Hijackthis bloc note
youyou 113
Messages postés
22
Statut
Membre
-
youyou 113 Messages postés 22 Statut Membre -
youyou 113 Messages postés 22 Statut Membre -
Bonjour,
j'ai un probleme avec mon PC, toujours une fenetre s'ouvre de virus remover 2008, voici le rapport de hijackthis : svp quelqu'un peut me dire quoi faire maintenant?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:34:43, on 13/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\Program Files\TOPNET\AccessRunner ADSL\CnxDslTb.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\sistray.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\kaled\Bureau\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.topnet.tn/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ircdown.com/fr/index.php?rvs=hompag&d=79918891e=6079
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = https://www.topnet.tn/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = TopNet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\system32\IETie.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TOPNET\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [GhostSurf Reminder] "C:\Program Files\GhostSurf 2005\Privacy Control Center.exe" reminder
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] ~"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MaxTV.lnk = C:\Program Files\DMV\MaxTV4\maxtv.exe
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: LG SyncManager.lnk = ?
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2195ED1-580D-4D40-AC6F-A49E79A17101}: NameServer = 213.150.176.196 193.95.67.22
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Information Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
--
End of file - 9131 bytes
j'ai un probleme avec mon PC, toujours une fenetre s'ouvre de virus remover 2008, voici le rapport de hijackthis : svp quelqu'un peut me dire quoi faire maintenant?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:34:43, on 13/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\Program Files\TOPNET\AccessRunner ADSL\CnxDslTb.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\sistray.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\kaled\Bureau\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.topnet.tn/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ircdown.com/fr/index.php?rvs=hompag&d=79918891e=6079
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = https://www.topnet.tn/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = TopNet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\system32\IETie.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TOPNET\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [GhostSurf Reminder] "C:\Program Files\GhostSurf 2005\Privacy Control Center.exe" reminder
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] ~"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MaxTV.lnk = C:\Program Files\DMV\MaxTV4\maxtv.exe
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: LG SyncManager.lnk = ?
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2195ED1-580D-4D40-AC6F-A49E79A17101}: NameServer = 213.150.176.196 193.95.67.22
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Information Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
--
End of file - 9131 bytes
Configuration: Windows XP Firefox 3.0.4
A voir également:
- Hijackthis bloc note
- Hijackthis - Télécharger - Antivirus & Antimalwares
- Bloc note gratuit - Télécharger - Traitement de texte
- Bloc-notes-Android - Télécharger - Agendas & Calendriers
- Redmi note 14 4g test - Accueil - Téléphones
- Eteindre redmi note 14 - Forum Xiaomi
14 réponses
Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)
Salut youyou !!
reposte le rapport de ToolbarSD au complet stp
il se trouve là C:\TB.txt
Comment copier/coller le rapport :
Quand tu as le rapport à l écran, tu fais ctrl A pour "sélectionner tout" puis ctrl C pour "copier".
ensuite tu viens sur le forum pour me répondre et tu fais ctrl V pour "coller" le rapport.
reposte le rapport de ToolbarSD au complet stp
il se trouve là C:\TB.txt
Comment copier/coller le rapport :
Quand tu as le rapport à l écran, tu fais ctrl A pour "sélectionner tout" puis ctrl C pour "copier".
ensuite tu viens sur le forum pour me répondre et tu fais ctrl V pour "coller" le rapport.
ah oui desolé. voici le rapport :
-----------\\ ToolBar S&D 1.2.4 XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Award Modular BIOS v6.00PG
USER : kaled ( Administrator )
BOOT : Normal boot
Antivirus : Rising Antivirus (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:7 Go)
D:\ (Local Disk) - NTFS - Total:37 Go (Free:2 Go)
E:\ (CD or DVD)
"C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
Option : [1] ( 13/11/2008|16:11 )
-----------\\ Recherche de Fichiers / Dossiers ...
C:\DOCUME~1\kaled\LOCALS~1\Temp\nsd4D.tmp
C:\DOCUME~1\kaled\LOCALS~1\Temp\nsh122.tmp
C:\DOCUME~1\kaled\LOCALS~1\Temp\nst10D.tmp
C:\DOCUME~1\kaled\LOCALS~1\Temp\nsxF9.tmp
-----------\\ Extensions
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68} => imagezoom
(kaled) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(kaled) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
(kaled) - {8c483120-01da-11d9-9669-0800200c9a66} => freetranslate
(kaled) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper
(kaled) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} => hotspot_shield
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.ircdown.com/fr/index.php?rvs=hompag&d=79918891e=6079"
"Default_Page_URL"="https://www.topnet.tn/"
"SearchMigratedDefaultURL"="https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
"First Home Page"="https://www.topnet.tn/"
--------------------\\ Recherche d'autres infections
C:\WINDOWS\System32\nvs2.inf
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc_nav.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc_navps.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek.exe
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek_nav.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek_navps.dat
[b]==> EGDACCESS <==/b
--------------------\\ ROOTKIT !!
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HookSys]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\HookSys]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HookSys]
-----------\\ ToolBar S&D 1.2.4 XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Award Modular BIOS v6.00PG
USER : kaled ( Administrator )
BOOT : Normal boot
Antivirus : Rising Antivirus (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:7 Go)
D:\ (Local Disk) - NTFS - Total:37 Go (Free:2 Go)
E:\ (CD or DVD)
"C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
Option : [1] ( 13/11/2008|16:11 )
-----------\\ Recherche de Fichiers / Dossiers ...
C:\DOCUME~1\kaled\LOCALS~1\Temp\nsd4D.tmp
C:\DOCUME~1\kaled\LOCALS~1\Temp\nsh122.tmp
C:\DOCUME~1\kaled\LOCALS~1\Temp\nst10D.tmp
C:\DOCUME~1\kaled\LOCALS~1\Temp\nsxF9.tmp
-----------\\ Extensions
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68} => imagezoom
(kaled) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(kaled) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
(kaled) - {8c483120-01da-11d9-9669-0800200c9a66} => freetranslate
(kaled) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper
(kaled) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} => hotspot_shield
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.ircdown.com/fr/index.php?rvs=hompag&d=79918891e=6079"
"Default_Page_URL"="https://www.topnet.tn/"
"SearchMigratedDefaultURL"="https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
"First Home Page"="https://www.topnet.tn/"
--------------------\\ Recherche d'autres infections
C:\WINDOWS\System32\nvs2.inf
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc_nav.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc_navps.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek.exe
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek_nav.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek_navps.dat
[b]==> EGDACCESS <==/b
--------------------\\ ROOTKIT !!
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HookSys]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\HookSys]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HookSys]
▶ Relance Toolbar-S&D en double-cliquant sur le raccourci.
▶ Tape sur "2" puis valide en appuyant sur "Entrée".
/!\ Ne ferme pas la fenêtre lors de la suppression !
▶ Un rapport sera généré, poste son contenu ici.
NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.
ensuite :
▶ Télécharge sur le bureau Navilog1
*Si ton antivirus s'affole , le désactiver
sous vista : Clic-droit sur le raccourci Navilog1 présent sur le bureau et choisis "Exécuter en tant qu'administrateur
sous XP : double-clic dessus pour l'installer et le lancer
▶ Quand installé
▶ taper F
▶ Appuyer sur une touche jusqu' arriver aux options
▶ Choisir Recherche ( = taper 1 )
▶ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes
▶un rapport : fixnavi.txt dans ==> C:
▶le copier et le coller dans la réponse
▶ Tape sur "2" puis valide en appuyant sur "Entrée".
/!\ Ne ferme pas la fenêtre lors de la suppression !
▶ Un rapport sera généré, poste son contenu ici.
NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.
ensuite :
▶ Télécharge sur le bureau Navilog1
*Si ton antivirus s'affole , le désactiver
sous vista : Clic-droit sur le raccourci Navilog1 présent sur le bureau et choisis "Exécuter en tant qu'administrateur
sous XP : double-clic dessus pour l'installer et le lancer
▶ Quand installé
▶ taper F
▶ Appuyer sur une touche jusqu' arriver aux options
▶ Choisir Recherche ( = taper 1 )
▶ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes
▶un rapport : fixnavi.txt dans ==> C:
▶le copier et le coller dans la réponse
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
pas malwarebytes maintenant !!!!
http://www.commentcamarche.net/forum/affich 9402365 hijackthis bloc note?#7
http://www.commentcamarche.net/forum/affich 9402365 hijackthis bloc note?#7
-----------\\ ToolBar S&D 1.2.4 XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Award Modular BIOS v6.00PG
USER : kaled ( Administrator )
BOOT : Normal boot
Antivirus : Rising Antivirus (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:7 Go)
D:\ (Local Disk) - NTFS - Total:37 Go (Free:2 Go)
E:\ (CD or DVD)
"C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
Option : [2] ( 13/11/2008|18:08 )
-----------\\ SUPPRESSION
Supprime! - C:\DOCUME~1\kaled\LOCALS~1\Temp\nsd4D.tmp
Supprime! - C:\DOCUME~1\kaled\LOCALS~1\Temp\nsh122.tmp
Supprime! - C:\DOCUME~1\kaled\LOCALS~1\Temp\nst10D.tmp
Supprime! - C:\DOCUME~1\kaled\LOCALS~1\Temp\nsxF9.tmp
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ Extensions
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68} => imagezoom
(kaled) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(kaled) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
(kaled) - {8c483120-01da-11d9-9669-0800200c9a66} => freetranslate
(kaled) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper
(kaled) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} => hotspot_shield
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.ircdown.com/fr/index.php?rvs=hompag&d=79918891e=6079"
"Default_Page_URL"="https://www.topnet.tn/"
"SearchMigratedDefaultURL"="https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"
"First Home Page"="https://www.topnet.tn/"
--------------------\\ Recherche d'autres infections
C:\WINDOWS\System32\nvs2.inf
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc_nav.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc_navps.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek.exe
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek_nav.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek_navps.dat
[b]==> EGDACCESS <==/b
--------------------\\ ROOTKIT !!
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HookSys]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\HookSys]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HookSys]
1 - "C:\ToolBar SD\TB_1.txt" - 13/11/2008|18:22 - Option : [2]
-----------\\ Fin du rapport a 18:22:14,46
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Award Modular BIOS v6.00PG
USER : kaled ( Administrator )
BOOT : Normal boot
Antivirus : Rising Antivirus (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:7 Go)
D:\ (Local Disk) - NTFS - Total:37 Go (Free:2 Go)
E:\ (CD or DVD)
"C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
Option : [2] ( 13/11/2008|18:08 )
-----------\\ SUPPRESSION
Supprime! - C:\DOCUME~1\kaled\LOCALS~1\Temp\nsd4D.tmp
Supprime! - C:\DOCUME~1\kaled\LOCALS~1\Temp\nsh122.tmp
Supprime! - C:\DOCUME~1\kaled\LOCALS~1\Temp\nst10D.tmp
Supprime! - C:\DOCUME~1\kaled\LOCALS~1\Temp\nsxF9.tmp
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ Extensions
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => forecastfox
(kaled) - {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68} => imagezoom
(kaled) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(kaled) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
(kaled) - {8c483120-01da-11d9-9669-0800200c9a66} => freetranslate
(kaled) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper
(kaled) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} => hotspot_shield
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
(kaled) - {DCBD1271-D228-4082-9FBC-36D9B7660B03} => 1clickweather
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.ircdown.com/fr/index.php?rvs=hompag&d=79918891e=6079"
"Default_Page_URL"="https://www.topnet.tn/"
"SearchMigratedDefaultURL"="https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"
"First Home Page"="https://www.topnet.tn/"
--------------------\\ Recherche d'autres infections
C:\WINDOWS\System32\nvs2.inf
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc_nav.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\aksckmc_navps.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek.exe
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek_nav.dat
C:\DOCUME~1\kaled\LOCALS~1\APPLIC~1\oeuek_navps.dat
[b]==> EGDACCESS <==/b
--------------------\\ ROOTKIT !!
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HookSys]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\HookSys]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HOOKSYS]
Rootkit Pandex ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HookSys]
1 - "C:\ToolBar SD\TB_1.txt" - 13/11/2008|18:22 - Option : [2]
-----------\\ Fin du rapport a 18:22:14,46
ok maintenant fais ceci stp :
▶ Télécharge sur le bureau Navilog1
*Si ton antivirus s'affole , le désactiver
sous vista : Clic-droit sur le raccourci Navilog1 présent sur le bureau et choisis "Exécuter en tant qu'administrateur
sous XP : double-clic dessus pour l'installer et le lancer
▶ Quand installé
▶ taper F
▶ Appuyer sur une touche jusqu' arriver aux options
▶ Choisir Recherche ( = taper 1 )
▶ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes
▶un rapport : fixnavi.txt dans ==> C:
▶le copier et le coller dans la réponse
▶ Télécharge sur le bureau Navilog1
*Si ton antivirus s'affole , le désactiver
sous vista : Clic-droit sur le raccourci Navilog1 présent sur le bureau et choisis "Exécuter en tant qu'administrateur
sous XP : double-clic dessus pour l'installer et le lancer
▶ Quand installé
▶ taper F
▶ Appuyer sur une touche jusqu' arriver aux options
▶ Choisir Recherche ( = taper 1 )
▶ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes
▶un rapport : fixnavi.txt dans ==> C:
▶le copier et le coller dans la réponse
voici le rapport, et après svp?
Search Navipromo version 3.6.9 commencé le 13/11/2008 à 18:27:13,01
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "kaled"
Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 8.0.6001.18241
Système de fichiers : NTFS
Recherche executé en mode normal
*** Recherche Programmes installés ***
*** Recherche dossiers dans "C:\WINDOWS" ***
*** Recherche dossiers dans "C:\Program Files" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***
*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\kaled\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\kaled\locals~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\kaled\menudm~1\progra~1" ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Fichier(s) caché(s) :
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.dat
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.exe
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_nav.dat
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_navps.dat
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans "C:\WINDOWS\system32" *
* Recherche dans "C:\Documents and Settings\kaled\locals~1\applic~1" *
*** Recherche fichiers ***
C:\WINDOWS\system32\nvs2.inf trouvé !
*** Recherche clés spécifiques dans le Registre ***
HKEY_CURRENT_USER\Software\Lanconfig trouvé !
