Aide please virus avec plein de pub
franckydegun
Messages postés
11
Statut
Membre
-
Destrio5 Messages postés 99820 Statut Modérateur -
Destrio5 Messages postés 99820 Statut Modérateur -
Bonjour,
Si vous pouvez m'aider vraiment j'en serai reconnaissant.
Voici mon problème, j'ai des fenêtres de pub qui s'ouvrent quand je suis sur le net et qui ralentissent ma connection.
Voici toutes les infos...
Que puis je faire ?
Logfile of HijackThis v1.99.1
Scan saved at 23:44:56, on 25/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Emmanuel\Bureau\Scanner.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {66AF7728-4CBE-4C32-B633-E5CE48B23DA2} - C:\WINDOWS\system32\rhxtvoxe.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {8689FC95-FB98-4737-A000-39A30EF6CAB3} - C:\WINDOWS\system32\rhxtvoxe.dll
O2 - BHO: (no name) - {8A98733F-F4D4-4BAE-A5F8-7A23665F6BAC} - C:\WINDOWS\system32\rqRHwVnm.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {907248E1-2AD0-4AC5-9193-27BE40735236} - C:\Documents and Settings\Emmanuel\Local Settings\Temporary Internet Files\Content.IE5\YCSW8TIL\3077ahntdksr[1].dll
O2 - BHO: {62032114-bff9-4f49-b4c4-7c93c55d5d5a} - {a5d5d55c-39c7-4c4b-94f4-9ffb41123026} - C:\WINDOWS\system32\phgwhu.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [58fc5976] rundll32.exe "C:\WINDOWS\system32\lnpagtax.dll",b
O4 - HKLM\..\Run: [BM5bcf6aea] Rundll32.exe "C:\WINDOWS\system32\wuwqygtg.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.8.3.35/mahjong/mahjong-fr_FR.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/2.0.1.13/cfweb_activex.camfrogweb.com-advanced-2.0.1.13_instmodule.exe
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - https://webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - https://webshots.com/weekly
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f004.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4682/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
Si vous pouvez m'aider vraiment j'en serai reconnaissant.
Voici mon problème, j'ai des fenêtres de pub qui s'ouvrent quand je suis sur le net et qui ralentissent ma connection.
Voici toutes les infos...
Que puis je faire ?
Logfile of HijackThis v1.99.1
Scan saved at 23:44:56, on 25/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Emmanuel\Bureau\Scanner.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {66AF7728-4CBE-4C32-B633-E5CE48B23DA2} - C:\WINDOWS\system32\rhxtvoxe.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {8689FC95-FB98-4737-A000-39A30EF6CAB3} - C:\WINDOWS\system32\rhxtvoxe.dll
O2 - BHO: (no name) - {8A98733F-F4D4-4BAE-A5F8-7A23665F6BAC} - C:\WINDOWS\system32\rqRHwVnm.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {907248E1-2AD0-4AC5-9193-27BE40735236} - C:\Documents and Settings\Emmanuel\Local Settings\Temporary Internet Files\Content.IE5\YCSW8TIL\3077ahntdksr[1].dll
O2 - BHO: {62032114-bff9-4f49-b4c4-7c93c55d5d5a} - {a5d5d55c-39c7-4c4b-94f4-9ffb41123026} - C:\WINDOWS\system32\phgwhu.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [58fc5976] rundll32.exe "C:\WINDOWS\system32\lnpagtax.dll",b
O4 - HKLM\..\Run: [BM5bcf6aea] Rundll32.exe "C:\WINDOWS\system32\wuwqygtg.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.8.3.35/mahjong/mahjong-fr_FR.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/2.0.1.13/cfweb_activex.camfrogweb.com-advanced-2.0.1.13_instmodule.exe
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - https://webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - https://webshots.com/weekly
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f004.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4682/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
A voir également:
- Aide please virus avec plein de pub
- Bloqueur de pub youtube - Accueil - Streaming
- Virus mcafee - Accueil - Piratage
- Stop pub gratuit - Télécharger - Divers Utilitaires
- Supprimer la pub - Guide
- Virus facebook demande d'amis - Accueil - Facebook
20 réponses
Salut,
---> Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)
---> Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)
Bonjour,
Télécharge VirtumundoBegone sur le bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
Double clique sur VirtumundoBeGone.exe et suis les instructions.
Une fois terminé, redémarre l’ordinateur .
Copie/colle le contenu du rapport VBG.TXT créé sur le bureau
A+
Télécharge VirtumundoBegone sur le bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
Double clique sur VirtumundoBeGone.exe et suis les instructions.
Une fois terminé, redémarre l’ordinateur .
Copie/colle le contenu du rapport VBG.TXT créé sur le bureau
A+
voici le rapport et merci pour l'aide
[07/26/2008, 0:12:07] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Emmanuel\Local Settings\Temporary Internet Files\Content.IE5\YCSW8TIL\VirtumundoBeGone[1].exe" )
[07/26/2008, 0:12:11] - Detected System Information:
[07/26/2008, 0:12:11] - Windows Version: 5.1.2600, Service Pack 2
[07/26/2008, 0:12:11] - Current Username: Emmanuel (Admin)
[07/26/2008, 0:12:11] - Windows is in NORMAL mode.
