Spyware privacy remover m64 + antivirus 2008

methodman -  
verni29 Messages postés 6699 Date d'inscription   Statut Contributeur sécurité Dernière intervention   -
Bonjour,

Quand j'allume mon ordi en fond de page j'ai un fond bleu avec un message d'alerte
warning spyware detected on your computer
avec en dessous win 32 adware virtumonde en face DANGER
et en dessous warning win 32 privacy remover 64 avec aussi en face DANGER
et en bas il y a please activate your antivirus software to clean your computer

Je dois aussi avoir le virus "Antivirus XP2008" car une fenetre apparait quand je demarre mon PC

merci de m'aider !!!
A voir également:

40 réponses

  • 1
  • 2
Réponse 1 / 40
verni29 Messages postés 6699 Date d'inscription   Statut Contributeur sécurité Dernière intervention   180
 
Bonjour,

Télécharge et installe HijackThis .
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

Choisir « Download Hijackthis Installer »
Après l'installation, un raccourci sera crée sur le bureau. Double-clique dessus pour le lancer.

Choisir l'option Do a system scan and save a logfile.
Le rapport va s'ouvrir. Tu copies/colles le contenu de ce rapport dans ton prochain message.

A+
0
Réponse 2 / 40
methodman
 
Merci Vernis

Voici le résultat du scan

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:30:21, on 21/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\System32\FTRTSVC.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\drivers\Icon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Nokia\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\lphca7mj0ej6n.exe
C:\Documents and Settings\Jess\Local Settings\Temp\.tt435.tmp.exe
C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\Program Files\OFFICE One6.5\program\soffice.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Nokia\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [lphca7mj0ej6n] C:\WINDOWS\system32\lphca7mj0ej6n.exe
O4 - HKLM\..\Run: [inrhce7mj0ej6n] C:\Documents and Settings\Jess\Local Settings\Temp\.tt435.tmp.exe /CR=5F8C0875B49BA02BB503A8EC828A17BCA572CAC20570658735043702BC2C0E307557EBDA9E232D714BFFBE7AC2898F385A32FFEB43AEA6AFF681F523B5B72910A185054D79DBAF7C9DC017C7A8DD568185
O4 - HKLM\..\Run: [OoPDFSettingsv6.exe] C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OFFICE One 6.5.lnk = C:\Program Files\OFFICE One6.5\program\quickstart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: OFFICE One Clock v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
O4 - Global Startup: OFFICE One Notes v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - https://secure.photobox.com/assets/aurigma/ImageUploader4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
0
Réponse 3 / 40
verni29 Messages postés 6699 Date d'inscription   Statut Contributeur sécurité Dernière intervention   180
 
tu télécharges smitfraudfix :

En image :
http://siri.urz.free.fr/Fix/SmitfraudFix.php

tu double cliques sur smitfraudfix.cmd et tu choisis l' option 1 .
Un rapport sera crée.
Copie/colle le rapport dans ton prochain message.



A+
0
Réponse 4 / 40
methodman
 
le programme se lance, mais aucune boite de dialogue n'apparait sur mon écran de pc.
Donc je peux pas choisir d'option et après il ne se passe plus rien.

Que dois-je faire?
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 40
methodman
 
j'ai toujours la fenetre "Antivirus XP 2008 license agreement" qui est là.
Et cette fenetre ne m'autorise qu'un seul choix:
"agree and install"
0
Réponse 6 / 40
verni29 Messages postés 6699 Date d'inscription   Statut Contributeur sécurité Dernière intervention   180
 
1) Tu vas utiliser SDFix téléchargeable à :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Tu installes le logiciel.
Tu peux t’aider du tuto suivant :
https://www.malekal.com/slenfbot-still-an-other-irc-bot/

Il faut que tu redémarres en mode sans échec.
Pour cela, tu redémarres ton ordinateur et tu appuies sur la touche F8.

A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
Choisis ton compte.

Tu lances SDFix en double-cliquant sur RunThis.bat dans le dossier où tu as installé le logiciel.