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans "C:\WINDOWS\system32" :
* Dans "C:\Documents and Settings\kaled\locals~1\applic~1" :
aksckmc.dat trouvé !
aksckmc_nav.dat trouvé !
aksckmc_navps.dat trouvé !
oeuek_nav.dat trouvé !
oeuek_navps.dat trouvé !
3)Recherche Certificats :
Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche fichiers connus :
*** Analyse terminée le 13/11/2008 à 18:39:26,12 ***
Search Navipromo version 3.6.9 commencé le 13/11/2008 à 18:27:13,01
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "kaled"
Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 8.0.6001.18241
Système de fichiers : NTFS
Recherche executé en mode normal
*** Recherche Programmes installés ***
*** Recherche dossiers dans "C:\WINDOWS" ***
*** Recherche dossiers dans "C:\Program Files" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***
*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\kaled\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\kaled\locals~1\applic~1" ***
*** Recherche dossiers dans "C:\Documents and Settings\kaled\menudm~1\progra~1" ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Fichier(s) caché(s) :
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.dat
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.exe
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_nav.dat
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_navps.dat
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans "C:\WINDOWS\system32" *
* Recherche dans "C:\Documents and Settings\kaled\locals~1\applic~1" *
*** Recherche fichiers ***
C:\WINDOWS\system32\nvs2.inf trouvé !
*** Recherche clés spécifiques dans le Registre ***
HKEY_CURRENT_USER\Software\Lanconfig trouvé !
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans "C:\WINDOWS\system32" :
* Dans "C:\Documents and Settings\kaled\locals~1\applic~1" :
aksckmc.dat trouvé !
aksckmc_nav.dat trouvé !
aksckmc_navps.dat trouvé !
oeuek_nav.dat trouvé !
oeuek_navps.dat trouvé !
3)Recherche Certificats :
Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche fichiers connus :
*** Analyse terminée le 13/11/2008 à 18:39:26,12 ***
ok maintenant fais ceci stp :
▶ Relance navilog1
▶ Choisis cette fois option 2 taper 2
note : le bureau disparaît
▶redémarrage du pc
▶ mettre le rapport dans la réponse
▶ Relance navilog1
▶ Choisis cette fois option 2 taper 2
note : le bureau disparaît
▶redémarrage du pc
▶ mettre le rapport dans la réponse
et mnt stp?
Clean Navipromo version 3.6.9 commencé le 13/11/2008 à 18:42:41,54
Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "kaled"
Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 8.0.6001.18241
Système de fichiers : NTFS
Mode suppression automatique
avec prise en charge résultats Catchme et GNS
Nettoyage exécuté au redémarrage de l'ordinateur
*** Creation backups fichiers trouvés par Catchme ***
Copie vers "C:\Program Files\navilog1\Backupnavi"
Copie C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.dat réalisée avec succès !
Copie C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.exe réalisée avec succès !
Copie C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_nav.dat réalisée avec succès !
Copie C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_navps.dat réalisée avec succès !
*** Suppression des fichiers trouvés avec Catchme ***
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.dat supprimé !
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.exe supprimé !
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_nav.dat supprimé !
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_navps.dat supprimé !
** 2ème passage avec résultats Catchme **
* Dans "C:\WINDOWS\system32" *
* Dans "C:\Documents and Settings\kaled\locals~1\applic~1" *
*** Suppression avec sauvegardes résultats GenericNaviSearch ***
* Suppression dans "C:\WINDOWS\System32" *
* Suppression dans "C:\Documents and Settings\kaled\locals~1\applic~1" *
*** Suppression dossiers dans "C:\WINDOWS" ***
*** Suppression dossiers dans "C:\Program Files" ***
*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***
*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\kaled\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\kaled\locals~1\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\kaled\menudm~1\progra~1" ***
*** Suppression fichiers ***
C:\WINDOWS\system32\nvs2.inf supprimé !
*** Suppression fichiers temporaires ***
Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\kaled\locals~1\Temp effectué !
*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Suppression avec sauvegardes nouveaux fichiers Instant Access :
2)Recherche, création sauvegardes et suppression Heuristique :
* Dans "C:\WINDOWS\system32" *
* Dans "C:\Documents and Settings\kaled\locals~1\applic~1" *
aksckmc.dat trouvé !
Copie aksckmc.dat réalisée avec succès !
aksckmc.dat supprimé !
aksckmc_nav.dat trouvé !
Copie aksckmc_nav.dat réalisée avec succès !
aksckmc_nav.dat supprimé !
aksckmc_navps.dat trouvé !
Copie aksckmc_navps.dat réalisée avec succès !
aksckmc_navps.dat supprimé !
*** Sauvegarde du Registre vers dossier Safebackup ***
sauvegarde du Registre réalisée avec succès !
*** Nettoyage Registre ***
Nettoyage Registre Ok
*** Certificats ***
Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !
*** Nettoyage terminé le 13/11/2008 à 18:48:53,10 ***
Clean Navipromo version 3.6.9 commencé le 13/11/2008 à 18:42:41,54
Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "kaled"
Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 8.0.6001.18241
Système de fichiers : NTFS
Mode suppression automatique
avec prise en charge résultats Catchme et GNS
Nettoyage exécuté au redémarrage de l'ordinateur
*** Creation backups fichiers trouvés par Catchme ***
Copie vers "C:\Program Files\navilog1\Backupnavi"
Copie C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.dat réalisée avec succès !
Copie C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.exe réalisée avec succès !
Copie C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_nav.dat réalisée avec succès !
Copie C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_navps.dat réalisée avec succès !
*** Suppression des fichiers trouvés avec Catchme ***
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.dat supprimé !
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek.exe supprimé !
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_nav.dat supprimé !
C:\Documents and Settings\kaled\Local Settings\Application Data\oeuek_navps.dat supprimé !
** 2ème passage avec résultats Catchme **
* Dans "C:\WINDOWS\system32" *
* Dans "C:\Documents and Settings\kaled\locals~1\applic~1" *
*** Suppression avec sauvegardes résultats GenericNaviSearch ***
* Suppression dans "C:\WINDOWS\System32" *
* Suppression dans "C:\Documents and Settings\kaled\locals~1\applic~1" *
*** Suppression dossiers dans "C:\WINDOWS" ***
*** Suppression dossiers dans "C:\Program Files" ***
*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***
*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\kaled\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\kaled\locals~1\applic~1" ***
*** Suppression dossiers dans "C:\Documents and Settings\kaled\menudm~1\progra~1" ***
*** Suppression fichiers ***
C:\WINDOWS\system32\nvs2.inf supprimé !
*** Suppression fichiers temporaires ***
Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\kaled\locals~1\Temp effectué !
*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Suppression avec sauvegardes nouveaux fichiers Instant Access :
2)Recherche, création sauvegardes et suppression Heuristique :
* Dans "C:\WINDOWS\system32" *
* Dans "C:\Documents and Settings\kaled\locals~1\applic~1" *
aksckmc.dat trouvé !
Copie aksckmc.dat réalisée avec succès !
aksckmc.dat supprimé !
aksckmc_nav.dat trouvé !