[07/26/2008, 0:12:11] - Searching for Browser Helper Objects:
[07/26/2008, 0:12:11] - BHO 1: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} ()
[07/26/2008, 0:12:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\NppBho
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\NppBho, continuing.
[07/26/2008, 0:12:12] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[07/26/2008, 0:12:12] - BHO 3: {66AF7728-4CBE-4C32-B633-E5CE48B23DA2} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rhxtvoxe
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rhxtvoxe, continuing.
[07/26/2008, 0:12:12] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/26/2008, 0:12:12] - BHO 5: {8689FC95-FB98-4737-A000-39A30EF6CAB3} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rhxtvoxe
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rhxtvoxe, continuing.
[07/26/2008, 0:12:12] - BHO 6: {8A98733F-F4D4-4BAE-A5F8-7A23665F6BAC} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rqRHwVnm
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rqRHwVnm, continuing.
[07/26/2008, 0:12:12] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[07/26/2008, 0:12:12] - BHO 8: {907248E1-2AD0-4AC5-9193-27BE40735236} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\3077ahntdksr[1]
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\3077ahntdksr[1], continuing.
[07/26/2008, 0:12:12] - BHO 9: {a5d5d55c-39c7-4c4b-94f4-9ffb41123026} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\phgwhu
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\phgwhu, continuing.
[07/26/2008, 0:12:13] - Finished Searching Browser Helper Objects
[07/26/2008, 0:12:13] - Finishing up...
[07/26/2008, 0:12:13] - Nothing found! Exiting...
[07/26/2008, 0:12:07] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Emmanuel\Local Settings\Temporary Internet Files\Content.IE5\YCSW8TIL\VirtumundoBeGone[1].exe" )
[07/26/2008, 0:12:11] - Detected System Information:
[07/26/2008, 0:12:11] - Windows Version: 5.1.2600, Service Pack 2
[07/26/2008, 0:12:11] - Current Username: Emmanuel (Admin)
[07/26/2008, 0:12:11] - Windows is in NORMAL mode.
[07/26/2008, 0:12:11] - Searching for Browser Helper Objects:
[07/26/2008, 0:12:11] - BHO 1: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} ()
[07/26/2008, 0:12:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\NppBho
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\NppBho, continuing.
[07/26/2008, 0:12:12] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[07/26/2008, 0:12:12] - BHO 3: {66AF7728-4CBE-4C32-B633-E5CE48B23DA2} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rhxtvoxe
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rhxtvoxe, continuing.
[07/26/2008, 0:12:12] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/26/2008, 0:12:12] - BHO 5: {8689FC95-FB98-4737-A000-39A30EF6CAB3} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rhxtvoxe
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rhxtvoxe, continuing.
[07/26/2008, 0:12:12] - BHO 6: {8A98733F-F4D4-4BAE-A5F8-7A23665F6BAC} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rqRHwVnm
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rqRHwVnm, continuing.
[07/26/2008, 0:12:12] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[07/26/2008, 0:12:12] - BHO 8: {907248E1-2AD0-4AC5-9193-27BE40735236} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\3077ahntdksr[1]
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\3077ahntdksr[1], continuing.
[07/26/2008, 0:12:12] - BHO 9: {a5d5d55c-39c7-4c4b-94f4-9ffb41123026} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\phgwhu
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\phgwhu, continuing.
[07/26/2008, 0:12:13] - Finished Searching Browser Helper Objects
[07/26/2008, 0:12:13] - Finishing up...
[07/26/2008, 0:12:13] - Nothing found! Exiting...
Relance ToolBar S&D, fais l'option 2 et poste le rapport.
Merci encore, voici ce que tu m'as demandé... c'est grave ?
@ + :-)
-----------\\ ToolBar S&D 1.0.7 XP/Vista
[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : Emmanuel ] [ "C:\Toolbar SD" ] [ Selection : 2 ]
[ 26/07/2008 | 6:50:32,95 ] [ PC : SN400703200002 ]
[ MAJ : 25-07-2008 | 17:35 ]
-----------\\ SUPPRESSION
Supprime! - C:\Program Files\KaZaA\BGP2P
Supprime! - C:\Program Files\KaZaA\plugins
Supprime! - C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-30EFBC20.pf
Supprime! - C:\DOCUME~1\Emmanuel\APPLIC~1\Search Settings\kb127
Supprime! - C:\DOCUME~1\STPHAN~1\APPLIC~1\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
Supprime! - C:\WINDOWS\iun6002.exe
Supprime! - C:\Program Files\KaZaA
Supprime! - C:\DOCUME~1\Emmanuel\APPLIC~1\Search Settings
Supprime! - C:\DOCUME~1\STPHAN~1\APPLIC~1\Search Settings
Supprime! - C:\Program Files\Search Settings
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="https://actus.sfr.fr"
"Search Bar"="https://actus.sfr.fr"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://actus.sfr.fr"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
-----------\\ Fin du rapport a 6:54:34,62
@ + :-)
-----------\\ ToolBar S&D 1.0.7 XP/Vista
[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : Emmanuel ] [ "C:\Toolbar SD" ] [ Selection : 2 ]
[ 26/07/2008 | 6:50:32,95 ] [ PC : SN400703200002 ]
[ MAJ : 25-07-2008 | 17:35 ]
-----------\\ SUPPRESSION
Supprime! - C:\Program Files\KaZaA\BGP2P
Supprime! - C:\Program Files\KaZaA\plugins
Supprime! - C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-30EFBC20.pf
Supprime! - C:\DOCUME~1\Emmanuel\APPLIC~1\Search Settings\kb127
Supprime! - C:\DOCUME~1\STPHAN~1\APPLIC~1\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
Supprime! - C:\WINDOWS\iun6002.exe
Supprime! - C:\Program Files\KaZaA
Supprime! - C:\DOCUME~1\Emmanuel\APPLIC~1\Search Settings
Supprime! - C:\DOCUME~1\STPHAN~1\APPLIC~1\Search Settings
Supprime! - C:\Program Files\Search Settings
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="https://actus.sfr.fr"
"Search Bar"="https://actus.sfr.fr"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://actus.sfr.fr"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
-----------\\ Fin du rapport a 6:54:34,62
On va s'en sortir.