Ton ordinateur va redémarrer. il te sera peut-être demander d'appuyer sur une touche pour redémarrer.
L'outil va continuer à travailler, c'est normal.
Une fois affiché Finished, appuie sur une touche pour finir l'exécution du logiciel.
Ton bureau devrait réapparaitre.
Ouvre le dossier de SDFix sur ton Bureau.
Copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum.

Avec un nouveau log HijackThis !



2) methodman,

Tu n'as aucune protection sur ton ordinateur.
Tu joues avec le feu.

Il faut absolument que tu installes antivirus, antispyware et parefeu.
On en reparle après les 2 rapports.

A+
0
Réponse 7 / 40
methodman
 
1- J'installe le logiciel en mode normal, c'est ça?


ensuite je le redémarre en mode sans echec et je lance le programme??

2- oui, je viens de tout supprimer.
J'avais une versin périmé de Norton, et pour l'antispyware et parefeu j'en ai pas installé.

Que me conseille tu pour ces 3 protection?
Avast??
Spyware terminator???


Je t'envoie le rapport dès ke j'ai terminé
0
Réponse 8 / 40
verni29 Messages postés 6699 Date d'inscription   Statut Contributeur sécurité Dernière intervention   180
 
POur SDFix, c'est exactement ça.

Tu l'installes sous windows puis tu redémarres en mode sans échec pour la désinfection.

Après on verra pour les protections.

A+
0
Réponse 9 / 40
methodman
 
Alors voici le 1er rapport SDfix


[b]SDFix: Version 1.227 [/b]
Run by Jess on 21/09/2008 at 17:25

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File
Restoring Default Desktop Wallpaper
Restoring Default ScreenSaver value

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\system32\lphca7mj0ej6n.exe - Deleted
C:\WINDOWS\system32\phca7mj0ej6n.bmp - Deleted
C:\WINDOWS\system32\blphca7mj0ej6n.scr - Deleted
C:\Documents and Settings\Jess\Local Settings\Temp\.tt435.tmp.exe - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt1.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt10.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt11.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt12.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt1A.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt2.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt3.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt4.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt431.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt432.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt435.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt43B.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt43F.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt440.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt443.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt444.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt445.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt446.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt447.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt448.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt44A.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt44B.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt44C.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt44D.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt44E.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt450.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt451.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt452.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt454.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt455.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt456.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt457.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt458.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt45A.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt45C.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt45E.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt460.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt462.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt467.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt468.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt46A.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt46C.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt474.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt476.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt477.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt478.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt47A.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt47C.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt47E.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt47F.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt481.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt483.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt484.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt488.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt48A.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt48B.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt48D.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt490.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt492.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt493.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt499.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt4E.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt5.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt5E6.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt6.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt60.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt7.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt785.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt7D3.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt8.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt87.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt9.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt908.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt946.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt98E.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt99.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA12.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA2.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA28.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA2A.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA2C.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA36.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA3D.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA3F.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA41.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA43.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA4A.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA4E.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA50.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA8.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttB.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttC.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttD.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttE.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttF.tmp - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt435.tmp.exe - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.tt12.tmp.vbs - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttA.tmp.vbs - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttB.tmp.vbs - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttC.tmp.vbs - Deleted
C:\DOCUME~1\Jess\LOCALS~1\Temp\.ttF.tmp.vbs - Deleted
C:\WINDOWS\system32\drivers\tdssserv.sys - Deleted
C:\WINDOWS\system32\tdssadw.dll - Deleted
C:\WINDOWS\system32\tdssinit.dll - Deleted
C:\WINDOWS\system32\tdssl.dll - Deleted
C:\WINDOWS\system32\tdsslog.dll - Deleted
C:\WINDOWS\system32\tdssmain.dll - Deleted
C:\WINDOWS\system32\tdssserf.dll - Deleted
C:\WINDOWS\system32\tdssservers.dat - Deleted





Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-21 17:44:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\3553677d]
"ImagePath"="\SystemRoot\System32\drivers\3553677d.sys"
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv]
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\3553677d]
"ImagePath"="\SystemRoot\System32\drivers\3553677d.sys"
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TDSSserv]
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\APPS\\Powercinema\\PowerCinema.exe"="C:\\APPS\\Powercinema\\PowerCinema.exe:*:Enabled:PowerCinema"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Disabled:Internet Explorer"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Documents and Settings\\Jess\\Mes documents\\bureau\\utorrent\\utorrent.exe"="C:\\Documents and Settings\\Jess\\Mes documents\\bureau\\utorrent\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\APPS\\skype\\phone\\Skype.exe"="C:\\APPS\\skype\\phone\\Skype.exe:*:Enabled:Skype"
"C:\\Documents and Settings\\Jess\\Mes documents\\Ma musique\\eMule\\emule.exe"="C:\\Documents and Settings\\Jess\\Mes documents\\Ma musique\\eMule\\emule.exe:*:Disabled:eMule"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\drivers\\svchost.exe"="C:\\WINDOWS\\system32\\drivers\\svchost.exe:*:Disabled:svchost"
"C:\\Documents and Settings\\Jess\\Local Settings\\Temp\\.tt43A.tmp"="C:\\Documents and Settings\\Jess\\Local Settings\\Temp\\.tt43A.tmp:*:Enabled:enable"
"C:\\Documents and Settings\\Jess\\Local Settings\\Temp\\WZSE0.TMP\\SymNRT.exe"="C:\\Documents and Settings\\Jess\\Local Settings\\Temp\\WZSE0.TMP\\SymNRT.exe:*:Enabled:Norton Removal Tool"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Fri 5 Aug 2005 215 A.SHR --- "C:\BOOT.BAK"
Fri 12 Mar 2004 54,384 A..H. --- "C:\Program Files\AOL 9.0\aolphx.exe"
Fri 12 Mar 2004 156,784 A..H. --- "C:\Program Files\AOL 9.0\aoltray.exe"
Fri 12 Mar 2004 31,344 A..H. --- "C:\Program Files\AOL 9.0\RBM.exe"
Fri 12 May 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 7 Oct 2006 427,008 A..H. --- "C:\Documents and Settings\Jess\Application Data\Microsoft\Word\~WRL0208.tmp"
Sat 7 Oct 2006 512,512 A..H. --- "C:\Documents and Settings\Jess\Application Data\Microsoft\Word\~WRL0329.tmp"
Sat 7 Oct 2006 506,880 A..H. --- "C:\Documents and Settings\Jess\Application Data\Microsoft\Word\~WRL2733.tmp"
Fri 12 May 2006 4,348 A..H. --- "C:\Documents and Settings\Jess\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Sat 23 Dec 2006 20 A..H. --- "C:\Documents and Settings\Jess\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Sat 23 Dec 2006 312 A..H. --- "C:\Documents and Settings\Jess\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Sat 23 Dec 2006 1,536 A..H. --- "C:\Documents and Settings\Jess\Mes documents\Ma musique\Sauvegarde de la licence\drmv2lic.bak"
Fri 12 Mar 2004 106,496 A..H. --- "C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll"
Mon 18 Feb 2008 100,352 ...H. --- "C:\Documents and Settings\Jess\Mes documents\Evariste Galois\liste ‚lŠves\liste ‚lŠves 2007-2008\~WRL3513.tmp"
Mon 18 Feb 2008 100,352 A..H. --- "C:\Documents and Settings\Jess\Mes documents\Evariste Galois\cl‚ USB\liste ‚lŠves\liste ‚lŠves 2007-2008\~WRL3513.tmp"
Mon 10 Dec 2007 40,448 A..H. --- "C:\Documents and Settings\Jess\Mes documents\Evariste Galois\cl‚ USB\work\PP\~WRL2772.tmp"

[b]Finished![/b]







