings\Application Data\wdokbye.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\counter-strike\\hl.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Radio Fr Solo\\Radio_Fr_Solo.exe"=
"C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-vga.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\day of defeat\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\opposing force\\hl.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\deathmatch classic\\hl.exe"=
"C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\team fortress classic\\hl.exe"=
"C:\\Program Files\\Google\\Google Earth Pro\\GoogleEarth.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\half-life\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\ricochet\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\valve test app 1003\\Rag_Doll_Kung_Fu_Steam.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\WM Recorder 10.2\\WMR.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\dedicated server\\hlds.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:TCP"= 80:TCP:GOOGLE EARTH TCP
"80:UDP"= 80:UDP:GOOGLE EARTH UDP
"55000:UDP"= 55000:UDP:AZUREUS UDP
"55000:TCP"= 55000:TCP:AZUREUSTCP
"8200:TCP"= 8200:TCP:emule 1
"10200:UDP"= 10200:UDP:emule2
"3587:TCP"= 3587:TCP:Groupement homologue Windows
"3540:UDP"= 3540:UDP:Protocole PNRP (Peer Name Resolution Protocol)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 MPRIFL;MPRIFL;C:\WINDOWS\system32\DRIVERS\MPRIFL.SYS [2007-04-17 23:52]
R2 app_filter;app_filter;C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe [2004-11-20 06:01]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2008-03-21 20:59]
S3 epstw2k;Pilote SCSI du port parallèle SCM;C:\WINDOWS\system32\DRIVERS\epstw2k.sys [2001-08-17 21:50]
S3 GVTDrv;GVTDrv;C:\WINDOWS\system32\drivers\GVTDrv.sys [2007-06-09 06:58]
S3 p2pgasvc;Authentification de groupe réseau homologue;C:\WINDOWS\system32\svchost.exe [2004-08-05 14:00]
S3 p2pimsvc;Gestionnaire d'identité réseau homologue;C:\WINDOWS\system32\svchost.exe [2004-08-05 14:00]
S3 p2psvc;Réseau homologue;C:\WINDOWS\system32\svchost.exe [2004-08-05 14:00]
S3 PNRPSvc;Protocole de résolution de noms d'homologues;C:\WINDOWS\system32\svchost.exe [2004-08-05 14:00]
S3 scsiscan;Pilote de scanneur SCSI;C:\WINDOWS\system32\DRIVERS\scsiscan.sys [2001-08-17 21:53]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3420adc2-2217-11da-bbc5-806d6172696f}]
\Shell\AutoRun\command - E:\ASUSACPI.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-05-27 06:43:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-15 20:00:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDetect.exe
"2008-06-15 19:30:40 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-06-10 04:20:04 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-15 22:02:52
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Temps d'accomplissement: 2008-06-15 22:03:23
ComboFix-quarantined-files.txt 2008-06-15 20:03:18
ComboFix2.txt 2008-06-15 19:36:57
ComboFix3.txt 2008-06-15 18:56:53

Pre-Run: 14,344,826,880 octets libres
Post-Run: 14,337,105,920 octets libres

268 --- E O F --- 2008-06-10 21:19:28




ComboFix 08-06-15.1 - PASCAL 2008-06-15 22:01:14.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.500 [GMT 2:00]
Endroit: C:\Documents and Settings\PASCAL\Bureau\combofix.exe
Command switches used :: C:\Documents and Settings\PASCAL\Bureau\CFScript.doc
* Création d'un nouveau point de restauration
* Resident AV is active


[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\swlegwin.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2008-05-15 to 2008-06-15 ))))))))))))))))))))))))))))))))))))
.

2008-06-10 23:17 . 2008-06-10 23:18 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-06-10 20:47 . 2008-04-14 17:52 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-10 20:47 . 2008-04-14 17:52 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-09 20:07 . 2008-06-10 19:57 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-09 20:07 . 2008-06-09 20:07 <REP> d----c--- C:\Documents and Settings\PASCAL\Application Data\Malwarebytes
2008-06-09 20:07 . 2008-06-09 20:07 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-09 20:07 . 2008-06-09 20:13 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-09 20:07 . 2008-06-09 20:13 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-07 19:49 . 2008-06-07 19:49 <REP> d-------- C:\Program Files\XoftSpySE
2008-06-07 19:30 . 2008-06-07 19:30 <REP> d-------- C:\Program Files\Trend Micro
2008-06-07 14:19 . 2008-06-07 14:59 <REP> d-------- C:\Program Files\Spyware Terminator
2008-06-07 14:19 . 2008-06-07 14:19 <REP> d-------- C:\Program Files\Crawler
2008-06-07 14:19 . 2008-06-07 14:22 <REP> d----c--- C:\Documents and Settings\PASCAL\Application Data\Spyware Terminator
2008-06-07 14:19 . 2008-06-07 14:59 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-06-07 14:19 . 2008-06-07 14:19 141,312 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-06-01 12:59 . 2008-06-01 12:59 <REP> d----c--- C:\tmp
2008-06-01 09:57 . 2008-06-01 10:00 <REP> d-------- C:\Program Files\Free FLV Converter
2008-06-01 09:57 . 2007-06-19 01:22 364,544 --a------ C:\WINDOWS\system32\PropertyGrid.ocx
2008-06-01 09:57 . 2008-05-15 11:30 208,896 --a------ C:\WINDOWS\system32\TubeFinder.exe
2008-06-01 09:57 . 2005-10-13 15:42 208,500 --a------ C:\WINDOWS\system32\ReyXpBasics.tlb
2008-06-01 09:57 . 2004-03-09 02:00 84,512 --a------ C:\WINDOWS\system32\PICCLP32.OCX
2008-06-01 09:57 . 1998-07-12 21:00 32,768 --a------ C:\WINDOWS\system32\CMDLGFR.DLL
2008-06-01 09:57 . 2005-09-28 03:31 24,576 --a------ C:\WINDOWS\system32\ControlSubX.ocx
2008-06-01 09:57 . 1998-07-13 02:00 9,728 --a------ C:\WINDOWS\system32\PCCLPFR.DLL
2008-06-01 09:07 . 2008-06-01 09:07 <REP> d----c--- C:\YoutubeGet
2008-06-01 08:48 . 2008-06-01 09:51 <REP> d-------- C:\Program Files\Replay Converter
2008-05-31 20:47 . 2008-05-31 20:47 <REP> d----c--- C:\Downloaded Videos
2008-05-31 20:44 . 2005-08-27 03:38 1,435,272 --a------ C:\WINDOWS\system32\Flash.ocx
2008-05-31 20:44 . 2004-03-09 00:00 131,856 --a------ C:\WINDOWS\system32\MSADODC.ocx
2008-05-30 20:59 . 2008-05-30 21:00 <REP> d-------- C:\Program Files\Pet Soccer