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Et voilà, encore merci... je croise les doigts
ComboFix 08-07-25.7 - Emmanuel 2008-07-26 16:22:25.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.203 [GMT 2:00]
Endroit: C:\Documents and Settings\Emmanuel\Mes documents\ComboFix.exe
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM5bcf6aea.txt
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\pack.epk
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\agsjatvb.dll
C:\WINDOWS\system32\ajxqhknj.dll
C:\WINDOWS\system32\eknlmxaq.dll
C:\WINDOWS\system32\fdocnb.dll
C:\WINDOWS\system32\iqjomofl.ini
C:\WINDOWS\system32\kpyzfk.dll
C:\WINDOWS\system32\krxfhpnh.dll
C:\WINDOWS\system32\liqcunmt.ini
C:\WINDOWS\system32\lnpagtax.dll
C:\WINDOWS\system32\lsargeym.dll
C:\WINDOWS\system32\lsrrwiar.dll
C:\WINDOWS\system32\MabryObj.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mnVwHRqr.ini
C:\WINDOWS\system32\mnVwHRqr.ini2
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\ofpjoojx.dll
C:\WINDOWS\system32\phgwhu.dll
C:\WINDOWS\system32\rhxtvoxe.dll
C:\WINDOWS\system32\rqRHwVnm.dll
C:\WINDOWS\system32\wuwqygtg.dll
C:\WINDOWS\system32\xatgapnl.ini
C:\WINDOWS\system32\xlopcmnu.ini
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-26 to 2008-07-26 ))))))))))))))))))))))))))))))))))))
.
2008-07-26 00:04 . 2008-07-26 06:54 <REP> d-------- C:\Toolbar SD
2008-07-25 19:03 . 2008-07-26 16:20 <REP> d-------- C:\Program Files\Enigma Software Group
2008-07-22 22:42 . 2008-07-26 16:16 111,619 --a------ C:\WINDOWS\BM5bcf6aea.xml
2008-07-11 10:19 . 2008-07-11 10:19 <REP> d-------- C:\tmp
2008-07-11 10:19 . 2008-07-11 10:19 <REP> d-------- C:\Program Files\Nosibay
2008-06-26 14:15 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-06-26 14:15 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-06-26 14:15 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-06-26 09:24 . 2008-06-26 09:25 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-06-26 09:23 . 2008-06-26 09:27 <REP> d-------- C:\Program Files\Windows Live
2008-06-26 09:22 . 2008-06-26 09:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-26 14:30 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-07-26 14:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-07-26 11:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-25 16:29 --------- d-----w C:\Program Files\Java
2008-07-23 21:13 --------- d-----w C:\Documents and Settings\Emmanuel\Application Data\Delivery
2008-07-23 17:24 --------- d-----w C:\Program Files\Spybot - anti espion
2008-07-21 21:03 --------- d-----w C:\Program Files\eMule
2008-06-24 18:52 --------- d-----w C:\Documents and Settings\Emmanuel\Application Data\Canon
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-31 09:59 --------- d-----w C:\Documents and Settings\Emmanuel\Application Data\DivX
2008-05-31 09:43 --------- d-----w C:\Documents and Settings\Emmanuel\Application Data\Dr. DivX 2.0 OSS
2008-05-31 09:34 --------- d-----w C:\Program Files\DivX
2008-05-29 18:57 --------- d-----w C:\Program Files\Free Video Converter
2008-05-29 17:45 --------- d-----w C:\Documents and Settings\Emmanuel\Application Data\Media Player Classic
2008-05-29 17:36 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2008-05-29 17:36 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-09-29 17:50 87,608 ----a-w C:\Documents and Settings\Emmanuel\Application Data\inst.exe
2007-09-29 17:50 47,360 ----a-w C:\Documents and Settings\Emmanuel\Application Data\pcouffin.sys
2007-02-03 08:06 87,608 ----a-w C:\Documents and Settings\Emmanuel\Application Data\ezpinst.exe
2006-08-10 11:15 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2006-03-30 14:47 81,352 ----a-w C:\Documents and Settings\Emmanuel\Application Data\GDIPFONTCACHEV1.DAT
2002-09-30 10:52 4,107 --sha-w C:\WINDOWS\rreg32.dll
2002-09-30 10:52 1,209 --sha-w C:\WINDOWS\utapi32.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-07-28 15:21 139264]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-01-09 23:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 01:11 771704]
"Symantec PIF AlertEng"="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22 517768]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [2004-06-11 06:48 286720]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv32"= C:\WINDOWS\system32\ir32_32.dll
"vidc.iv31"= C:\WINDOWS\system32\ir32_32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4013:TCP"= 4013:TCP:ppLive