Le 2ème HiJack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:53:58, on 21/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\System32\FTRTSVC.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\drivers\Icon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Nokia\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\OFFICE One6.5\program\soffice.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Nokia\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [OoPDFSettingsv6.exe] C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OFFICE One 6.5.lnk = C:\Program Files\OFFICE One6.5\program\quickstart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: OFFICE One Clock v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
O4 - Global Startup: OFFICE One Notes v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - https://secure.photobox.com/assets/aurigma/ImageUploader4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
0
Réponse 10 / 40
methodman
 
alors là visiblement, je n'ai plus le fond d'écran bleu avec un message d'alerte
warning spyware detected on your computer

et je n'ai plus la fenêtre "Antivirus XP 2008 license agreement"
0
Réponse 11 / 40
verni29 Messages postés 6699 Date d'inscription   Statut Contributeur sécurité Dernière intervention   180
 
Pour les protections de ton PC :

1) Comme antivirusn ,n'installe pas Avast.
Je te conseillerais plutot Antivir. C'est le meilleur antivirus gratuit.
Il est en anglais mais la version française doit bientôt sortir.

Je te joins un article qui compare Avast et Antivir
http://forum.malekal.com/ftopic3528.php

tuto antivir :
https://www.malekal.com/avira-free-security-antivirus-gratuit/

2) Comme antispywares, au choix :

AVG anti spyware:
http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware

Spybot :
https://www.malekal.com/spybot-search-destroy-proteger-desinfecter-pc-virus/ ( avec le tea timer )

3) pare-feu gratuits :

Zone alarm :
https://www.malekal.com/tutoriel-zonealarm-firewall/

- Comodo™ Firewall ( version 3.0 en anglais, sinon 2.4 multi-langues )
https://www.malekal.com/tutorial-comodo-firewall/
http://www.personalfirewall.comodo.com/download_firewall.html#fw2.4

- Kerio Personal Firewall
https://www.malekal.com/tutorial-et-guide-counterspy/

Si l'anglais ne te dérange pas , online armor a la cote sur le net.
-Online Armor :
https://www.malekal.com/tutorial-online-armor-free/

Installe ces trois types de protection et poste ensuite un nouveau rapport Hijackthis que je vois si c'est correctement configuré.

Il reste encore des outils après à passer pour finir de désinfecter ton PC.

A+
0
Réponse 12 / 40
methodman
 
1- Antivirus

Sur la page que tu m'as donné, je prend la version anglaise, mais il y a 2 fichier, un zipper et l'autre pas.
lequel je prends?
0
Réponse 13 / 40
verni29 Messages postés 6699 Date d'inscription   Statut Contributeur sécurité Dernière intervention   180
 
prends celui non zippé. Il est autoéxecutable.
0
Réponse 14 / 40
methodman
 
Voilà, j'ai installé

Antivirus = ANTIVIR
Spyware = AVG
Pare feu = Zone alarm

Pare contre j'ai un pare feu windows, faut il que je le désinstalle pour éviter les conflits??

J'ai redémarré mon PC (ce qui a été très long.. est ce normal??) et je t'envoie maintenant le rapport

Rapport Hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:06:20, on 21/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\System32\FTRTSVC.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\drivers\Icon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Nokia\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
C:\Program Files\OFFICE One6.5\program\soffice.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Nokia\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [OoPDFSettingsv6.exe] C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OFFICE One 6.5.lnk = C:\Program Files\OFFICE One6.5\program\quickstart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: OFFICE One Clock v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
O4 - Global Startup: OFFICE One Notes v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - https://secure.photobox.com/assets/aurigma/ImageUploader4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (antivirscheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (antivirservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard (avg anti-spyware guard) - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
0
Réponse 15 / 40
verni29 Messages postés 6699 Date d'inscription   Statut Contributeur sécurité Dernière intervention   180
 
Les protections te prennent une partie de la mémoire au démarrage, mais tu as aussi beaucoup trop d'exécutables qui se chargent au démarrage d'une session.
On se chargera d'optimiser cela à la fin de la désinfection.

1) Spywareterminator avait installé une barre d'outil qu'il vaut mieux désinstallé.

Télécharge Toolbar-S&D sur ton Bureau :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique sur le raccourci de Toolbar-S&D.
* Sélectionne la langue puis valide.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Copie/colle le contenu du rapport situé dans C:\TB.txt .