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-15 18:49 --------- dc----w C:\Documents and Settings\PASCAL\Application Data\Azureus
2008-06-15 17:27 --------- d-----w C:\Program Files\Steam
2008-06-10 21:06 --------- dc----w C:\Documents and Settings\PASCAL\Application Data\AdobeUM
2008-06-01 07:50 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-06-01 06:55 --------- d-----w C:\Program Files\eMule
2008-05-31 12:51 2,414,080 ----a-w C:\WINDOWS\Internet Logs\xDB3B.tmp
2008-05-31 12:51 135,168 ----a-w C:\WINDOWS\Internet Logs\xDB3A.tmp
2008-05-29 18:21 1,767,936 ----a-w C:\WINDOWS\Internet Logs\xDB39.tmp
2008-05-26 18:07 17,781,379 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2008_05_26_08_24_48_full.dmp.zip
2008-05-24 13:07 32,768 ----a-w C:\WINDOWS\Internet Logs\xDB37.tmp
2008-05-24 13:07 2,404,864 ----a-w C:\WINDOWS\Internet Logs\xDB38.tmp
2008-05-24 12:49 37,888 ----a-w C:\WINDOWS\Internet Logs\xDB35.tmp
2008-05-24 12:49 2,404,864 ----a-w C:\WINDOWS\Internet Logs\xDB36.tmp
2008-05-24 12:44 3,127,808 ----a-w C:\WINDOWS\Internet Logs\xDB34.tmp
2008-05-19 06:04 6,820,197 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-05-09 11:50 35,328 ----a-w C:\WINDOWS\Internet Logs\xDB32.tmp
2008-05-09 11:50 2,391,040 ----a-w C:\WINDOWS\Internet Logs\xDB33.tmp
2008-05-09 11:33 2,716,672 ----a-w C:\WINDOWS\Internet Logs\xDB30.tmp
2008-05-09 11:33 2,390,528 ----a-w C:\WINDOWS\Internet Logs\xDB31.tmp
2008-05-08 16:24 2,955,264 ----a-w C:\WINDOWS\Internet Logs\xDB2E.tmp
2008-05-08 16:24 2,388,992 ----a-w C:\WINDOWS\Internet Logs\xDB2F.tmp
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 08:44 672,256 ----a-w C:\WINDOWS\Internet Logs\xDB2C.tmp
2008-05-08 08:44 2,388,480 ----a-w C:\WINDOWS\Internet Logs\xDB2D.tmp
2008-05-08 08:26 3,148,288 ----a-w C:\WINDOWS\Internet Logs\xDB2A.tmp
2008-05-08 08:26 2,388,480 ----a-w C:\WINDOWS\Internet Logs\xDB2B.tmp
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-03 10:54 34,816 ----a-w C:\WINDOWS\Internet Logs\xDB28.tmp
2008-05-03 10:54 2,382,848 ----a-w C:\WINDOWS\Internet Logs\xDB29.tmp
2008-05-03 10:36 28,672 ----a-w C:\WINDOWS\Internet Logs\xDB27.tmp
2008-05-03 10:33 3,333,120 ----a-w C:\WINDOWS\Internet Logs\xDB25.tmp
2008-05-03 10:33 2,382,336 ----a-w C:\WINDOWS\Internet Logs\xDB26.tmp
2008-04-21 07:02 663,552 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-19 09:04 --------- d-----w C:\Program Files\Azureus
2008-04-09 18:12 2,976,768 ----a-w C:\WINDOWS\Internet Logs\xDB23.tmp
2008-04-09 18:12 2,356,224 ----a-w C:\WINDOWS\Internet Logs\xDB24.tmp
2008-03-30 18:23 2,344,960 ----a-w C:\WINDOWS\Internet Logs\xDB22.tmp
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-01-08 20:02 35,560 -c--a-w C:\Documents and Settings\PASCAL\Application Data\GDIPFONTCACHEV1.DAT
2006-02-05 15:31 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
1995-09-20 14:16 456,976 ----a-w C:\Program Files\Fichiers communs\dao3032.dll
2005-11-26 15:58 8,192 --sha-w C:\WINDOWS\o2cLicStore.bin
2006-12-10 13:41 56 --sh--r C:\WINDOWS\system32\18D9FD8534.sys
2004-08-05 12:00 65,024 --sha-w C:\WINDOWS\system32\asycfilt.dll
2005-07-14 19:31 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
2006-08-25 15:51 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
2005-06-26 22:32 616,448 --sha-r C:\WINDOWS\system32\cygwin1.dll
2004-08-05 12:00 16,384 --sha-w C:\WINDOWS\system32\ds32gt.dll
2004-08-05 12:00 380,957 --sha-w C:\WINDOWS\system32\expsrv.dll
2006-12-10 13:41 11,270 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2004-08-05 12:00 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2004-08-05 12:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
1999-05-05 20:22 1,056,768 --sha-w C:\WINDOWS\system32\msjet35.dll
1999-12-13 09:20 163,840 --sha-w C:\WINDOWS\system32\msjint35.dll
1999-12-12 19:20 36,864 --sha-w C:\WINDOWS\system32\msjter35.dll
2004-08-05 12:00 54,784 --sha-w C:\WINDOWS\system32\msvcirt.dll
2004-08-05 12:00 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2004-08-05 12:00 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll
2004-08-05 12:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
2004-08-05 12:00 61,440 --sha-w C:\WINDOWS\system32\msvcrt40.dll
2004-08-05 12:00 20,480 --sha-w C:\WINDOWS\system32\mtxdm.dll
2004-08-05 12:00 26,224 --sha-w C:\WINDOWS\system32\odbc16gt.dll
2004-08-05 12:00 249,856 --sha-w C:\WINDOWS\system32\odbc32.dll
2004-08-05 12:00 16,384 --sha-w C:\WINDOWS\system32\odbc32gt.dll
2004-08-05 12:00 32,768 --sha-w C:\WINDOWS\system32\odbcad32.exe
2004-08-05 12:00 69,632 --sha-w C:\WINDOWS\system32\odbcconf.exe
2004-08-05 12:00 106,496 --sha-w C:\WINDOWS\system32\odbccp32.dll
2004-08-05 12:00 65,536 --sha-w C:\WINDOWS\system32\odbccr32.dll
2004-08-05 12:00 65,536 --sha-w C:\WINDOWS\system32\odbccu32.dll
2004-08-05 12:00 98,304 --sha-w C:\WINDOWS\system32\odbcint.dll
2004-08-05 12:00 61,712 --sha-w C:\WINDOWS\system32\odbcji32.dll
2004-08-05 12:00 278,559 --sha-w C:\WINDOWS\system32\odbcjt32.dll
2004-08-05 12:00 147,456 --sha-w C:\WINDOWS\system32\odbctrac.dll
2004-08-05 12:00 20,511 --sha-w C:\WINDOWS\system32\oddbse32.dll
2004-08-05 12:00 20,510 --sha-w C:\WINDOWS\system32\odexl32.dll
2004-08-05 12:00 20,510 --sha-w C:\WINDOWS\system32\odfox32.dll
2004-08-05 12:00 20,510 --sha-w C:\WINDOWS\system32\odpdx32.dll
2004-08-05 12:00 20,511 --sha-w C:\WINDOWS\system32\odtext32.dll
2007-12-04 18:41 550,912 --sha-w C:\WINDOWS\system32\oleaut32.dll
2004-08-05 12:00 83,456 --sha-w C:\WINDOWS\system32\olepro32.dll
2004-08-05 12:00 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2007-03-03 15:16 160832]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-12-28 20:01 16384]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 09:20 222080]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Services"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2004-11-20 06:02 266240]
"NVRTCLK"="C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe" [2003-12-30 11:44 24576]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-08-25 11:14 4554752]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-02-15 22:46 917504]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02 919280]
"nwiz"="nwiz.exe" [2004-08-25 11:14 921600 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-08-25 11:14 86016]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-08-20 16:36 6731312]
"Vade Retro Outlook Express"="C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2006-02-16 16:46 295936]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2003-06-30 21:56 188416]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2003-06-30 22:00 65536]
"LogitechGalleryRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2003-06-30 21:56 188416]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-12-28 20:01:33 169472]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^PASCAL^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=C:\Documents and Settings\PASCAL\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DllRunning]
C:\WINDOWS\system32\vgcsfmst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\flockbox]
--a------ 2007-04-17 23:52 1070448 C:\Program Files\My Lockbox\flockbox.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Piolet]
C:\Program Files\Piolet\Piolet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VGAUtil]
--a------ 2004-09-09 12:04 552960 C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wdokbye.dll]
C:\Documents and Settings\PASCAL\Local Settings\Application Data\wdokbye.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\counter-strike\\hl.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Radio Fr Solo\\Radio_Fr_Solo.exe"=
"C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-vga.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\day of defeat\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\opposing force\\hl.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\deathmatch classic\\hl.exe"=
"C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\team fortress classic\\hl.exe"=
"C:\\Program Files\\Google\\Google Earth Pro\\GoogleEarth.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\half-life\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\ricochet\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\valve test app 1003\\Rag_Doll_Kung_Fu_Steam.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\WM Recorder 10.2\\WMR.exe"=
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\dedicated server\\hlds.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:TCP"= 80:TCP:GOOGLE EARTH TCP
"80:UDP"= 80:UDP:GOOGLE EARTH UDP
"55000:UDP"= 55000:UDP:AZUREUS UDP
"55000:TCP"= 55000:TCP:AZUREUSTCP
"8200:TCP"= 8200:TCP:emule 1
"10200:UDP"= 10200:UDP:emule2
"3587:TCP"= 3587:TCP:Groupement homologue Windows
"3540:UDP"= 3540:UDP:Protocole PNRP (Peer Name Resolution Protocol)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 MPRIFL;MPRIFL;C:\WINDOWS\system32\DRIVERS\MPRIFL.SYS [2007-04-17 23:52]
R2 app_filter;app_filter;C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe [2004-11-20 06:01]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2008-03-21 20:59]
S3 epstw2k;Pilote SCSI du port parallèle SCM;C:\WINDOWS\system32\DRIVERS\epstw2k.sys [2001-08-17 21:50]
S3 GVTDrv;GVTDrv;C:\WINDOWS\system32\drivers\GVTDrv.sys [2007-06-09 06:58]
S3 p2pgasvc;Authentification de groupe réseau homologue;C:\WINDOWS\system32\svchost.exe [2004-08-05 14:00]
S3 p2pimsvc;Gestionnaire d'identité réseau homologue;C:\WINDOWS\system32\svchost.exe [2004-08-05 14:00]
S3 p2psvc;Réseau homologue;C:\WINDOWS\system32\svchost.exe [2004-08-05 14:00]
S3 PNRPSvc;Protocole de résolution de noms d'homologues;C:\WINDOWS\system32\svchost.exe [2004-08-05 14:00]
S3 scsiscan;Pilote de scanneur SCSI;C:\WINDOWS\system32\DRIVERS\scsiscan.sys [2001-08-17 21:53]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3420adc2-2217-11da-bbc5-806d6172696f}]
\Shell\AutoRun\command - E:\ASUSACPI.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-05-27 06:43:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-15 20:00:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDetect.exe
"2008-06-15 19:30:40 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-06-10 04:20:04 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-15 22:02:52
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Temps d'accomplissement: 2008-06-15 22:03:23
ComboFix-quarantined-files.txt 2008-06-15 20:03:18
ComboFix2.txt 2008-06-15 19:36:57
ComboFix3.txt 2008-06-15 18:56:53