"6175:UDP"= 6175:UDP:ppLive
R1 vcsmpdrv;vcsmpdrv;C:\WINDOWS\system32\DRIVERS\vcsmpdrv.sys [2002-06-07 12:38]
R2 VCSSecS;Virtual CD v4 Security service (SDK - Version);C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe [2002-05-16 12:17]
R3 DDPlayCam;DDPlay Virtual Camera;C:\WINDOWS\system32\DRIVERS\DDPlayCam.sys [2005-10-27 08:01]
R3 STAC97NA;SigmaTel 3D Environmental Audio;C:\WINDOWS\system32\drivers\stac97na.sys [2002-09-20 18:42]
R3 STAC97NH;STAC97NH;C:\WINDOWS\system32\drivers\stac97nh.sys [2002-09-20 18:43]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]
S3 alcan5ln;SpeedTouch(tm) USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys [2003-12-08 12:53]
S3 ATWPKT;ATWPKT;C:\WINDOWS\system32\Drivers\ATWPKT.SYS [2002-05-10 13:50]
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 19:08]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 19:11]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 19:11]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 19:13]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 19:15]
S3 NetMate;CATC USB/Ethernet Link device driver;C:\WINDOWS\system32\DRIVERS\netmate2.sys [2000-04-25 12:01]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 03:13]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2006-10-30 13:46]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 07:58]
S3 wg121;NETGEAR WG121 802.11g Wireless USB2.0 Adapter;C:\WINDOWS\system32\DRIVERS\wg121nd5.sys []
*Newly Created Service* - COMHOST
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
.
- - - - ORPHANS REMOVED - - - -
BHO-{EE49B8B5-188A-4030-A9A1-FD9D6B3C01F9} - C:\Documents and Settings\Emmanuel\Local Settings\Temporary Internet Files\Content.IE5\G8Q0B3RV\3077ahntdksr[1].dll
HKLM-Run-58fc5976 - C:\WINDOWS\system32\lnpagtax.dll
HKLM-Run-BM5bcf6aea - C:\WINDOWS\system32\wuwqygtg.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.lequipe.fr/
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
O8 -: &Recherche AOL Toolbar - C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 -: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O16 -: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd
O16 -: Mah Jong Garden by pogo - hxxp://game1.pogo.com/applet-6.8.3.35/mahjong/mahjong-fr_FR.cab
C:\WINDOWS\Downloaded Program Files\Mah Jong Garden by pogo.osd
O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/2.0.1.13/cfweb_activex.camfrogweb.com-advanced-2.0.1.13_instmodule.exe
O16 -: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} - hxxp://techcity.aol.fr/download/img/DiagSetup.cab
C:\WINDOWS\Downloaded Program Files\AOLWebInstall.inf
C:\WINDOWS\AOLSetup.dat
C:\WINDOWS\Downloaded Program Files\AOLWebInstall.dll
O16 -: {C36112BF-2FA3-4694-8603-3B510EA3B465} - hxxp://f004.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
C:\WINDOWS\Downloaded Program Files\FileUploader.inf
C:\WINDOWS\Downloaded Program Files\FileUploader.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-26 16:30:56
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-26 16:40:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-26 14:39:55
Pre-Run: 21,532,987,392 octets libres
Post-Run: 21,890,240,512 octets libres
192 --- E O F --- 2008-07-09 16:02:34
ComboFix 08-07-25.7 - Emmanuel 2008-07-26 16:22:25.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.203 [GMT 2:00]
Endroit: C:\Documents and Settings\Emmanuel\Mes documents\ComboFix.exe
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM5bcf6aea.txt
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\pack.epk
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\agsjatvb.dll
C:\WINDOWS\system32\ajxqhknj.dll
C:\WINDOWS\system32\eknlmxaq.dll
C:\WINDOWS\system32\fdocnb.dll
C:\WINDOWS\system32\iqjomofl.ini
C:\WINDOWS\system32\kpyzfk.dll
C:\WINDOWS\system32\krxfhpnh.dll
C:\WINDOWS\system32\liqcunmt.ini
C:\WINDOWS\system32\lnpagtax.dll
C:\WINDOWS\system32\lsargeym.dll
C:\WINDOWS\system32\lsrrwiar.dll
C:\WINDOWS\system32\MabryObj.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mnVwHRqr.ini
C:\WINDOWS\system32\mnVwHRqr.ini2
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\ofpjoojx.dll
C:\WINDOWS\system32\phgwhu.dll
C:\WINDOWS\system32\rhxtvoxe.dll
C:\WINDOWS\system32\rqRHwVnm.dll
C:\WINDOWS\system32\wuwqygtg.dll
C:\WINDOWS\system32\xatgapnl.ini
C:\WINDOWS\system32\xlopcmnu.ini
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-26 to 2008-07-26 ))))))))))))))))))))))))))))))))))))
.