2) Il doit rester des traces de Norton sur ton PC.
Utilise cet outil pour nettoyer cela :
http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924

3) J'aimerais que tu analyses un fichier :

. Tu vas sur le site de VirusTotal et tu vas pouvoir analyser le fichier.
https://www.virustotal.com/gui/

Copier le chemin indiqué ci-dessous et le coller dans la zone à analyser.
Tu cliques ensuite sur envoyer le fichier.
Tu postes le rapport de l'analyse ( pour cela, tu sélectionnes la zone de résultat --> click droit --> copier )

Chemin : C:\WINDOWS\system32\drivers\Icon.exe

A+
0
Réponse 16 / 40
methodman
 
1- J'ai désinstaler "CRAWLER Toolbar" (celle ki c installé avec Spyware) manuellement parce que ça marcher pas avec l'outil

2- J'ai repassé l'outil "Norton Removal Tool" (car je l'avais déjà fait)


J'ai du redémarrer le pc car ma connection internet ne se faisait pas.
Mon PC est toujours aussi TERRIBLEMENT long à redémarrer (icone sur le bureau qui sont présent mais les logo associés sont très long a s'afficher + barre d'outil à charger)

3- je te l'envoie dès que je parviens àme reconnecter (là je t'écris d'un autre PC)
0
Réponse 17 / 40
methodman
 
J'ai un message dans une boite de dialogue:

OFFICE One PDF Setting v6
"Viloation d'accès à l'adresse 100069CC dans le module 'cdintf.dllé. Lecture de l'adresse 0000003C."
ça signifie quoi?
0
Réponse 18 / 40
verni29 Messages postés 6699 Date d'inscription   Statut Contributeur sécurité Dernière intervention   180
 
OFFICE One PDF est un logiciel ( payant ) pour convertir les fichiers office en .pdf.
La il essaye d'écrire dans une librairie.
Désinstalle-le.

Télécharge PDF creator qui est gratuit :
http://www.commentcamarche.net/telecharger/telecharger 128 pdf creator

A+
0
Réponse 19 / 40
methodman
 
OK, je fais ça....

Comment se fait il que mon PC soit si long.
Dès que je clique sur une touche c'est 10 minutes pour qu'il réagisse.
0
Réponse 20 / 40
methodman
 
Voici le résultat de l'analyse du fichier

C:\WINDOWS\system32\drivers\Icon.exe

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.9.19.2 2008.09.19 -
AntiVir 7.8.1.34 2008.09.21 -
Authentium 5.1.0.4 2008.09.21 -
Avast 4.8.1195.0 2008.09.20 -
AVG 8.0.0.161 2008.09.21 -
BitDefender 7.2 2008.09.21 -
CAT-QuickHeal 9.50 2008.09.20 -
ClamAV 0.93.1 2008.09.21 -
DrWeb 4.44.0.09170 2008.09.21 -
eSafe 7.0.17.0 2008.09.21 -
eTrust-Vet 31.6.6098 2008.09.21 -
Ewido 4.0 2008.09.21 -
F-Prot 4.4.4.56 2008.09.21 -
F-Secure 8.0.14332.0 2008.09.21 -
Fortinet 3.113.0.0 2008.09.21 -
GData 19 2008.09.21 -
Ikarus T3.1.1.34.0 2008.09.21 -
K7AntiVirus 7.10.466 2008.09.20 -
Kaspersky 7.0.0.125 2008.09.21 -
McAfee 5388 2008.09.19 -
Microsoft 1.3903 2008.09.21 -
NOD32v2 3458 2008.09.21 -
Norman 5.80.02 2008.09.19 -
Panda 9.0.0.4 2008.09.21 -
PCTools 4.4.2.0 2008.09.21 -
Prevx1 V2 2008.09.21 -
Rising 20.62.62.00 2008.09.21 -
Sophos 4.33.0 2008.09.21 -
Sunbelt 3.1.1653.1 2008.09.20 -
Symantec 10 2008.09.21 -
TheHacker 6.3.0.9.090 2008.09.20 -
TrendMicro 8.700.0.1004 2008.09.20 -
VBA32 3.12.8.5 2008.09.20 -
ViRobot 2008.9.20.1385 2008.09.20 -
VirusBuster 4.5.11.0 2008.09.21 -
Webwasher-Gateway 6.6.2 2008.09.21 -
Information additionnelle
File size: 217088 bytes
MD5...: 49d568d4c78b56e0d1bb156414dbc649
SHA1..: f9a45cd5c68045a664695b480f32eca2d625acd8
SHA256: 0b55c269b7a77def408848da2804af448a9ff19114d8f08c5527d2db5cc3b52d
SHA512: 4f23f9178518b56b9877730a37b0b8a5c41fdcb6a166ef0c8e40651d72d21ec6
ba3dd62983de9953bc5ccdbecbb9a8d0d0dd833fdd8ec92e4b2a43427062a6ff
PEiD..: Armadillo v1.71
TrID..: File type identification
InstallShield setup (37.7%)
Win32 Executable MS Visual C++ (generic) (33.0%)
Windows Screen Saver (11.4%)
Win32 Executable Generic (7.4%)
Win32 Dynamic Link Library (generic) (6.6%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40a462
timedatestamp.....: 0x404c0336 (Mon Mar 08 05:23:02 2004)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x22d0f 0x23000 6.60 cde9f92a434041ae18c7487597140327
.rdata 0x24000 0x8aa6 0x9000 4.76 4427aab199423df74659b0546a012ef7
.data 0x2d000 0x8688 0x5000 2.20 11f93a42b1e46bc5c72253293bbe4129
.rsrc 0x36000 0x2540 0x3000 4.00 ff0b4b142627aa55b975e37845c28a32