Pre-Run: 14,344,826,880 octets libres
Post-Run: 14,337,105,920 octets libres

268 --- E O F --- 2008-06-10 21:19:28
0
Réponse 42 / 59
jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
ce qui me gene moi c'est le Purity

0
Réponse 43 / 59
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Télécharges OTMoveIt (de Old_Timer) sur ton Bureau.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

!! déconnecte toi, fermes toute tes application en cours !!

clic double sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,

C:\WINDOWS\iun6002.exe

et colles-la dans le cadre de gauche de OTMoveIt2 :
Paste standard List of Files/Folders to be moved.

cliques sur MoveIt! pour lancer la suppression.
le résultat apparaîtra dans le cadre Results.

cliques sur Exit pour fermer.
--->postes le rapport situé dans " C:\OTMoveIt\MovedFiles." accompagné d'un nouvel hijackthis ...

il te sera peut-être demandé de redémarrer le pc pour achever la suppression.
si c'est le cas acceptes par "Yes".

0
Réponse 44 / 59
romanza Messages postés 263 Statut Membre 2
 
Voilà :

C:\WINDOWS\iun6002.exe moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06152008_225147
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 45 / 59
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Postes nous un nouveau rapport hijackthis svp ...
0
Réponse 46 / 59
romanza Messages postés 263 Statut Membre 2
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:11:53, on 15/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ESET\nod32kui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: (no name) - {A4F64D63-3576-4754-8DD5-4D0A49345FD5} - (no file) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: app_filter - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
0
Réponse 47 / 59
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Bon , ... Crawler toujours là ...

A faire sous FireFoxe :

1-Télécharges Brute Force Uninstaller (de Merijn) ici : http://www.merijn.org/files/bfu.zip

Une fois le .zip téléchargé fais ce qui suit :

A) Créé un nouveau dossier sur ton bureau :
pointes ta souris sur ton bureau , click droit : vas dans "nouveau" , choisis "dossier" et nomme ce dossier BFU .

Décompresses le fichier téléchargé (clik droit : extrair tout) dans dossier BFU que tu viens de crée ( et pas ailleur ! ) .

B) Ensuite, télécharges Toolbar.bfu (de Chercheur) :
Ouvres ce lien ---> http://chercheur-perso.perso.orange.fr/

Sur cette page, fais un clic droit sur "toolbar.bfu"
---> choisis "Enregistrer la cible sous..." afin de télécharger Toolbar.bfu (de Chercheur).
! Sauvegardes le dans le dossier BFU que tu as créé sur ton bureau !
**Note : si tu utilises Internet Explorer ; lors de la sauvegarde, assures-toi que le champs "Type" il y est : "Tous les fichiers".

Donc au final, tu dois maintenant avoir deux fichiers dans le dossier BFU : toolbar.bfu et BFU.exe (très important).

Une fois cela fais correctement , passes au nettoyage :

2-Lances "Brute Force Uninstaller" en double-cliquant BFU.exe (Dans le dossier BFU)
--> Cliques sur le petit dossier jaune, et clique sur : Toolbar.bfu
--> Coches la case "Show log after script ends"
- Clique sur "Execute" pour que le fix fasse son boulot : attends bien que le message "Complete scrïpt execution" apparaîsse et clique sur OK.
Un rapport va s'afficher dans la fenêtre du programme, copie et colle dans le bloc-notes ( =doc .txt), puis sauvegardes le de manière à le retrouver ...
Cliques "Exit" pour fermer le programme BFU.

Tu as une démo animée ici (merci balltrap34):
--->http://perso.orange.fr/rginformatique/section%20virus/bfu%20demo.htm

Postes moi donc ce rapport accompagné d'un nouveau rapport Hijackthis pour analyse ...
0
Réponse 48 / 59
romanza Messages postés 263 Statut Membre 2
 
Voilà :

BFU v1.11.0
Windows XP SP2 (WinNT 5.01.2600 SP2)
Script started at 08:07:24, on 16/06/2008

Warning: The following line has unexpanded aliases and will be skipped: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Orange</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

<script type="text/javascript">
//<![CDATA[
//<!--
var o_bNoWalledGarden = false;
//-->
//]]>
</script>

<!-- Scripts Orange Moteur -->
<script language="JavaScript" src="http://c.orange.fr/Js/o.js"></script>
<script language="JavaScript" src="http://c.orange.fr/Js/common.js"></script>
<!-- / Scripts Orange Moteur -->

<script type="text/javascript">
//<![CDATA[
//<!--
var sUrlReferrer = "W3ACC_vis_accueil";
// initUrlReferrer();
// fonction définuie dans http://www.dev.orange.fr/Js/hp.js ... utile ?
//-->
//]]>
</script>

<!-- Inclusions Styles Orange -->
<style type="text/css" media="all">
@import url(http://c.orange.fr/Css/o.css);
</style>
<!-- / Inclusions Styles Orange -->

<link rel="stylesheet" href="C/autosearch.css" type="text/css">
<script language="JavaScript" src="https://www.orange.fr/portail"></script>
<SCRIPT LANGUAGE="JavaScript" type="text/javascript" >
var cartoucheStat = 1; // 1 : 1 champs web,image,actu. 2 : 1 champs shopping. 3 : 3 champs enville
</SCRIPT>
<script type="text/javascript">
function initialisations()
{
document.forms['web_fr'].rdata.focus();
}
</script>
</head>
<body onload="initialisations()">