2008-07-26 00:04 . 2008-07-26 06:54 <REP> d-------- C:\Toolbar SD
2008-07-25 19:03 . 2008-07-26 16:20 <REP> d-------- C:\Program Files\Enigma Software Group
2008-07-22 22:42 . 2008-07-26 16:16 111,619 --a------ C:\WINDOWS\BM5bcf6aea.xml
2008-07-11 10:19 . 2008-07-11 10:19 <REP> d-------- C:\tmp
2008-07-11 10:19 . 2008-07-11 10:19 <REP> d-------- C:\Program Files\Nosibay
2008-06-26 14:15 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-06-26 14:15 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-06-26 14:15 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-06-26 09:24 . 2008-06-26 09:25 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-06-26 09:23 . 2008-06-26 09:27 <REP> d-------- C:\Program Files\Windows Live
2008-06-26 09:22 . 2008-06-26 09:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-26 14:30 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-07-26 14:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-07-26 11:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-25 16:29 --------- d-----w C:\Program Files\Java
2008-07-23 21:13 --------- d-----w C:\Documents and Settings\Emmanuel\Application Data\Delivery
2008-07-23 17:24 --------- d-----w C:\Program Files\Spybot - anti espion
2008-07-21 21:03 --------- d-----w C:\Program Files\eMule
2008-06-24 18:52 --------- d-----w C:\Documents and Settings\Emmanuel\Application Data\Canon
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-31 09:59 --------- d-----w C:\Documents and Settings\Emmanuel\Application Data\DivX
2008-05-31 09:43 --------- d-----w C:\Documents and Settings\Emmanuel\Application Data\Dr. DivX 2.0 OSS
2008-05-31 09:34 --------- d-----w C:\Program Files\DivX
2008-05-29 18:57 --------- d-----w C:\Program Files\Free Video Converter
2008-05-29 17:45 --------- d-----w C:\Documents and Settings\Emmanuel\Application Data\Media Player Classic
2008-05-29 17:36 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2008-05-29 17:36 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-09-29 17:50 87,608 ----a-w C:\Documents and Settings\Emmanuel\Application Data\inst.exe
2007-09-29 17:50 47,360 ----a-w C:\Documents and Settings\Emmanuel\Application Data\pcouffin.sys
2007-02-03 08:06 87,608 ----a-w C:\Documents and Settings\Emmanuel\Application Data\ezpinst.exe
2006-08-10 11:15 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2006-03-30 14:47 81,352 ----a-w C:\Documents and Settings\Emmanuel\Application Data\GDIPFONTCACHEV1.DAT
2002-09-30 10:52 4,107 --sha-w C:\WINDOWS\rreg32.dll
2002-09-30 10:52 1,209 --sha-w C:\WINDOWS\utapi32.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-07-28 15:21 139264]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-01-09 23:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 01:11 771704]
"Symantec PIF AlertEng"="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22 517768]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [2004-06-11 06:48 286720]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv32"= C:\WINDOWS\system32\ir32_32.dll
"vidc.iv31"= C:\WINDOWS\system32\ir32_32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4013:TCP"= 4013:TCP:ppLive
"6175:UDP"= 6175:UDP:ppLive
R1 vcsmpdrv;vcsmpdrv;C:\WINDOWS\system32\DRIVERS\vcsmpdrv.sys [2002-06-07 12:38]
R2 VCSSecS;Virtual CD v4 Security service (SDK - Version);C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe [2002-05-16 12:17]
R3 DDPlayCam;DDPlay Virtual Camera;C:\WINDOWS\system32\DRIVERS\DDPlayCam.sys [2005-10-27 08:01]
R3 STAC97NA;SigmaTel 3D Environmental Audio;C:\WINDOWS\system32\drivers\stac97na.sys [2002-09-20 18:42]
R3 STAC97NH;STAC97NH;C:\WINDOWS\system32\drivers\stac97nh.sys [2002-09-20 18:43]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]
S3 alcan5ln;SpeedTouch(tm) USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys [2003-12-08 12:53]
S3 ATWPKT;ATWPKT;C:\WINDOWS\system32\Drivers\ATWPKT.SYS [2002-05-10 13:50]
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-03-04 19:08]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-03-04 19:11]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-03-04 19:11]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-03-04 19:13]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-03-04 19:15]
S3 NetMate;CATC USB/Ethernet Link device driver;C:\WINDOWS\system32\DRIVERS\netmate2.sys [2000-04-25 12:01]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2005-11-19 03:13]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2006-10-30 13:46]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 07:58]
S3 wg121;NETGEAR WG121 802.11g Wireless USB2.0 Adapter;C:\WINDOWS\system32\DRIVERS\wg121nd5.sys []
*Newly Created Service* - COMHOST
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
.