( 12 imports )
> KERNEL32.dll: GetCommandLineA, RaiseException, GetStartupInfoA, TerminateProcess, HeapAlloc, SetStdHandle, GetFileType, HeapFree, HeapReAlloc, HeapSize, GetTimeZoneInformation, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetACP, SetHandleCount, ExitProcess, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, SetUnhandledExceptionFilter, DuplicateHandle, CreateFileA, SizeofResource, LCMapStringW, GetStringTypeA, GetStringTypeW, IsBadReadPtr, IsBadCodePtr, RtlUnwind, CompareStringA, CompareStringW, SetEnvironmentVariableA, GetTickCount, FormatMessageA, FileTimeToSystemTime, FileTimeToLocalFileTime, SetErrorMode, GetFileTime, GetFileSize, GetFileAttributesA, GetFullPathNameA, GetThreadLocale, FindClose, GetVolumeInformationA, FindFirstFileA, SetEndOfFile, FlushFileBuffers, UnlockFile, LockFile, ReadFile, SetFilePointer, WriteFile, GetStdHandle, GetCurrentProcess, LockResource, GetVersion, lstrcatA, GetCurrentThreadId, GlobalGetAtomNameA, lstrcmpiA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, lstrcpyA, GetModuleHandleA, GetWindowsDirectoryA, LoadLibraryA, GetProcAddress, FreeLibrary, VirtualAlloc, WritePrivateProfileStringA, GetProfileStringA, GetOEMCP, GetCPInfo, GetProcessVersion, GlobalFlags, TlsGetValue, LocalReAlloc, TlsSetValue, EnterCriticalSection, GlobalReAlloc, LeaveCriticalSection, TlsFree, GlobalHandle, DeleteCriticalSection, TlsAlloc, InitializeCriticalSection, LocalFree, LocalAlloc, lstrcpynA, GetLastError, MulDiv, SetLastError, MultiByteToWideChar, WideCharToMultiByte, InterlockedDecrement, InterlockedIncrement, lstrlenA, GlobalUnlock, GlobalFree, CloseHandle, GetModuleFileNameA, GlobalLock, GlobalAlloc, lstrcmpA, GetCurrentThread, FindResourceA, LoadResource, IsBadWritePtr, LCMapStringA, GetEnvironmentVariableA, GetVersionExA
> USER32.dll: SetRect, GetNextDlgGroupItem, MessageBeep, CopyAcceleratorTableA, InvalidateRect, InflateRect, RegisterClipboardFormatA, PostThreadMessageA, GetSysColorBrush, LoadCursorA, GetDesktopWindow, PtInRect, GetClassNameA, GrayStringA, DrawTextA, TabbedTextOutA, EndPaint, BeginPaint, GetWindowDC, ReleaseDC, GetDC, ClientToScreen, DestroyMenu, LoadStringA, MapDialogRect, SetWindowContextHelpId, EndDialog, CreateDialogIndirectParamA, GetMessageA, TranslateMessage, GetActiveWindow, ValidateRect, GetCursorPos, SetCursor, PostQuitMessage, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, CharUpperA, CharNextA, ShowWindow, MoveWindow, SetWindowTextA, IsDialogMessageA, PostMessageA, UpdateWindow, GetSysColor, PeekMessageA, GetFocus, SetActiveWindow, IsWindow, SetFocus, AdjustWindowRectEx, ScreenToClient, CopyRect, IsWindowVisible, GetTopWindow, MessageBoxA, IsChild, GetParent, GetCapture, WinHelpA, GetClassInfoA, RegisterClassA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetDlgItem, GetWindowTextLengthA, GetWindowTextA, GetDlgCtrlID, GetKeyState, DefWindowProcA, DestroyWindow, CreateWindowExA, SetWindowsHookExA, IsWindowEnabled, GetNextDlgTabItem, DispatchMessageA, CallNextHookEx, GetClassLongA, SetPropA, UnhookWindowsHookEx, GetPropA, CallWindowProcA, RemovePropA, GetMessageTime, GetMessagePos, GetLastActivePopup, GetForegroundWindow, SetForegroundWindow, GetWindow, GetWindowLongA, SetWindowLongA, SetWindowPos, RegisterWindowMessageA, OffsetRect, IntersectRect, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, wsprintfA, IsIconic, GetSystemMetrics, GetClientRect, DrawIcon, GetSystemMenu, AppendMenuA, SendMessageA, LoadIconA, EnableWindow, RegisterHotKey, UnregisterHotKey, MapWindowPoints, SendDlgItemMessageA, DrawFocusRect, UnregisterClassA, HideCaret, ShowCaret, ExcludeUpdateRgn, DefDlgProcA, IsWindowUnicode
> GDI32.dll: DeleteObject, GetDeviceCaps, GetViewportExtEx, GetWindowExtEx, CreateSolidBrush, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, GetTextColor, GetBkColor, DPtoLP, LPtoDP, GetMapMode, PatBlt, CreateDIBitmap, CreateCompatibleDC, BitBlt, GetTextExtentPointA, IntersectClipRect, ScaleWindowExtEx, SetWindowExtEx, SetViewportExtEx, OffsetViewportOrgEx, ScaleViewportExtEx, SetMapMode, SetViewportOrgEx, SetBkMode, GetStockObject, SelectObject, SaveDC, RestoreDC, CreateBitmap, GetObjectA, DeleteDC, SetTextColor, GetClipBox, SetBkColor
> comdlg32.dll: GetFileTitleA
> WINSPOOL.DRV: ClosePrinter, DocumentPropertiesA, OpenPrinterA
> ADVAPI32.dll: RegCloseKey, RegSetValueExA, RegOpenKeyExA, RegQueryValueExA, RegCreateKeyExA
> SHELL32.dll: Shell_NotifyIconA
> COMCTL32.dll: -
> oledlg.dll: -
> ole32.dll: CoFreeUnusedLibraries, OleUninitialize, OleInitialize, CoTaskMemFree, CreateILockBytesOnHGlobal, StgCreateDocfileOnILockBytes, CoGetClassObject, CLSIDFromString, CLSIDFromProgID, StgOpenStorageOnILockBytes, CoRegisterMessageFilter, CoRevokeClassObject, OleFlushClipboard, OleIsCurrentClipboard, CoTaskMemAlloc
> OLEPRO32.DLL: -
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -

( 0 exports )
0

Discussions similaires

Privacy shield ???
DYLLEN76 -
stam18 -

13 réponses
" Échec de l'analyse antivirus " la solution.
bazfile -
bazfile -

0 réponse
Google Chrome "  Échec de l'analyse antivirus "
jmpower -
RBmoon -

18 réponses