<br/>
<!-- Bloc de texte + moteur de recherche //// MAJ: pas de bloc de recherche -->
<div class="boite4">
<div class="bbody">

<div class="boite1Header"><img src="http://img.ke.orange.fr/I/orange/logo_info.jpg" alt="!"><h3>Page introuvable</h3></div>
<p> Vous venez d'être redirigé vers une page d'erreur.<br>
<b>L'adresse URL</b> que vous avez saisie ou <b>le lien</b> que vous avez cliqué <b>sont erronés</b>. </p>
<p>Vous pouvez poursuivre votre navigation en lançant une nouvelle recherche: </p>
<form action="https://www.orange.fr/portail" method="get" target="_top" name="web_fr" id="web_fr" onSubmit="return submitFormCartoucheWeb();">
<input name="sev" value="" type="hidden">
<input name="rtype" value="kw" type="hidden">
<input name="profil" value="autosearch" type="hidden">
<input name="bhv" id="bhv" value="web_fr" type="hidden">
<input tabindex="1" maxlength="100" class="searchFormTxtAutoS" id="rdata" name="rdata" value="" accesskey="0" type="text"> 
<input tabindex="2" name="submit" class="bt_sub" src="http://img.ke.orange.fr/I/orange/btn_rechercher.gif" align="absmiddle" type="image">
</form>
</div>
<div class="bb">
<div class="bb1"><div></div></div>
<div class="bb2"><div> </div></div>
</div>
<div class="bc1"><div> </div></div>
<div class="bc2"><div> </div></div>
<div class="bc3"><div> </div></div>
</div>
<!--bloc de texte + moteur de recherche -->

<!-- les liens HOT-spots-->
<div class="err_colSponsbox">
<div class="err_desc">
Vous pouvez également cliquer sur l'un des thèmes ci-dessous pour accéder au moteur de recherche :
</div>

<table class="table_mots" width="780" cellpadding="0" cellspacing="0">
<tr>
<td width="20%">
<div id="colSpons">
<div class="heado">
<div class="titleo">
Voyages/Vacances
</div>
</div>
<div class="content">
<ul>
<li>> <a title="Rechercher Vol Dégriffé" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=vol+degriffe&referers=hotspots">Vol Dégriffé</a></li>
<li>> <a title="Rechercher Hôtel" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=hotel&referers=hotspots">Hôtel</a></li>
<li>> <a title="Rechercher Vacances Famille" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=vacances+famille&referers=hotspots">Vacances Famille</a></li>
<li>> <a title="Rechercher Voiture de location" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=voiture+de+location&referers=hotspots">Voiture de location</a></li>
<li>> <a title="Rechercher Agences de voyages" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=agences+de+voyages&referers=hotspots">Agences de voyages</a></li>
<li>> <a title="Rechercher Week-end" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=week-end&referers=hotspots">Week-end</a></li>
<li>> <a title="Rechercher Location Vacances" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=location+vacances&referers=hotspots">Location Vacances</a></li>
<li>> <a title="Rechercher Croisiere" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=croisiere&referers=hotspots">Croisière</a></li>
</ul>
</div>

</div>
</td>
<td width="20%">
<div id="colSpons">
<div class="heado">
<div class="titleo">
Finances
</div>
</div>
<div class="content">
<ul>
<li>> <a title="Rechercher Bourse" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=bourse&referers=hotspots">Bourse</a></li>
<li>> <a title="Rechercher Loi Robien" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=loi+robien&referers=hotspots">Loi Robien</a></li>
<li>> <a title="Rechercher Mutuelle" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=mutuelle&referers=hotspots">Mutuelle</a></li>
<li>> <a title="Rechercher Assurance Vie Multisupport" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=assurance+vie+multisupport&referers=hotspots">Assurance Vie Multisupport</a></li>
<li>> <a title="Rechercher Epargne" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=epargne&referers=hotspots">Épargne</a></li>
<li>> <a title="Rechercher Défiscalisation" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=defiscalisation&referers=hotspots">Défiscalisation</a></li>
<li>> <a title="Rechercher Placement" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=placement&referers=hotspots">Placement</a></li>
<li>> <a title="Rechercher Rachat Crédit" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=rachat+credit&referers=hotspots">Rachat Crédit</a></li>
</ul>
</div>
</div>
</td>
<td width="20%">
<div id="colSpons">
<div class="heado">
<div class="titleo">
Santé
</div>
</div>
<div class="content">
<ul>
<li>> <a title="Rechercher Cheveux" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=cheveux&referers=hotspots">Cheveux</a></li>
<li>> <a title="Rechercher Produit Minceur" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=produit+minceur&referers=hotspots">Produit Minceur</a></li>
<li>> <a title="Rechercher Spa" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=spa&referers=hotspots">Spa</a></li>
<li>> <a title="Rechercher Mincir" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=mincir&referers=hotspots">Mincir</a></li>
<li>> <a title="Rechercher Thalasso" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=thalasso&referers=hotspots">Thalasso</a></li>
<li>> <a title="Rechercher Épilation" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=epilation&referers=hotspots">Épilation</a></li>
<li>> <a title="Rechercher Parfum" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=parfum&referers=hotspots">Parfum</a></li>
<li>> <a title="Rechercher Produit Bio" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=produit+bio&referers=hotspots">Produit Bio</a></li>
</ul>
</div>
</div>
</td>
<td width="20%">
<div id="colSpons">
<div class="heado">
<div class="titleo">
Shopping
</div>
</div>
<div class="content">
<ul>
<li>> <a title="Rechercher Pc Portable" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=pc+portable&referers=hotspots">Pc Portable</a></li>
<li>> <a title="Rechercher Idée Cadeau" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=idee+cadeau&referers=hotspots">Idée Cadeau</a></li>
<li>> <a title="Rechercher Acheter Livre" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=acheter+livre&referers=hotspots">Acheter Livre</a></li>
<li>> <a title="Rechercher Dvd Vierge" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=dvd+vierge&referers=hotspots">Dvd Vierge</a></li>
<li>> <a title="Rechercher Cartouche encre imprimante" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=cartouche+encre+imprimante&referers=hotspots">Cartouche encre imprimante</a></li>
<li>> <a title="Rechercher Course domicile" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=course+domicile&referers=hotspots">Course domicile</a></li>
<li>> <a title="Rechercher Bijoux Fantaisie" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=bijoux+fantaisie&referers=hotspots">Bijoux Fantaisie</a></li>
<li>> <a title="Rechercher Vêtement Femme" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=vetement+femme&referers=hotspots">Vêtement Femme</a></li>
</ul>
</div>
</div>
</td>
<td width="20%">
<div id="colSpons">
<div class="heado">
<div class="titleo">
Pratique
</div>
</div>
<div class="content">
<ul>
<li>> <a title="Rechercher Immobilier" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=immobilier&referers=hotspots">Immobilier</a></li>
<li>> <a title="Rechercher Rencontre" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=rencontre&referers=hotspots">Rencontre</a></li>
<li>> <a title="Rechercher Apprendre Anglais" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=apprendre+anglais&referers=hotspots">Apprendre Anglais</a></li>
<li>> <a title="Rechercher Voyance" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=voyance&referers=hotspots">Voyance</a></li>
<li>> <a title="Rechercher Depannage Informatique" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=depannage+informatique&referers=hotspots">Dépannage Informatique</a></li>
<li>> <a title="Rechercher Voix sur IP" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=voix+sur+ip&referers=hotspots">Voix sur IP</a></li>
<li>> <a title="Rechercher Déménagement" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=demenagement&referers=hotspots">Déménagement</a></li>
<li>> <a title="Rechercher Plombier" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=plombier&referers=hotspots">Plombier</a></li>
</ul>
</div>
</div>
</td>
</tr>
</table>
<br/>
<br/>
</div>
<!-- fin des liens hot-spots -->