- - - - ORPHANS REMOVED - - - -
BHO-{EE49B8B5-188A-4030-A9A1-FD9D6B3C01F9} - C:\Documents and Settings\Emmanuel\Local Settings\Temporary Internet Files\Content.IE5\G8Q0B3RV\3077ahntdksr[1].dll
HKLM-Run-58fc5976 - C:\WINDOWS\system32\lnpagtax.dll
HKLM-Run-BM5bcf6aea - C:\WINDOWS\system32\wuwqygtg.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.lequipe.fr/
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
O8 -: &Recherche AOL Toolbar - C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 -: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O16 -: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd
O16 -: Mah Jong Garden by pogo - hxxp://game1.pogo.com/applet-6.8.3.35/mahjong/mahjong-fr_FR.cab
C:\WINDOWS\Downloaded Program Files\Mah Jong Garden by pogo.osd
O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/2.0.1.13/cfweb_activex.camfrogweb.com-advanced-2.0.1.13_instmodule.exe
O16 -: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} - hxxp://techcity.aol.fr/download/img/DiagSetup.cab
C:\WINDOWS\Downloaded Program Files\AOLWebInstall.inf
C:\WINDOWS\AOLSetup.dat
C:\WINDOWS\Downloaded Program Files\AOLWebInstall.dll
O16 -: {C36112BF-2FA3-4694-8603-3B510EA3B465} - hxxp://f004.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
C:\WINDOWS\Downloaded Program Files\FileUploader.inf
C:\WINDOWS\Downloaded Program Files\FileUploader.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-26 16:30:56
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-26 16:40:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-26 14:39:55
Pre-Run: 21,532,987,392 octets libres
Post-Run: 21,890,240,512 octets libres
192 --- E O F --- 2008-07-09 16:02:34
Pas mal.
- Télécharge et installe MalwareByte's Anti-Malware :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm
- Mets-le à jour
- Redémarre en mode sans échec (Recommandé) :
https://www.malekal.com/demarrer-windows-mode-sans-echec/
- Choisis ta session habituelle
- Fais un scan complet avec MalwareByte's Anti-Malware
- Supprime tout ce que le logiciel trouve, enregistre le rapport
- Redémarre en mode normal et poste le rapport ici
Tutorial :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
- Télécharge et installe MalwareByte's Anti-Malware :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm
- Mets-le à jour
- Redémarre en mode sans échec (Recommandé) :
https://www.malekal.com/demarrer-windows-mode-sans-echec/
- Choisis ta session habituelle
- Fais un scan complet avec MalwareByte's Anti-Malware
- Supprime tout ce que le logiciel trouve, enregistre le rapport
- Redémarre en mode normal et poste le rapport ici
Tutorial :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Malwarebytes' Anti-Malware 1.23
Version de la base de données: 994
Windows 5.1.2600 Service Pack 2
20:45:43 26/07/2008
mbam-log-7-26-2008 (20-45-43).txt
Type de recherche: Examen complet (C:\|D:\|E:\|I:\|J:\|)
Eléments examinés: 148601
Temps écoulé: 2 hour(s), 18 minute(s), 13 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 27
Salut Desrio, voilà c'est fait :-)
j'attends la suite, bonne soirée, @ + (encore merci, je sais je le dis à chaque fois mais j'y tiens)
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\Temp\{ffdf9b82-c690-42b1-9a0c-345fe967ccc1} (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\agsjatvb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ajxqhknj.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\eknlmxaq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\lnpagtax.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\lsargeym.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\rhxtvoxe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\rqRHwVnm.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\wuwqygtg.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1189\A0159487.vxd (Adware.Winad) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1189\A0159794.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1189\A0159804.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1189\A0159806.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1190\A0159824.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1190\A0159825.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1190\A0159827.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1190\A0159828.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1197\A0161968.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163075.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163076.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163077.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163081.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163082.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163086.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163087.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163088.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM5bcf6aea.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
Version de la base de données: 994
Windows 5.1.2600 Service Pack 2
20:45:43 26/07/2008
mbam-log-7-26-2008 (20-45-43).txt
Type de recherche: Examen complet (C:\|D:\|E:\|I:\|J:\|)
Eléments examinés: 148601
Temps écoulé: 2 hour(s), 18 minute(s), 13 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 27
Salut Desrio, voilà c'est fait :-)
j'attends la suite, bonne soirée, @ + (encore merci, je sais je le dis à chaque fois mais j'y tiens)
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\Temp\{ffdf9b82-c690-42b1-9a0c-345fe967ccc1} (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\agsjatvb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ajxqhknj.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\eknlmxaq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\lnpagtax.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\lsargeym.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\rhxtvoxe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\rqRHwVnm.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\wuwqygtg.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1189\A0159487.vxd (Adware.Winad) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1189\A0159794.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1189\A0159804.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1189\A0159806.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1190\A0159824.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1190\A0159825.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1190\A0159827.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1190\A0159828.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1197\A0161968.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163075.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163076.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163077.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163081.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163082.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163086.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163087.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP1200\A0163088.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM5bcf6aea.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
J'ai déjà tout supprimé dans la 1ère manip.
Dois je néanmoins relancer en mode sans échec et re tout supprimer ?
Merci pour la réponse
Dois je néanmoins relancer en mode sans échec et re tout supprimer ?
Merci pour la réponse
salut,
j'avais effectivement pas supprimé, c'est fait et voici le rapport hijackis
Logfile of HijackThis v1.99.1
Scan saved at 10:02:25, on 27/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\Emmanuel\Bureau\Scanner.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.lequipe.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.8.3.35/mahjong/mahjong-fr_FR.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/2.0.1.13/cfweb_activex.camfrogweb.com-advanced-2.0.1.13_instmodule.exe
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - https://webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - https://webshots.com/weekly
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f004.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4682/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
j'avais effectivement pas supprimé, c'est fait et voici le rapport hijackis
Logfile of HijackThis v1.99.1
Scan saved at 10:02:25, on 27/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\Emmanuel\Bureau\Scanner.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.lequipe.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.8.3.35/mahjong/mahjong-fr_FR.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/2.0.1.13/cfweb_activex.camfrogweb.com-advanced-2.0.1.13_instmodule.exe
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - https://webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - https://webshots.com/weekly
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f004.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4682/mcfscan.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
Tu as Norton Antivirus qui n'est pas très bien. Je te propose de le virer et de mettre un autre antivirus. Le problème, l'autre antivirus est en anglais mais est très simple et très efficace.