Copie aksckmc_nav.dat réalisée avec succès !
aksckmc_nav.dat supprimé !
aksckmc_navps.dat trouvé !
Copie aksckmc_navps.dat réalisée avec succès !
aksckmc_navps.dat supprimé !
*** Sauvegarde du Registre vers dossier Safebackup ***
sauvegarde du Registre réalisée avec succès !
*** Nettoyage Registre ***
Nettoyage Registre Ok
*** Certificats ***
Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !
*** Nettoyage terminé le 13/11/2008 à 18:48:53,10 ***
ok maintenant tu peux faire ceci stp :
▶ Télécharge malwarebyte's anti-malware
▶ Voici un tutoriel pour t'aider à l'utiliser.
▶ Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
▶ Lance une analyse complète en cliquant sur "Exécuter un examen complet"
▶ Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"
▶ L'analyse peut durer un bon moment.....
▶ Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"
▶ Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"
▶ Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum
* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée
Et ensuite refais un nouveau rapport hijackthis stp
je reviens tout à l heure pour vérifier tes réponses ;-)
@+
▶ Télécharge malwarebyte's anti-malware
▶ Voici un tutoriel pour t'aider à l'utiliser.
▶ Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
▶ Lance une analyse complète en cliquant sur "Exécuter un examen complet"
▶ Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"
▶ L'analyse peut durer un bon moment.....
▶ Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"
▶ Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"
▶ Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum
* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée
Et ensuite refais un nouveau rapport hijackthis stp
je reviens tout à l heure pour vérifier tes réponses ;-)
@+
ok quand tu veux, je serai là...
Poste le rapport de malwarebytes et je te dirai la suite ;-)
Bonne soirée @+
Poste le rapport de malwarebytes et je te dirai la suite ;-)
Bonne soirée @+
ok maintenant j'ai terminé la recherche et voici le rapport :
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1395
Windows 5.1.2600 Service Pack 3
14/11/2008 11:23:40
mbam-log-2008-11-14 (11-23-40).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 110100
Temps écoulé: 2 hour(s), 54 minute(s), 43 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 14
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\kaled\Local Settings\Temporary Internet Files\Content.IE5\XP5TW8L1\c-setup[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP158\A0132368.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP158\A0132370.DLL (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP159\A0133334.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP159\A0133335.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP159\A0133336.DLL (Adware.AskSBAR) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP159\A0133363.dll (Adware.AskSBAR) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP168\A0140198.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP224\A0182108.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\k.txt (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Antivirus Scan.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\kaled\Favoris\SMS TRAP.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\kaled\Favoris\Antivirus Scan.url (Rogue.Link) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1395
Windows 5.1.2600 Service Pack 3
14/11/2008 11:23:40
mbam-log-2008-11-14 (11-23-40).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 110100
Temps écoulé: 2 hour(s), 54 minute(s), 43 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 14
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\kaled\Local Settings\Temporary Internet Files\Content.IE5\XP5TW8L1\c-setup[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP158\A0132368.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP158\A0132370.DLL (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP159\A0133334.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP159\A0133335.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP159\A0133336.DLL (Adware.AskSBAR) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP159\A0133363.dll (Adware.AskSBAR) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP168\A0140198.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22776CD9-C9E3-4097-9D42-FC8E7F1F9303}\RP224\A0182108.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\k.txt (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Antivirus Scan.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\kaled\Favoris\SMS TRAP.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\kaled\Favoris\Antivirus Scan.url (Rogue.Link) -> Quarantined and deleted successfully.
et voici le rapport hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:29, on 14/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\logiciels\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.topnet.tn/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ircdown.com/fr/index.php?rvs=hompag&d=79918891e=6079
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = https://www.topnet.tn/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = TopNet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\system32\IETie.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TOPNET\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [GhostSurf Reminder] "C:\Program Files\GhostSurf 2005\Privacy Control Center.exe" reminder
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] ~"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MaxTV.lnk = C:\Program Files\DMV\MaxTV4\maxtv.exe
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: LG SyncManager.lnk = ?
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2195ED1-580D-4D40-AC6F-A49E79A17101}: NameServer = 213.150.176.196 193.95.67.22
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Information Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:29, on 14/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\logiciels\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.topnet.tn/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ircdown.com/fr/index.php?rvs=hompag&d=79918891e=6079
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = https://www.topnet.tn/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = TopNet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\system32\IETie.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TOPNET\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [GhostSurf Reminder] "C:\Program Files\GhostSurf 2005\Privacy Control Center.exe" reminder
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] ~"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MaxTV.lnk = C:\Program Files\DMV\MaxTV4\maxtv.exe
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: LG SyncManager.lnk = ?
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2195ED1-580D-4D40-AC6F-A49E79A17101}: NameServer = 213.150.176.196 193.95.67.22
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Information Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
Salut !!
▶ Télécharge Combofix de sUBs
▶ et enregistre le sur le Bureau.
▶ désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware)
Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
ensuite envois le rapport et refais un nouveau rapport hijackthis stp
▶ Télécharge Combofix de sUBs
▶ et enregistre le sur le Bureau.
▶ désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware)
Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
ensuite envois le rapport et refais un nouveau rapport hijackthis stp
voici le rapport combofix :
ComboFix 08-11-12.02 - kaled 2008-11-14 17:34:49.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.57 [GMT 1:00]
Lancé depuis: c:\documents and settings\kaled\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\kaled\Favoris\Cheap Pharmacy Online.url
c:\documents and settings\kaled\Favoris\Search Online.url
c:\documents and settings\kaled\Favoris\VIP Casino.url
c:\windows\system32\wdsdtdsini.dll
D:\Autorun.inf
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-14 au 2008-11-14 ))))))))))))))))))))))))))))))))))))
.