<br/>

<script type="text/javascript">
//<![CDATA[
//<!--
o_audience();
//-->
//]]>
</script>

<div id='o_footer'>
<script type='text/javascript'>
//<![CDATA[
//<!--
o_footer('type=footer');
//-->
//]]>
</script>
</div>
</body>
</html>

Warning: unknown command '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Orange</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

<script type="text/javascript">
//<![CDATA[
//<!--
var o_bNoWalledGarden = false;
//-->
//]]>
</script>

<!-- Scripts Orange Moteur -->
<script language="JavaScript" src="http://c.orange.fr/Js/o.js"></script>
<script language="JavaScript" src="http://c.orange.fr/Js/common.js"></script>
<!-- / Scripts Orange Moteur -->

<script type="text/javascript">
//<![CDATA[
//<!--
var sUrlReferrer = "W3ACC_vis_accueil";
// initUrlReferrer();
// fonction définuie dans http://www.dev.orange.fr/Js/hp.js ... utile ?
//-->
//]]>
</script>

<!-- Inclusions Styles Orange -->
<style type="text/css" media="all">
@import url(http://c.orange.fr/Css/o.css);
</style>
<!-- / Inclusions Styles Orange -->

<link rel="stylesheet" href="C/autosearch.css" type="text/css">
<script language="JavaScript" src="https://www.orange.fr/portail"></script>
<SCRIPT LANGUAGE="JavaScript" type="text/javascript" >
var cartoucheStat = 1; // 1 : 1 champs web,image,actu. 2 : 1 champs shopping. 3 : 3 champs enville
</SCRIPT>
<script type="text/javascript">
function initialisations()
{
document.forms['web_fr'].rdata.focus();
}
</script>
</head>
<body onload="initialisations()">

<br/>
<!-- Bloc de texte + moteur de recherche //// MAJ: pas de bloc de recherche -->
<div class="boite4">
<div class="bbody">

<div class="boite1Header"><img src="http://img.ke.orange.fr/I/orange/logo_info.jpg" alt="!"><h3>Page introuvable</h3></div>
<p> Vous venez d'être redirigé vers une page d'erreur.<br>
<b>L'adresse URL</b> que vous avez saisie ou <b>le lien</b> que vous avez cliqué <b>sont erronés</b>. </p>
<p>Vous pouvez poursuivre votre navigation en lançant une nouvelle recherche: </p>
<form action="https://www.orange.fr/portail" method="get" target="_top" name="web_fr" id="web_fr" onSubmit="return submitFormCartoucheWeb();">
<input name="sev" value="" type="hidden">
<input name="rtype" value="kw" type="hidden">
<input name="profil" value="autosearch" type="hidden">
<input name="bhv" id="bhv" value="web_fr" type="hidden">
<input tabindex="1" maxlength="100" class="searchFormTxtAutoS" id="rdata" name="rdata" value="" accesskey="0" type="text"> 
<input tabindex="2" name="submit" class="bt_sub" src="http://img.ke.orange.fr/I/orange/btn_rechercher.gif" align="absmiddle" type="image">
</form>
</div>
<div class="bb">
<div class="bb1"><div></div></div>
<div class="bb2"><div> </div></div>
</div>
<div class="bc1"><div> </div></div>
<div class="bc2"><div> </div></div>
<div class="bc3"><div> </div></div>
</div>
<!--bloc de texte + moteur de recherche -->

<!-- les liens HOT-spots-->
<div class="err_colSponsbox">
<div class="err_desc">
Vous pouvez également cliquer sur l'un des thèmes ci-dessous pour accéder au moteur de recherche :
</div>

<table class="table_mots" width="780" cellpadding="0" cellspacing="0">
<tr>
<td width="20%">
<div id="colSpons">
<div class="heado">
<div class="titleo">
Voyages/Vacances
</div>
</div>
<div class="content">
<ul>
<li>> <a title="Rechercher Vol Dégriffé" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=vol+degriffe&referers=hotspots">Vol Dégriffé</a></li>
<li>> <a title="Rechercher Hôtel" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=hotel&referers=hotspots">Hôtel</a></li>
<li>> <a title="Rechercher Vacances Famille" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=vacances+famille&referers=hotspots">Vacances Famille</a></li>
<li>> <a title="Rechercher Voiture de location" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=voiture+de+location&referers=hotspots">Voiture de location</a></li>
<li>> <a title="Rechercher Agences de voyages" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=agences+de+voyages&referers=hotspots">Agences de voyages</a></li>
<li>> <a title="Rechercher Week-end" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=week-end&referers=hotspots">Week-end</a></li>
<li>> <a title="Rechercher Location Vacances" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=location+vacances&referers=hotspots">Location Vacances</a></li>
<li>> <a title="Rechercher Croisiere" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=croisiere&referers=hotspots">Croisière</a></li>
</ul>
</div>

</div>
</td>
<td width="20%">
<div id="colSpons">
<div class="heado">
<div class="titleo">
Finances
</div>
</div>
<div class="content">
<ul>
<li>> <a title="Rechercher Bourse" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=bourse&referers=hotspots">Bourse</a></li>
<li>> <a title="Rechercher Loi Robien" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=loi+robien&referers=hotspots">Loi Robien</a></li>
<li>> <a title="Rechercher Mutuelle" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=mutuelle&referers=hotspots">Mutuelle</a></li>
<li>> <a title="Rechercher Assurance Vie Multisupport" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=assurance+vie+multisupport&referers=hotspots">Assurance Vie Multisupport</a></li>
<li>> <a title="Rechercher Epargne" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=epargne&referers=hotspots">Épargne</a></li>
<li>> <a title="Rechercher Défiscalisation" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=defiscalisation&referers=hotspots">Défiscalisation</a></li>
<li>> <a title="Rechercher Placement" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=placement&referers=hotspots">Placement</a></li>
<li>> <a title="Rechercher Rachat Crédit" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=rachat+credit&referers=hotspots">Rachat Crédit</a></li>
</ul>
</div>
</div>
</td>
<td width="20%">
<div id="colSpons">
<div class="heado">
<div class="titleo">
Santé
</div>
</div>
<div class="content">
<ul>
<li>> <a title="Rechercher Cheveux" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=cheveux&referers=hotspots">Cheveux</a></li>
<li>> <a title="Rechercher Produit Minceur" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=produit+minceur&referers=hotspots">Produit Minceur</a></li>
<li>> <a title="Rechercher Spa" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=spa&referers=hotspots">Spa</a></li>
<li>> <a title="Rechercher Mincir" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=mincir&referers=hotspots">Mincir</a></li>
<li>> <a title="Rechercher Thalasso" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=thalasso&referers=hotspots">Thalasso</a></li>
<li>> <a title="Rechercher Épilation" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=epilation&referers=hotspots">Épilation</a></li>
<li>> <a title="Rechercher Parfum" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=parfum&referers=hotspots">Parfum</a></li>
<li>> <a title="Rechercher Produit Bio" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=produit+bio&referers=hotspots">Produit Bio</a></li>
</ul>
</div>
</div>
</td>
<td width="20%">
<div id="colSpons">
<div class="heado">
<div class="titleo">
Shopping
</div>
</div>
<div class="content">
<ul>
<li>> <a title="Rechercher Pc Portable" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=pc+portable&referers=hotspots">Pc Portable</a></li>
<li>> <a title="Rechercher Idée Cadeau" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=idee+cadeau&referers=hotspots">Idée Cadeau</a></li>
<li>> <a title="Rechercher Acheter Livre" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=acheter+livre&referers=hotspots">Acheter Livre</a></li>
<li>> <a title="Rechercher Dvd Vierge" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=dvd+vierge&referers=hotspots">Dvd Vierge</a></li>
<li>> <a title="Rechercher Cartouche encre imprimante" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=cartouche+encre+imprimante&referers=hotspots">Cartouche encre imprimante</a></li>
<li>> <a title="Rechercher Course domicile" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=course+domicile&referers=hotspots">Course domicile</a></li>
<li>> <a title="Rechercher Bijoux Fantaisie" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=bijoux+fantaisie&referers=hotspots">Bijoux Fantaisie</a></li>
<li>> <a title="Rechercher Vêtement Femme" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=vetement+femme&referers=hotspots">Vêtement Femme</a></li>
</ul>
</div>
</div>
</td>
<td width="20%">
<div id="colSpons">
<div class="heado">
<div class="titleo">
Pratique
</div>
</div>
<div class="content">
<ul>
<li>> <a title="Rechercher Immobilier" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=immobilier&referers=hotspots">Immobilier</a></li>
<li>> <a title="Rechercher Rencontre" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=rencontre&referers=hotspots">Rencontre</a></li>
<li>> <a title="Rechercher Apprendre Anglais" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=apprendre+anglais&referers=hotspots">Apprendre Anglais</a></li>
<li>> <a title="Rechercher Voyance" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=voyance&referers=hotspots">Voyance</a></li>
<li>> <a title="Rechercher Depannage Informatique" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=depannage+informatique&referers=hotspots">Dépannage Informatique</a></li>
<li>> <a title="Rechercher Voix sur IP" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=voix+sur+ip&referers=hotspots">Voix sur IP</a></li>
<li>> <a title="Rechercher Déménagement" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=demenagement&referers=hotspots">Déménagement</a></li>
<li>> <a title="Rechercher Plombier" target="_top" href="https://www.orange.fr/portail?rtype=kw&profil=orange&bhv=web_fr&rdata=plombier&referers=hotspots">Plombier</a></li>
</ul>
</div>
</div>
</td>
</tr>
</table>
<br/>
<br/>
</div>
<!-- fin des liens hot-spots -->