Que décides-tu ?
Que décides-tu ?
Tout d'abord merci beaucoup Destrio pour toute ton aide, je pense que j'en suis débarassé :-)
Concernant l'antivirus je ne maitrise pas trop l'anglais et j'ai norton pour 9 mois encore, sans compter que j'ai pris aussi spy hunter pour supprimer les virus et troyens que seul toi m'a permis de me débarasser.
Mais je me permets vraiment d'insister merci d'avoir passer du temps à m'aider.
Pour info quel est le logiciel anti virus dont tu me parles ?
Concernant l'antivirus je ne maitrise pas trop l'anglais et j'ai norton pour 9 mois encore, sans compter que j'ai pris aussi spy hunter pour supprimer les virus et troyens que seul toi m'a permis de me débarasser.
Mais je me permets vraiment d'insister merci d'avoir passer du temps à m'aider.
Pour info quel est le logiciel anti virus dont tu me parles ?
Tout d'abord merci beaucoup Destrio pour toute ton aide, je pense que j'en suis débarassé :-)
Concernant l'antivirus je ne maitrise pas trop l'anglais et j'ai norton pour 9 mois encore, sans compter que j'ai pris aussi spy hunter pour supprimer les virus et troyens que seul toi m'a permis de me débarasser.
Mais je me permets vraiment d'insister merci d'avoir passer du temps à m'aider.
Pour info quel est le logiciel anti virus dont tu me parles ?
Concernant l'antivirus je ne maitrise pas trop l'anglais et j'ai norton pour 9 mois encore, sans compter que j'ai pris aussi spy hunter pour supprimer les virus et troyens que seul toi m'a permis de me débarasser.
Mais je me permets vraiment d'insister merci d'avoir passer du temps à m'aider.
Pour info quel est le logiciel anti virus dont tu me parles ?
Télécharge Tools Cleaner sur ton bureau.
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
Clique sur Recherche et laisse le scan agir.
Clique sur Suppression pour finaliser.
Tu peux, si tu le souhaites, te servir des Options facultatives.
Clique sur Quitter pour obtenir le rapport.
Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download
---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.
---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger :
http://www.infos-du-net.com/forum/272480-11-desactiver-activer-restauration-systeme
---> Je te conseille de créer un point de restauration que tu pourras utiliser plus tard si tu as un problème :
https://www.vulgarisation-informatique.com/creer-point-restauration.php
---> L'antivirus que je te propose s'appelle Antivir.
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
Clique sur Recherche et laisse le scan agir.
Clique sur Suppression pour finaliser.
Tu peux, si tu le souhaites, te servir des Options facultatives.
Clique sur Quitter pour obtenir le rapport.
Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download
---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.
---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger :
http://www.infos-du-net.com/forum/272480-11-desactiver-activer-restauration-systeme
---> Je te conseille de créer un point de restauration que tu pourras utiliser plus tard si tu as un problème :
https://www.vulgarisation-informatique.com/creer-point-restauration.php
---> L'antivirus que je te propose s'appelle Antivir.
Voilà, j'ai tout fait comme tu as dit, suis je toujours infecté ?
pour antivir, je te dirai cela dans la semaine
[07/26/2008, 0:12:07] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Emmanuel\Local Settings\Temporary Internet Files\Content.IE5\YCSW8TIL\VirtumundoBeGone[1].exe" )
[07/26/2008, 0:12:11] - Detected System Information:
[07/26/2008, 0:12:11] - Windows Version: 5.1.2600, Service Pack 2
[07/26/2008, 0:12:11] - Current Username: Emmanuel (Admin)
[07/26/2008, 0:12:11] - Windows is in NORMAL mode.
[07/26/2008, 0:12:11] - Searching for Browser Helper Objects:
[07/26/2008, 0:12:11] - BHO 1: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} ()
[07/26/2008, 0:12:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\NppBho
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\NppBho, continuing.
[07/26/2008, 0:12:12] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[07/26/2008, 0:12:12] - BHO 3: {66AF7728-4CBE-4C32-B633-E5CE48B23DA2} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rhxtvoxe
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rhxtvoxe, continuing.
[07/26/2008, 0:12:12] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/26/2008, 0:12:12] - BHO 5: {8689FC95-FB98-4737-A000-39A30EF6CAB3} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rhxtvoxe
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rhxtvoxe, continuing.
[07/26/2008, 0:12:12] - BHO 6: {8A98733F-F4D4-4BAE-A5F8-7A23665F6BAC} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rqRHwVnm
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rqRHwVnm, continuing.
[07/26/2008, 0:12:12] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[07/26/2008, 0:12:12] - BHO 8: {907248E1-2AD0-4AC5-9193-27BE40735236} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\3077ahntdksr[1]
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\3077ahntdksr[1], continuing.