2008-11-14 14:30 . 2008-11-14 14:30 <REP> d-------- c:\documents and settings\All Users\Application Data\Trymedia
2008-11-14 14:23 . 2008-11-14 14:23 <REP> d-------- c:\windows\LastGood
2008-11-14 14:18 . 2008-11-14 14:39 <REP> d-------- c:\program files\rFactorLexus
2008-11-13 18:24 . 2008-11-13 18:48 <REP> d-------- c:\program files\Navilog1
2008-11-13 17:19 . 2008-11-13 17:19 <REP> d-------- c:\documents and settings\kaled\Application Data\Malwarebytes
2008-11-13 17:18 . 2008-11-13 17:22 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-13 17:18 . 2008-11-13 17:18 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-13 17:18 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-13 17:18 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-13 16:08 . 2008-11-13 18:22 <REP> d-------- C:\ToolBar SD
2008-11-13 07:19 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-13 07:15 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-12 21:15 . 2008-11-14 11:21 22 --a------ c:\windows\RsConfig.ini
2008-11-12 19:58 . 2008-11-13 11:39 160 --a------ c:\windows\system32\BsMain.ini
2008-11-12 19:58 . 2008-11-12 20:02 136 -r-hs---- C:\rising.ini
2008-11-12 19:57 . 2008-11-14 14:03 <REP> dr------- C:\RavBin
2008-11-12 19:57 . 2008-11-12 19:47 237,168 --a------ c:\windows\system32\bsmain.exe
2008-11-12 19:57 . 2008-11-12 19:47 164,848 --a------ c:\windows\system32\drivers\HookSys.sys
2008-11-12 19:57 . 2008-11-12 19:46 113,264 --a------ c:\windows\system32\RavExt.dll
2008-11-12 19:57 . 2008-11-12 19:47 62,576 --a------ c:\windows\system32\drivers\HookNtos.sys
2008-11-12 19:57 . 2008-11-12 19:47 38,256 --a------ c:\windows\system32\drivers\HOOKREG.sys
2008-11-12 19:57 . 2008-11-12 19:47 30,704 --a------ c:\windows\system32\drivers\HookHelp.sys
2008-11-12 19:57 . 2008-11-12 19:47 13,808 --a------ c:\windows\system32\drivers\HookCont.sys
2008-11-12 19:57 . 2008-11-12 19:47 10,736 --a------ c:\windows\system32\drivers\RsNTGdi.sys
2008-11-12 19:56 . 2008-11-13 11:39 90 --a------ c:\windows\Rav.inf
2008-11-12 19:54 . 2008-11-12 19:54 <REP> d-------- c:\program files\Rising
2008-11-12 19:48 . 2008-11-12 19:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Rising
2008-11-12 19:48 . 2008-11-14 17:19 98 --a------ c:\windows\Rav.ini
2008-11-11 16:00 . 2008-11-11 16:00 <REP> d-------- C:\videooutput
2008-11-11 16:00 . 2007-02-25 15:36 383,238 --a------ c:\windows\system32\libmp3lame-0.dll
2008-11-09 18:39 . 2008-11-09 18:40 <REP> d-------- c:\program files\Windows Media Connect 2
2008-11-09 18:27 . 2008-11-09 18:27 <REP> d-------- c:\windows\system32\LogFiles
2008-11-09 18:27 . 2008-11-09 18:35 <REP> d-------- c:\windows\system32\drivers\UMDF
2008-11-09 18:17 . 2008-11-11 15:36 <REP> d-------- c:\program files\SuperCopier2
2008-11-09 11:27 . 2008-11-09 11:27 <REP> d-------- c:\program files\Fichiers communs\xing shared
2008-11-08 21:45 . 2008-11-08 21:45 <REP> d-------- c:\program files\SHOUTcast Source
2008-11-08 21:45 . 2008-11-08 21:45 <REP> d-------- c:\program files\MONOGRAM AMR SplitterDecoder
2008-11-08 21:45 . 2008-11-08 21:45 <REP> d-------- c:\program files\DScaler5
2008-11-08 21:45 . 2008-11-08 21:45 <REP> d-------- c:\program files\DirectVobSub
2008-11-08 21:45 . 2008-11-08 21:45 <REP> d-------- c:\program files\CD Audio Reader Filter
2008-11-08 21:39 . 2008-11-08 21:55 <REP> d-------- c:\program files\Zoom Player
2008-11-08 21:19 . 2008-11-08 21:20 <REP> d-------- c:\documents and settings\kaled\Application Data\Haihaisoft Universal Player
2008-11-08 21:19 . 2008-11-08 21:19 <REP> d-------- c:\documents and settings\All Users\Application Data\Haihaisoft
2008-11-08 21:18 . 2008-11-08 21:54 <REP> d-------- c:\program files\Haihaisoft Universal Player
2008-11-08 19:35 . 2008-11-08 19:35 <REP> d-------- c:\documents and settings\kaled\Application Data\kantaris
2008-11-08 19:34 . 2008-11-08 19:49 <REP> d-------- c:\program files\Kantaris
2008-11-08 13:26 . 2008-11-08 13:58 <REP> d-------- c:\program files\Hotspot_Shield
2008-11-08 13:26 . 2008-11-08 13:26 <REP> d-------- c:\program files\Conduit
2008-11-07 21:32 . 2008-11-07 21:32 <REP> d-------- c:\windows\system32\SpycatcherAgentSetupTemp
2008-11-07 21:31 . 2008-11-07 21:31 <REP> d-------- c:\documents and settings\All Users\Application Data\Tenebril
2008-11-07 21:29 . 2008-11-07 21:58 <REP> d-------- c:\program files\GhostSurf Platinum
2008-11-07 21:04 . 2008-11-07 21:58 <REP> d-------- c:\program files\GhostSurf
2008-11-07 20:41 . 2008-11-07 21:27 <REP> d-------- c:\program files\Ghost Navigator2_8_2
2008-11-07 18:27 . 2008-11-07 18:27 <REP> d--hs---- c:\documents and settings\kaled\PrivacIE
2008-11-07 18:24 . 2008-11-07 18:24 <REP> d-------- c:\program files\SweetIM
2008-11-07 15:55 . 2008-11-07 17:35 <REP> d-------- c:\program files\Spyware Doctor
2008-11-07 09:21 . 2008-11-07 09:22 <REP> d--h-c--- c:\windows\ie8
2008-11-05 20:02 . 1997-12-17 18:33 304,128 --a------ c:\windows\IsUninst.exe
2008-11-02 20:54 . 2008-11-02 20:57 <REP> d-------- c:\documents and settings\kaled\Application Data\vlc
2008-11-02 20:52 . 2008-11-02 20:52 <REP> d-------- c:\program files\VideoLAN
2008-10-24 12:54 . 2008-10-24 12:54 <REP> d-------- c:\documents and settings\kaled\Application Data\BitSpirit
2008-10-24 12:53 . 2008-10-26 16:52 <REP> d-------- c:\program files\BitSpirit
2008-10-24 11:13 . 2008-10-24 11:13 <REP> d-------- c:\program files\Fichiers communs\Adobe AIR
2008-10-24 08:33 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-10-16 16:20 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-10-16 16:16 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-10-16 16:15 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-16 16:15 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-16 16:15 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-16 16:15 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-14 16:04 --------- d-----w c:\program files\Fichiers communs\Akamai
2008-11-12 19:52 --------- d-----w c:\documents and settings\kaled\Application Data\Metacafe
2008-11-12 17:05 --------- d-----w c:\documents and settings\kaled\Application Data\Skype
2008-11-12 17:04 --------- d-----w c:\documents and settings\kaled\Application Data\skypePM
2008-11-11 14:55 --------- d-----w c:\program files\Fichiers communs\DVDVideoSoft
2008-11-11 14:55 --------- d-----w c:\program files\DVDVideoSoft
2008-11-11 12:38 --------- d-----w c:\program files\eMule
2008-11-09 10:27 --------- d-----w c:\program files\Fichiers communs\Real
2008-11-08 20:11 --------- d-----w c:\documents and settings\kaled\Application Data\DivX
2008-11-07 16:29 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-07 15:08 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-11-03 06:19 --------- d-----w c:\documents and settings\kaled\Application Data\Shareaza
2008-10-29 15:32 --------- d-----w c:\program files\Simply TV-Radio 2
2008-10-26 19:31 --------- d-----w c:\program files\Super Internet TV