<br/>

<script type="text/javascript">
//<![CDATA[
//<!--
o_audience();
//-->
//]]>
</script>

<div id='o_footer'>
<script type='text/javascript'>
//<![CDATA[
//<!--
o_footer('type=footer');
//-->
//]]>
</script>
</div>
</body>
</html>

' on line #1
Script completed at 08:07:28.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:09:11, on 16/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ESET\nod32kui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: (no name) - {A4F64D63-3576-4754-8DD5-4D0A49345FD5} - (no file) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: app_filter - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
0
Réponse 49 / 59
romanza Messages postés 263 Statut Membre 2
 
J'ai ça :

Résultat clean txt :

Veuillez svp envoyer le fichier C:\upload_moi_AMD64.tar.gz a l'adresse http://upload.malekal.com
Veuillez svp envoyer le fichier C:\upload_moi_AMD64.tar.gz a l'adresse http://upload.malekal.com

et ça :

Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 16/06/2008 a 22:37:59,29

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32
tentative de suppression de C:\WINDOWS\system32\bdod.bin
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.1"

*** Suppression des fichiers dans C:\Program Files
tentative de suppression de "C:\Program Files\Fichiers communs\Totem Shared\"

*** Suppression des clefs du registre effectuee..
0
Réponse 50 / 59
romanza Messages postés 263 Statut Membre 2
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:05:52, on 17/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: (no name) - {A4F64D63-3576-4754-8DD5-4D0A49345FD5} - (no file) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: app_filter - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
0
Réponse 51 / 59
romanza Messages postés 263 Statut Membre 2
 
Voilà :

[b]SDFix: Version 1.194 [/b]
Run by PASCAL on 17/06/2008 at 20:43

Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\PASCAL\Bureau\UTILIT~1\SDFix\SDFix

[b]Checking Services [/b]:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

[b]Checking Files [/b]:

Trojan Files Found:

C:\279374~1 - Deleted

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 21:30:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:40,7c,0a,f2,02,3e,1d,de,ce,61,7c,1d,d4,91,6e,f3,8e,64,8b,83,c9,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:40,7c,0a,f2,02,3e,1d,de,ce,61,7c,1d,d4,91,6e,f3,8e,64,8b,83,c9,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\romanzab\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Program Files\\Radio Fr Solo\\Radio_Fr_Solo.exe"="C:\\Program Files\\Radio Fr Solo\\Radio_Fr_Solo.exe:*:Enabled:Radio Fr Solo"
"C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-vga.exe"="C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-vga.exe:*:Disabled:Menu"
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\day of defeat\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\romanzab\\day of defeat\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\opposing force\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\romanzab\\opposing force\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"="C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe:*:Enabled:Nero Home"
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\deathmatch classic\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\romanzab\\deathmatch classic\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\team fortress classic\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\romanzab\\team fortress classic\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Google\\Google Earth Pro\\GoogleEarth.exe"="C:\\Program Files\\Google\\Google Earth Pro\\GoogleEarth.exe:*:Enabled:Google Earth Pro"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\half-life\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\romanzab\\half-life\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\ricochet\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\romanzab\\ricochet\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\valve test app 1003\\Rag_Doll_Kung_Fu_Steam.exe"="C:\\Program Files\\Steam\\SteamApps\\romanzab\\valve test app 1003\\Rag_Doll_Kung_Fu_Steam.exe:*:Enabled:Rag_Doll_Kung_Fu_Steam"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\WM Recorder 10.2\\WMR.exe"="C:\\Program Files\\WM Recorder 10.2\\WMR.exe:*:Enabled:WM Recorder 10.2"
"C:\\Program Files\\Steam\\SteamApps\\romanzab\\dedicated server\\hlds.exe"="C:\\Program Files\\Steam\\SteamApps\\romanzab\\dedicated server\\hlds.exe:*:Enabled:HLDS Launcher"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\PROGRA~1\\Livecom\\APPLIC~1\\Exe\\Livecom.exe"="C:\\PROGRA~1\\Livecom\\APPLIC~1\\Exe\\Livecom.exe:*:Enabled:Livecom"
"C:\\PROGRA~1\\Livecom\\APPLIC~1\\Exe\\..\\EconfV4\\ftplayer.exe"="C:\\PROGRA~1\\Livecom\\APPLIC~1\\Exe\\..\\EconfV4\\ftplayer.exe:*:Enabled:Livecom Media"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:

File Backups: - C:\DOCUME~1\PASCAL\Bureau\UTILIT~1\SDFix\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Sun 10 Dec 2006 56 ..SHR --- "C:\WINDOWS\system32\18D9FD8534.sys"
Thu 5 Aug 2004 65,024 A.SH. --- "C:\WINDOWS\system32\asycfilt.dll"
Thu 14 Jul 2005 27,648 A.SH. --- "C:\WINDOWS\system32\AVSredirect.dll"
Fri 25 Aug 2006 617,472 A.SH. --- "C:\WINDOWS\system32\comctl32.dll"
Mon 27 Jun 2005 616,448 A.SHR --- "C:\WINDOWS\system32\cygwin1.dll"
Thu 5 Aug 2004 4,656 A.SH. --- "C:\WINDOWS\system32\ds16gt.dLL"
Thu 5 Aug 2004 16,384 A.SH. --- "C:\WINDOWS\system32\ds32gt.dll"
Thu 5 Aug 2004 380,957 A.SH. --- "C:\WINDOWS\system32\expsrv.dll"
Sun 10 Dec 2006 11,270 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Thu 5 Aug 2004 1,028,096 A.SH. --- "C:\WINDOWS\system32\mfc42.dll"
Thu 5 Aug 2004 57,344 A.SH. --- "C:\WINDOWS\system32\mfc42loc.dll"
Wed 5 May 1999 1,056,768 A.SH. --- "C:\WINDOWS\system32\msjet35.dll"
Mon 13 Dec 1999 163,840 A.SH. --- "C:\WINDOWS\system32\msjint35.dll"
Sun 12 Dec 1999 36,864 A.SH. --- "C:\WINDOWS\system32\msjter35.dll"
Thu 5 Aug 2004 54,784 A.SH. --- "C:\WINDOWS\system32\msvcirt.dll"
Thu 5 Aug 2004 413,696 A.SH. --- "C:\WINDOWS\system32\msvcp60.dll"
Thu 5 Aug 2004 343,040 A.SH. --- "C:\WINDOWS\system32\msvcrt.dll"
Thu 5 Aug 2004 253,952 A.SH. --- "C:\WINDOWS\system32\msvcrt20.dll"
Thu 5 Aug 2004 61,440 A.SH. --- "C:\WINDOWS\system32\msvcrt40.dll"
Thu 5 Aug 2004 20,480 A.SH. --- "C:\WINDOWS\system32\mtxdm.dll"
Thu 5 Aug 2004 26,224 A.SH. --- "C:\WINDOWS\system32\odbc16gt.dll"
Thu 5 Aug 2004 249,856 A.SH. --- "C:\WINDOWS\system32\odbc32.dll"
Thu 5 Aug 2004 16,384 A.SH. --- "C:\WINDOWS\system32\odbc32gt.dll"
Thu 5 Aug 2004 32,768 A.SH. --- "C:\WINDOWS\system32\odbcad32.exe"
Thu 5 Aug 2004 69,632 A.SH. --- "C:\WINDOWS\system32\odbcconf.exe"
Thu 5 Aug 2004 106,496 A.SH. --- "C:\WINDOWS\system32\odbccp32.dll"
Thu 5 Aug 2004 65,536 A.SH. --- "C:\WINDOWS\system32\odbccr32.dll"
Thu 5 Aug 2004 65,536 A.SH. --- "C:\WINDOWS\system32\odbccu32.dll"
Thu 5 Aug 2004 98,304 A.SH. --- "C:\WINDOWS\system32\odbcint.dll"
Thu 5 Aug 2004 61,712 A.SH. --- "C:\WINDOWS\system32\odbcji32.dll"
Thu 5 Aug 2004 278,559 A.SH. --- "C:\WINDOWS\system32\odbcjt32.dll"
Thu 5 Aug 2004 147,456 A.SH. --- "C:\WINDOWS\system32\odbctrac.dll"
Thu 5 Aug 2004 20,511 A.SH. --- "C:\WINDOWS\system32\oddbse32.dll"
Thu 5 Aug 2004 20,510 A.SH. --- "C:\WINDOWS\system32\odexl32.dll"
Thu 5 Aug 2004 20,510 A.SH. --- "C:\WINDOWS\system32\odfox32.dll"
Thu 5 Aug 2004 20,510 A.SH. --- "C:\WINDOWS\system32\odpdx32.dll"
Thu 5 Aug 2004 20,511 A.SH. --- "C:\WINDOWS\system32\odtext32.dll"
Tue 4 Dec 2007 550,912 A.SH. --- "C:\WINDOWS\system32\oleaut32.dll"
Thu 5 Aug 2004 83,456 A.SH. --- "C:\WINDOWS\system32\olepro32.dll"
Thu 5 Aug 2004 30,749 A.SH. --- "C:\WINDOWS\system32\vbajet32.dll"
Sat 5 Nov 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 15 Dec 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 5 Aug 2004 4,096 A.SH. --- "C:\Program Files\Fichiers communs\System\Ole DB\msdadc.dll"
Thu 5 Aug 2004 4,096 A.SH. --- "C:\Program Files\Fichiers communs\System\Ole DB\msdaenum.dll"
Thu 5 Aug 2004 4,096 A.SH. --- "C:\Program Files\Fichiers communs\System\Ole DB\msdaer.dll"
Thu 5 Aug 2004 77,824 A.SH. --- "C:\Program Files\Fichiers communs\System\Ole DB\msdaosp.dll"
Thu 5 Aug 2004 204,800 A.SH. --- "C:\Program Files\Fichiers communs\System\Ole DB\msdaps.dll"
Thu 5 Aug 2004 4,096 A.SH. --- "C:\Program Files\Fichiers communs\System\Ole DB\msdasc.dll"
Thu 5 Aug 2004 315,392 A.SH. --- "C:\Program Files\Fichiers communs\System\Ole DB\msdasql.dll"
Thu 5 Aug 2004 16,384 A.SH. --- "C:\Program Files\Fichiers communs\System\Ole DB\msdasqlr.dll"
Thu 5 Aug 2004 20,480 A.SH. --- "C:\Program Files\Fichiers communs\System\Ole DB\msdatt.dll"
Thu 5 Aug 2004 487,424 A.SH. --- "C:\Program Files\Fichiers communs\System\Ole DB\oledb32.dll"
Thu 5 Aug 2004 77,824 A.SH. --- "C:\Program Files\Fichiers communs\System\Ole DB\oledb32r.dll"
Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\BIT2.tmp"
Thu 27 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\564b04e92fc8ec04ae348b95987245f2\BIT338.tmp"
Thu 27 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6b636582f273e0b4cae6f62415c52d81\BIT339.tmp"
Thu 27 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ab59ac72525ea90a47679441587835c9\BIT337.tmp"

[b]Finished![/b]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:38:55, on 17/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: (no name) - {A4F64D63-3576-4754-8DD5-4D0A49345FD5} - (no file) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: app_filter - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
0
Réponse 52 / 59
romanza Messages postés 263 Statut Membre 2
 
Voilà :

C:\PROGRA~1\Crawler\Toolbar\ctbr.dll unregistered successfully.
C:\PROGRA~1\Crawler\Toolbar\ctbr.dll moved successfully.
Folder move failed. C:\PROGRA~1\Crawler\Toolbar\WSGData\domains scheduled to be moved on reboot.
Folder move failed. C:\PROGRA~1\Crawler\Toolbar\WSGData scheduled to be moved on reboot.
C:\PROGRA~1\Crawler\Toolbar\Update moved successfully.
C:\PROGRA~1\Crawler\Toolbar\TempDir moved successfully.
C:\PROGRA~1\Crawler\Toolbar\TBR5LanguageAct moved successfully.
C:\PROGRA~1\Crawler\Toolbar\STWSGLanguageAct moved successfully.
C:\PROGRA~1\Crawler\Toolbar\Languages moved successfully.
C:\PROGRA~1\Crawler\Toolbar\firefox\components moved successfully.
Folder move failed. C:\PROGRA~1\Crawler\Toolbar\firefox\chrome scheduled to be moved on reboot.
Folder move failed. C:\PROGRA~1\Crawler\Toolbar\firefox scheduled to be moved on reboot.
Folder move failed. C:\PROGRA~1\Crawler\Toolbar scheduled to be moved on reboot.
C:\PROGRA~1\Crawler\Download moved successfully.
Folder move failed. C:\PROGRA~1\Crawler scheduled to be moved on reboot.

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06192008_195757

Files moved on Reboot...
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains moved successfully.
C:\PROGRA~1\Crawler\Toolbar\WSGData moved successfully.
C:\PROGRA~1\Crawler\Toolbar\firefox\chrome moved successfully.
C:\PROGRA~1\Crawler\Toolbar\firefox moved successfully.
C:\PROGRA~1\Crawler\Toolbar moved successfully.
C:\PROGRA~1\Crawler moved successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:06:49, on 19/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\notepad.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: (no name) - {A4F64D63-3576-4754-8DD5-4D0A49345FD5} - (no file) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: app_filter - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
0
Réponse 53 / 59
romanza Messages postés 263 Statut Membre 2
 
Voilà :

J'ai supprimé Boonty qui était sur c/Pfiles/Boonty

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:51:29, on 19/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: (no name) - {A4F64D63-3576-4754-8DD5-4D0A49345FD5} - (no file) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scan8/oscan8.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: app_filter - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
0
Réponse 54 / 59
romanza Messages postés 263 Statut Membre 2
 
Voilà :