[07/26/2008, 0:12:12] - BHO 9: {a5d5d55c-39c7-4c4b-94f4-9ffb41123026} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\phgwhu
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\phgwhu, continuing.
[07/26/2008, 0:12:13] - Finished Searching Browser Helper Objects
[07/26/2008, 0:12:13] - Finishing up...
[07/26/2008, 0:12:13] - Nothing found! Exiting...
pour antivir, je te dirai cela dans la semaine
[07/26/2008, 0:12:07] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Emmanuel\Local Settings\Temporary Internet Files\Content.IE5\YCSW8TIL\VirtumundoBeGone[1].exe" )
[07/26/2008, 0:12:11] - Detected System Information:
[07/26/2008, 0:12:11] - Windows Version: 5.1.2600, Service Pack 2
[07/26/2008, 0:12:11] - Current Username: Emmanuel (Admin)
[07/26/2008, 0:12:11] - Windows is in NORMAL mode.
[07/26/2008, 0:12:11] - Searching for Browser Helper Objects:
[07/26/2008, 0:12:11] - BHO 1: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} ()
[07/26/2008, 0:12:11] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\NppBho
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\NppBho, continuing.
[07/26/2008, 0:12:12] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[07/26/2008, 0:12:12] - BHO 3: {66AF7728-4CBE-4C32-B633-E5CE48B23DA2} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rhxtvoxe
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rhxtvoxe, continuing.
[07/26/2008, 0:12:12] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/26/2008, 0:12:12] - BHO 5: {8689FC95-FB98-4737-A000-39A30EF6CAB3} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rhxtvoxe
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rhxtvoxe, continuing.
[07/26/2008, 0:12:12] - BHO 6: {8A98733F-F4D4-4BAE-A5F8-7A23665F6BAC} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\rqRHwVnm
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\rqRHwVnm, continuing.
[07/26/2008, 0:12:12] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[07/26/2008, 0:12:12] - BHO 8: {907248E1-2AD0-4AC5-9193-27BE40735236} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\3077ahntdksr[1]
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\3077ahntdksr[1], continuing.
[07/26/2008, 0:12:12] - BHO 9: {a5d5d55c-39c7-4c4b-94f4-9ffb41123026} ()
[07/26/2008, 0:12:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/26/2008, 0:12:12] - Checking for HKLM\...\Winlogon\Notify\phgwhu
[07/26/2008, 0:12:12] - Key not found: HKLM\...\Winlogon\Notify\phgwhu, continuing.
[07/26/2008, 0:12:13] - Finished Searching Browser Helper Objects
[07/26/2008, 0:12:13] - Finishing up...
[07/26/2008, 0:12:13] - Nothing found! Exiting...
Au tant pour moi j'ai copié collé le mauvais rapport, voici le bon :
-->- Recherche:
C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Emmanuel\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Emmanuel\Bureau\Navilog1: trouvé !
C:\Documents and Settings\Emmanuel\Bureau\navilog1\Navilog1.bat: trouvé !
C:\Documents and Settings\Emmanuel\Mes documents\ComboFix.exe: trouvé !
C:\Documents and Settings\Emmanuel\Mes documents\HJTInstall.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
---------------------------------
-->- Suppression:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Emmanuel\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Emmanuel\Bureau\navilog1\Navilog1.bat: supprimé !
C:\Documents and Settings\Emmanuel\Mes documents\ComboFix.exe: supprimé !
C:\Documents and Settings\Emmanuel\Mes documents\HJTInstall.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\Emmanuel\Bureau\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
-->- Recherche:
C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Emmanuel\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Emmanuel\Bureau\Navilog1: trouvé !
C:\Documents and Settings\Emmanuel\Bureau\navilog1\Navilog1.bat: trouvé !
C:\Documents and Settings\Emmanuel\Mes documents\ComboFix.exe: trouvé !
C:\Documents and Settings\Emmanuel\Mes documents\HJTInstall.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
---------------------------------
-->- Suppression:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Emmanuel\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Emmanuel\Bureau\navilog1\Navilog1.bat: supprimé !
C:\Documents and Settings\Emmanuel\Mes documents\ComboFix.exe: supprimé !
C:\Documents and Settings\Emmanuel\Mes documents\HJTInstall.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\Emmanuel\Bureau\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
Bonne continuation sur le post.
A+
[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : Emmanuel ] [ "C:\Toolbar SD" ] [ Selection : 1 ]
[ 26/07/2008 | 0:06:46,92 ] [ PC : SN400703200002 ]
[ MAJ : 25-07-2008 | 17:35 ]
-----------\\ Recherche de Fichiers / Dossiers ...
C:\Program Files\KaZaA
C:\Program Files\KaZaA\BGP2P
C:\Program Files\KaZaA\plugins
C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-30EFBC20.pf
C:\DOCUME~1\Emmanuel\APPLIC~1\Search Settings
C:\DOCUME~1\Emmanuel\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\STPHAN~1\APPLIC~1\Search Settings
C:\DOCUME~1\STPHAN~1\APPLIC~1\Search Settings\kb127
C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb127
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\iun6002.exe
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="https://actus.sfr.fr"
"Search Bar"="https://actus.sfr.fr"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://actus.sfr.fr"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
-----------\\ Fin du rapport a 0:10:02,76