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 08:21 --------- d-----w c:\program files\Winamp
2008-10-13 19:03 --------- d-----w c:\program files\ShiftCast
2008-10-12 19:06 --------- d-----w c:\program files\FDRLab
2008-10-12 19:06 --------- d-----w c:\documents and settings\kaled\Application Data\FDRLab
2008-10-12 18:51 --------- d-----w c:\program files\JLC's Software
2008-10-12 18:38 --------- d-----w c:\program files\PeerTV
2008-10-12 07:39 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-10 20:40 --------- d-----w c:\documents and settings\kaled\Application Data\DMV Technologies
2008-10-10 20:37 --------- d-----w c:\program files\DMV
2008-10-10 20:29 --------- d-----w c:\documents and settings\kaled\Application Data\ZiggyTV
2008-10-10 19:26 --------- d-----w c:\documents and settings\All Users\Application Data\TVU Networks
2008-10-10 19:00 --------- d-----w c:\program files\worldTVRT
2008-10-09 17:07 --------- d-----w c:\documents and settings\kaled\Application Data\Uniblue
2008-10-09 16:28 --------- d-----w c:\documents and settings\kaled\Application Data\Camfrog
2008-10-09 16:20 --------- d-----w c:\program files\Camfrog
2008-10-08 20:38 --------- d-----w c:\program files\ImTOO
2008-10-08 19:46 --------- d-----w c:\program files\Win TV Pro Free
2008-09-29 14:01 --------- d-----w c:\documents and settings\All Users\Application Data\Metacafe
2008-09-29 14:00 --------- d-----w c:\program files\Metacafe
2008-09-27 07:40 --------- d-----w c:\program files\Java
2008-09-26 21:41 --------- d-----w c:\documents and settings\kaled\Application Data\.BitTornado
2008-09-25 13:09 --------- d-----w c:\documents and settings\kaled\Application Data\FrostWire
2008-09-24 05:22 --------- d-----w c:\program files\BitComet
2008-09-23 19:20 --------- d-----w c:\program files\Plugin
2008-09-22 14:48 --------- d-----w c:\documents and settings\kaled\Application Data\Azureus
2008-09-22 14:46 --------- d-----w c:\documents and settings\All Users\Application Data\Azureus
2008-09-22 14:31 --------- d-----w c:\documents and settings\kaled\Application Data\uTorrent
2008-09-22 11:52 --------- d-----w c:\program files\DietMP3
2008-09-22 11:39 --------- d-----w c:\program files\Fichiers communs\AVSMedia
2008-09-22 11:36 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-09-22 11:32 --------- d-----w c:\documents and settings\kaled\Application Data\Ringtone
2008-08-28 09:31 62,976 ----a-w c:\windows\PegtopUI.exe
2008-06-12 14:18 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2008-10-08 173368]
[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2008-10-08 12:22 1172792 --a------ c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"CnxDslTaskBar"="c:\program files\TOPNET\AccessRunner ADSL\CnxDslTb.exe" [2005-06-22 462848]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2008-10-08 111928]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-11-09 185872]
"RavTask"="c:\program files\Rising\Rav\RavTask.exe" [2008-11-12 211568]
"SoundMan"="SOUNDMAN.EXE" [2005-02-23 c:\windows\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - c:\program files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2006-05-12 581693]
LG SyncManager.lnk - c:\program files\LG PC Suite\LG PC Sync\LGSyncManager.exe [2005-04-24 229376]
Metacafe.lnk - c:\program files\Metacafe\MetacafeAgent.exe [2008-06-29 145736]
Utility Tray.lnk - c:\windows\system32\sistray.exe [2008-06-10 331776]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{32CD708B-60A7-4C00-9377-D73EAA495F0F}"= "c:\windows\system32\RavExt.dll" [2008-11-12 113264]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\JLC's Software\\Internet TV\\Internet TV.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Java\\jre1.6.0_06\\bin\\javaw.exe"=
"c:\\Program Files\\PeerTV\\PeerCast.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9420:TCP"= 9420:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
"23275:TCP"= 23275:TCP:BitComet 23275 TCP
"23275:UDP"= 23275:UDP:BitComet 23275 UDP
R0 RsNTGDI;RsNTGDI;c:\windows\system32\Drivers\RsNTGdi.sys [2008-11-12 10736]
R1 HookCont;HookCont;c:\windows\system32\drivers\HookCont.sys [2008-11-12 13808]
R1 HookNtos;HookNtos;c:\windows\system32\drivers\HookNtos.sys [2008-11-12 62576]
R1 HookReg;HookReg;c:\windows\system32\drivers\HookReg.sys [2008-11-12 38256]
R1 HookSys;HookSys;c:\windows\system32\drivers\HookSys.sys [2008-11-12 164848]
R2 ADSLAutoconnect;ADSLAutoconnect;c:\program files\ADSL Autoconnect\ADSL Autoconnect.exe [2008-06-10 446464]
R2 Akamai;Akamai;c:\windows\System32\svchost.exe [2008-04-14 14336]
R2 RsCCenter;Rising Process Communication Center;c:\program files\Rising\Rav\CCenter.exe [2008-11-12 162416]
R3 CnxEtP;TOPNET ADSL USB WAN Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys [2005-06-22 60288]
R3 CnxEtU;TOPNET ADSL ADU-2110 USB Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys [2005-06-22 646784]
R3 CnxTgN;TOPNET ADU-2110 USB WAN Adapter Driver;c:\windows\system32\DRIVERS\CnxTgN.sys [2005-06-22 108675]
S2 RsRavMon;Rising RealTime Monitor;c:\program files\RISING\RAV\Ravmond.exe [2008-11-12 395888]
S3 USBSTOR;Pilote de stockage de masse USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3cd7fc3e-3f9c-11dd-bdba-001485784397}]
\Shell\AutoRun\command - F:\ntde1ect.com
\Shell\explore\Command - F:\ntde1ect.com
\Shell\open\Command - F:\ntde1ect.com
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-11-14 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-Messenger (Yahoo!) - ~c:\program files\Yahoo!\Messenger\YahooMessenger.exe
HKCU-Run-fsm - (no file)
HKLM-Run-GhostSurf Reminder - c:\program files\GhostSurf 2005\Privacy Control Center.exe
.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\kaled\Application Data\Mozilla\Firefox\Profiles\kq5sanvh.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fr.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-14 17:37:55
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Akamai]
"ServiceDll"="C:/Program Files/Fichiers communs/Akamai/rswin_3447.dll"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Akamai]
"ServiceDll"="C:/Program Files/Fichiers communs/Akamai/rswin_3447.dll"
.
Heure de fin: 2008-11-14 17:44:52
ComboFix-quarantined-files.txt 2008-11-14 16:43:49
Avant-CF: 8 933 453 824 octets libres
Après-CF: 9,103,802,368 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
259 --- E O F --- 2008-11-14 09:45:00
ComboFix 08-11-12.02 - kaled 2008-11-14 17:34:49.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.57 [GMT 1:00]
Lancé depuis: c:\documents and settings\kaled\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\kaled\Favoris\Cheap Pharmacy Online.url
c:\documents and settings\kaled\Favoris\Search Online.url
c:\documents and settings\kaled\Favoris\VIP Casino.url
c:\windows\system32\wdsdtdsini.dll
D:\Autorun.inf
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-14 au 2008-11-14 ))))))))))))))))))))))))))))))))))))
.