Fichier NVRTClk.exe reçu le 2008.06.20 20:32:07 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 0/33 (0%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 39 et 56 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.6.19.0 2008.06.20 -
AntiVir 7.8.0.59 2008.06.20 -
Authentium 5.1.0.4 2008.06.20 -
Avast 4.8.1195.0 2008.06.20 -
AVG 7.5.0.516 2008.06.20 -
BitDefender 7.2 2008.06.20 -
CAT-QuickHeal 9.50 2008.06.20 -
ClamAV 0.93.1 2008.06.20 -
DrWeb 4.44.0.09170 2008.06.20 -
eSafe 7.0.15.0 2008.06.19 -
eTrust-Vet 31.6.5890 2008.06.20 -
Ewido 4.0 2008.06.20 -
F-Prot 4.4.4.56 2008.06.19 -
F-Secure 7.60.13501.0 2008.06.20 -
Fortinet 3.14.0.0 2008.06.20 -
GData 2.0.7306.1023 2008.06.20 -
Ikarus T3.1.1.26.0 2008.06.20 -
Kaspersky 7.0.0.125 2008.06.20 -
McAfee 5322 2008.06.20 -
Microsoft 1.3604 2008.06.20 -
NOD32v2 3204 2008.06.20 -
Norman 5.80.02 2008.06.20 -
Panda 9.0.0.4 2008.06.20 -
Prevx1 V2 2008.06.20 -
Rising 20.49.42.00 2008.06.20 -
Sophos 4.30.0 2008.06.20 -
Sunbelt 3.0.1153.1 2008.06.15 -
Symantec 10 2008.06.20 -
TheHacker 6.2.92.355 2008.06.19 -
TrendMicro 8.700.0.1004 2008.06.20 -
VBA32 3.12.6.7 2008.06.19 -
VirusBuster 4.3.26:9 2008.06.12 -
Webwasher-Gateway 6.6.2 2008.06.20 -
Information additionnelle
File size: 24576 bytes
MD5...: c0547b578e7d4e413f1170ad00cd8e13
SHA1..: 487ca40c96c4907fd384894c64daf2cb7910eb83
SHA256: f90a269c6103c8cc9e9c889488a8f983cb76828e61415c327e3fdcc406adf52f
SHA512: bf72d8599c400ac21f4e674ba05ae80daafec1649e06b30526a1033592798464
575bf70c1bf09ddc122d26af657f306e2082a22c35b6b8587d5b30177472bed4
PEiD..: Armadillo v1.71
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401ef0
timedatestamp.....: 0x3ff148f6 (Tue Dec 30 09:44:22 2003)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x10f2 0x2000 3.81 df40d6315f4ca66ee10331f578e7ea17
.rdata 0x3000 0xa64 0x1000 3.77 53e6f9c54026f7268a239074b04262b3
.data 0x4000 0x478 0x1000 1.55 00dac900c49df6a35b5388e7932d9f99
.rsrc 0x5000 0xb48 0x1000 2.54 7a3f3a925c22088668ea9967158a3956

( 5 imports )
> MFC42.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> MSVCRT.dll: _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, _controlfp, _acmdln, __getmainargs, _setmbcp, printf, exit, sprintf, strncmp, _onexit, _exit, __CxxFrameHandler, _XcptFilter, __dllonexit
> KERNEL32.dll: Sleep, GetProcAddress, FreeLibrary, DeviceIoControl, GetLastError, CreateFileA, CopyFileA, GetSystemDirectoryA, GetVersionExA, GetModuleHandleA, GetStartupInfoA, LoadLibraryA
> USER32.dll: IsIconic, EnableWindow, MessageBoxA, GetClientRect, DrawIcon, SendMessageA, GetSystemMetrics
> ADVAPI32.dll: CloseServiceHandle, RegCloseKey, RegSetValueExA, RegDeleteValueA, RegCreateKeyExA, CreateServiceA, OpenServiceA, OpenSCManagerA, StartServiceA, ControlService

( 0 exports )
0
Réponse 55 / 59
romanza Messages postés 263 Statut Membre 2
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:02:19, on 20/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {A4F64D63-3576-4754-8DD5-4D0A49345FD5} - (no file) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scan8/oscan8.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: app_filter - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
0
Réponse 56 / 59
romanza Messages postés 263 Statut Membre 2
 
Un grand merci sKe69, tu t'es baladé.

En défense j'ai nod32 et Zone alarme, est-ce suffisant?

Est-ce que nod32 tope bien les virus?

Que me conseilles tu comme protocole pour bien scanner mon PC et savoir quand demander de l'aide sur le forum?
0
Réponse 57 / 59
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
En défense j'ai nod32 et Zone alarme, est-ce suffisant? ---> c'est bien , reste plus qu'a fair attention où tu
surf et où tu click ;)

Que me conseilles tu comme protocole pour bien scanner mon PC ---> que ton anti virus soit bien à jours, et scanner ton PC tous les 7/10 jours en mode sans échec pour plus d'efficacité ...

savoir quand demander de l'aide sur le forum? ---> j'espère pour toi que cela ne se reproduira pas :)))

Sinon voilà pour la suite :

A-Télécharges ToolsCleaner (de A.Rothstein) sur ton Bureau.
http://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe

Lances le .
Cliques sur Recherche et laisses le scan se terminer (cela peut être long).
Cliques sur Suppression pour finaliser.
Tu peux, si tu le souhaites, te servir des Options facultatives

Ce petit soft va te nettoyer tout les trucs dont on c'est servi pour la désinfection ( tu n'en as plus besion ! ) .
Supprimes tout les outils , dossiers ou rapports consernant la désinfection que Toolsclaener2 n'a pas supprimé .

Puis enfin supprimes Toolscleaner2 ... ( gardes CCleaner et Malwarebytes : très utiles ! )

B-refais un coup de CCleaner ( registre compris )

C- un chekcup s'impose ( étape 1 à faire de suite !) :

1-Restauration système
*Désactives ta restauration :
Cliques droit sur poste de travail/propriétés/Restauration système/coche la case désactiver la restauration, appliquer, OK
--->Redémarres ton PC
*Réactives ta restauration :
Cliques droit sur poste de travail/propriétés/Restauration système/décoche la case désactiver la restauration, appliquer, OK
--->Redémarres ton PC

2-Nettoyage et Défragmentation de tes Disques
*Nettoyage :
Clic droit sur "poste de travail" ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Général"
Cliques sur le bouton "nettoyage de disque", OK
tu le fais pour chacun de tes disques

*Vérifications des erreurs :
Clic droit sur "poste de travail" ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Outil"
"Vérifier maintenant", une boîte s'ouvre, cocher les cases :
-réparer automatiquement les erreurs...
-rechercher et tenter une récupération...
--->Démarrer, ok
Note : s'il te dis de redémarrer ton Pc pour le faire , tu redémarres et tu laisses faire, cela prend un peu de temps c'est normal
tu le fais pour chacun de tes disques

ensuite toujours dans le même onglet tu choisis :
*Défragmentation :
"défragmenter maintenant", OK
une boîte s'ouvre, tu sélectionnes le disque à défragmenter, et tu cliques sur "analyser", puis après l'analyse, "défragmenter" . OK
tu le fais pour chacun de tes disques

Voilààà ... Une fois cela fais dis moi ce que tu en penses ;)
0
Réponse 58 / 59
romanza Messages postés 263 Statut Membre 2
 
Tout est OK.

Merci encore
0
Réponse 59 / 59
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Salut,
prb résolu donc ^^

Bonne continuation à toi

A++
0

Discussions similaires

Comment taper l'arobase sur un pc hp ?
kadem -
Parys -

6 réponses
Impossible de taper mon code confidentiel au démarrage windows 10
JoelleB54 -
e.d -

5 réponses
~comment ecrire arobase clavier hp
pecos -
Philippe5998 -

9 réponses
Comment faire arobase sur mon hp
Arobase -
Ossi -

3 réponses
Comment faire pour débloquer mon clavier d'ordinateur ?
nase -
Elisa. -

21 réponses