2008-11-14 14:30 . 2008-11-14 14:30 <REP> d-------- c:\documents and settings\All Users\Application Data\Trymedia
2008-11-14 14:23 . 2008-11-14 14:23 <REP> d-------- c:\windows\LastGood
2008-11-14 14:18 . 2008-11-14 14:39 <REP> d-------- c:\program files\rFactorLexus
2008-11-13 18:24 . 2008-11-13 18:48 <REP> d-------- c:\program files\Navilog1
2008-11-13 17:19 . 2008-11-13 17:19 <REP> d-------- c:\documents and settings\kaled\Application Data\Malwarebytes
2008-11-13 17:18 . 2008-11-13 17:22 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-13 17:18 . 2008-11-13 17:18 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-13 17:18 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-13 17:18 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-13 16:08 . 2008-11-13 18:22 <REP> d-------- C:\ToolBar SD
2008-11-13 07:19 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-13 07:15 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-12 21:15 . 2008-11-14 11:21 22 --a------ c:\windows\RsConfig.ini
2008-11-12 19:58 . 2008-11-13 11:39 160 --a------ c:\windows\system32\BsMain.ini
2008-11-12 19:58 . 2008-11-12 20:02 136 -r-hs---- C:\rising.ini
2008-11-12 19:57 . 2008-11-14 14:03 <REP> dr------- C:\RavBin
2008-11-12 19:57 . 2008-11-12 19:47 237,168 --a------ c:\windows\system32\bsmain.exe
2008-11-12 19:57 . 2008-11-12 19:47 164,848 --a------ c:\windows\system32\drivers\HookSys.sys
2008-11-12 19:57 . 2008-11-12 19:46 113,264 --a------ c:\windows\system32\RavExt.dll
2008-11-12 19:57 . 2008-11-12 19:47 62,576 --a------ c:\windows\system32\drivers\HookNtos.sys
2008-11-12 19:57 . 2008-11-12 19:47 38,256 --a------ c:\windows\system32\drivers\HOOKREG.sys
2008-11-12 19:57 . 2008-11-12 19:47 30,704 --a------ c:\windows\system32\drivers\HookHelp.sys
2008-11-12 19:57 . 2008-11-12 19:47 13,808 --a------ c:\windows\system32\drivers\HookCont.sys
2008-11-12 19:57 . 2008-11-12 19:47 10,736 --a------ c:\windows\system32\drivers\RsNTGdi.sys
2008-11-12 19:56 . 2008-11-13 11:39 90 --a------ c:\windows\Rav.inf
2008-11-12 19:54 . 2008-11-12 19:54 <REP> d-------- c:\program files\Rising
2008-11-12 19:48 . 2008-11-12 19:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Rising
2008-11-12 19:48 . 2008-11-14 17:19 98 --a------ c:\windows\Rav.ini
2008-11-11 16:00 . 2008-11-11 16:00 <REP> d-------- C:\videooutput
2008-11-11 16:00 . 2007-02-25 15:36 383,238 --a------ c:\windows\system32\libmp3lame-0.dll
2008-11-09 18:39 . 2008-11-09 18:40 <REP> d-------- c:\program files\Windows Media Connect 2
2008-11-09 18:27 . 2008-11-09 18:27 <REP> d-------- c:\windows\system32\LogFiles
2008-11-09 18:27 . 2008-11-09 18:35 <REP> d-------- c:\windows\system32\drivers\UMDF
2008-11-09 18:17 . 2008-11-11 15:36 <REP> d-------- c:\program files\SuperCopier2
2008-11-09 11:27 . 2008-11-09 11:27 <REP> d-------- c:\program files\Fichiers communs\xing shared
2008-11-08 21:45 . 2008-11-08 21:45 <REP> d-------- c:\program files\SHOUTcast Source
2008-11-08 21:45 . 2008-11-08 21:45 <REP> d-------- c:\program files\MONOGRAM AMR SplitterDecoder
2008-11-08 21:45 . 2008-11-08 21:45 <REP> d-------- c:\program files\DScaler5
2008-11-08 21:45 . 2008-11-08 21:45 <REP> d-------- c:\program files\DirectVobSub
2008-11-08 21:45 . 2008-11-08 21:45 <REP> d-------- c:\program files\CD Audio Reader Filter
2008-11-08 21:39 . 2008-11-08 21:55 <REP> d-------- c:\program files\Zoom Player
2008-11-08 21:19 . 2008-11-08 21:20 <REP> d-------- c:\documents and settings\kaled\Application Data\Haihaisoft Universal Player
2008-11-08 21:19 . 2008-11-08 21:19 <REP> d-------- c:\documents and settings\All Users\Application Data\Haihaisoft
2008-11-08 21:18 . 2008-11-08 21:54 <REP> d-------- c:\program files\Haihaisoft Universal Player
2008-11-08 19:35 . 2008-11-08 19:35 <REP> d-------- c:\documents and settings\kaled\Application Data\kantaris
2008-11-08 19:34 . 2008-11-08 19:49 <REP> d-------- c:\program files\Kantaris
2008-11-08 13:26 . 2008-11-08 13:58 <REP> d-------- c:\program files\Hotspot_Shield
2008-11-08 13:26 . 2008-11-08 13:26 <REP> d-------- c:\program files\Conduit
2008-11-07 21:32 . 2008-11-07 21:32 <REP> d-------- c:\windows\system32\SpycatcherAgentSetupTemp
2008-11-07 21:31 . 2008-11-07 21:31 <REP> d-------- c:\documents and settings\All Users\Application Data\Tenebril
2008-11-07 21:29 . 2008-11-07 21:58 <REP> d-------- c:\program files\GhostSurf Platinum
2008-11-07 21:04 . 2008-11-07 21:58 <REP> d-------- c:\program files\GhostSurf
2008-11-07 20:41 . 2008-11-07 21:27 <REP> d-------- c:\program files\Ghost Navigator2_8_2
2008-11-07 18:27 . 2008-11-07 18:27 <REP> d--hs---- c:\documents and settings\kaled\PrivacIE
2008-11-07 18:24 . 2008-11-07 18:24 <REP> d-------- c:\program files\SweetIM
2008-11-07 15:55 . 2008-11-07 17:35 <REP> d-------- c:\program files\Spyware Doctor
2008-11-07 09:21 . 2008-11-07 09:22 <REP> d--h-c--- c:\windows\ie8
2008-11-05 20:02 . 1997-12-17 18:33 304,128 --a------ c:\windows\IsUninst.exe
2008-11-02 20:54 . 2008-11-02 20:57 <REP> d-------- c:\documents and settings\kaled\Application Data\vlc
2008-11-02 20:52 . 2008-11-02 20:52 <REP> d-------- c:\program files\VideoLAN
2008-10-24 12:54 . 2008-10-24 12:54 <REP> d-------- c:\documents and settings\kaled\Application Data\BitSpirit
2008-10-24 12:53 . 2008-10-26 16:52 <REP> d-------- c:\program files\BitSpirit
2008-10-24 11:13 . 2008-10-24 11:13 <REP> d-------- c:\program files\Fichiers communs\Adobe AIR
2008-10-24 08:33 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-10-16 16:20 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-10-16 16:16 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-10-16 16:15 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-16 16:15 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-16 16:15 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-16 16:15 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-14 16:04 --------- d-----w c:\program files\Fichiers communs\Akamai
2008-11-12 19:52 --------- d-----w c:\documents and settings\kaled\Application Data\Metacafe
2008-11-12 17:05 --------- d-----w c:\documents and settings\kaled\Application Data\Skype
2008-11-12 17:04 --------- d-----w c:\documents and settings\kaled\Application Data\skypePM
2008-11-11 14:55 --------- d-----w c:\program files\Fichiers communs\DVDVideoSoft
2008-11-11 14:55 --------- d-----w c:\program files\DVDVideoSoft
2008-11-11 12:38 --------- d-----w c:\program files\eMule
2008-11-09 10:27 --------- d-----w c:\program files\Fichiers communs\Real
2008-11-08 20:11 --------- d-----w c:\documents and settings\kaled\Application Data\DivX
2008-11-07 16:29 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-07 15:08 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-11-03 06:19 --------- d-----w c:\documents and settings\kaled\Application Data\Shareaza
2008-10-29 15:32 --------- d-----w c:\program files\Simply TV-Radio 2
2008-10-26 19:31 --------- d-----w c:\program files\Super Internet TV
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 08:21 --------- d-----w c:\program files\Winamp
2008-10-13 19:03 --------- d-----w c:\program files\ShiftCast
2008-10-12 19:06 --------- d-----w c:\program files\FDRLab
2008-10-12 19:06 --------- d-----w c:\documents and settings\kaled\Application Data\FDRLab
2008-10-12 18:51 --------- d-----w c:\program files\JLC's Software
2008-10-12 18:38 --------- d-----w c:\program files\PeerTV
2008-10-12 07:39 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-10 20:40 --------- d-----w c:\documents and settings\kaled\Application Data\DMV Technologies
2008-10-10 20:37 --------- d-----w c:\program files\DMV
2008-10-10 20:29 --------- d-----w c:\documents and settings\kaled\Application Data\ZiggyTV
2008-10-10 19:26 --------- d-----w c:\documents and settings\All Users\Application Data\TVU Networks
2008-10-10 19:00 --------- d-----w c:\program files\worldTVRT
2008-10-09 17:07 --------- d-----w c:\documents and settings\kaled\Application Data\Uniblue
2008-10-09 16:28 --------- d-----w c:\documents and settings\kaled\Application Data\Camfrog
2008-10-09 16:20 --------- d-----w c:\program files\Camfrog
2008-10-08 20:38 --------- d-----w c:\program files\ImTOO
2008-10-08 19:46 --------- d-----w c:\program files\Win TV Pro Free
2008-09-29 14:01 --------- d-----w c:\documents and settings\All Users\Application Data\Metacafe
2008-09-29 14:00 --------- d-----w c:\program files\Metacafe
2008-09-27 07:40 --------- d-----w c:\program files\Java
2008-09-26 21:41 --------- d-----w c:\documents and settings\kaled\Application Data\.BitTornado
2008-09-25 13:09 --------- d-----w c:\documents and settings\kaled\Application Data\FrostWire
2008-09-24 05:22 --------- d-----w c:\program files\BitComet
2008-09-23 19:20 --------- d-----w c:\program files\Plugin
2008-09-22 14:48 --------- d-----w c:\documents and settings\kaled\Application Data\Azureus
2008-09-22 14:46 --------- d-----w c:\documents and settings\All Users\Application Data\Azureus
2008-09-22 14:31 --------- d-----w c:\documents and settings\kaled\Application Data\uTorrent
2008-09-22 11:52 --------- d-----w c:\program files\DietMP3
2008-09-22 11:39 --------- d-----w c:\program files\Fichiers communs\AVSMedia
2008-09-22 11:36 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-09-22 11:32 --------- d-----w c:\documents and settings\kaled\Application Data\Ringtone
2008-08-28 09:31 62,976 ----a-w c:\windows\PegtopUI.exe
2008-06-12 14:18 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2008-10-08 173368]
[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2008-10-08 12:22 1172792 --a------ c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"CnxDslTaskBar"="c:\program files\TOPNET\AccessRunner ADSL\CnxDslTb.exe" [2005-06-22 462848]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2008-10-08 111928]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-11-09 185872]
"RavTask"="c:\program files\Rising\Rav\RavTask.exe" [2008-11-12 211568]
"SoundMan"="SOUNDMAN.EXE" [2005-02-23 c:\windows\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - c:\program files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2006-05-12 581693]
LG SyncManager.lnk - c:\program files\LG PC Suite\LG PC Sync\LGSyncManager.exe [2005-04-24 229376]
Metacafe.lnk - c:\program files\Metacafe\MetacafeAgent.exe [2008-06-29 145736]
Utility Tray.lnk - c:\windows\system32\sistray.exe [2008-06-10 331776]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{32CD708B-60A7-4C00-9377-D73EAA495F0F}"= "c:\windows\system32\RavExt.dll" [2008-11-12 113264]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\JLC's Software\\Internet TV\\Internet TV.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Java\\jre1.6.0_06\\bin\\javaw.exe"=
"c:\\Program Files\\PeerTV\\PeerCast.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9420:TCP"= 9420:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
"23275:TCP"= 23275:TCP:BitComet 23275 TCP
"23275:UDP"= 23275:UDP:BitComet 23275 UDP
R0 RsNTGDI;RsNTGDI;c:\windows\system32\Drivers\RsNTGdi.sys [2008-11-12 10736]
R1 HookCont;HookCont;c:\windows\system32\drivers\HookCont.sys [2008-11-12 13808]
R1 HookNtos;HookNtos;c:\windows\system32\drivers\HookNtos.sys [2008-11-12 62576]
R1 HookReg;HookReg;c:\windows\system32\drivers\HookReg.sys [2008-11-12 38256]
R1 HookSys;HookSys;c:\windows\system32\drivers\HookSys.sys [2008-11-12 164848]
R2 ADSLAutoconnect;ADSLAutoconnect;c:\program files\ADSL Autoconnect\ADSL Autoconnect.exe [2008-06-10 446464]
R2 Akamai;Akamai;c:\windows\System32\svchost.exe [2008-04-14 14336]
R2 RsCCenter;Rising Process Communication Center;c:\program files\Rising\Rav\CCenter.exe [2008-11-12 162416]
R3 CnxEtP;TOPNET ADSL USB WAN Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys [2005-06-22 60288]
R3 CnxEtU;TOPNET ADSL ADU-2110 USB Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys [2005-06-22 646784]
R3 CnxTgN;TOPNET ADU-2110 USB WAN Adapter Driver;c:\windows\system32\DRIVERS\CnxTgN.sys [2005-06-22 108675]
S2 RsRavMon;Rising RealTime Monitor;c:\program files\RISING\RAV\Ravmond.exe [2008-11-12 395888]
S3 USBSTOR;Pilote de stockage de masse USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3cd7fc3e-3f9c-11dd-bdba-001485784397}]
\Shell\AutoRun\command - F:\ntde1ect.com
\Shell\explore\Command - F:\ntde1ect.com
\Shell\open\Command - F:\ntde1ect.com
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-11-14 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-Messenger (Yahoo!) - ~c:\program files\Yahoo!\Messenger\YahooMessenger.exe
HKCU-Run-fsm - (no file)
HKLM-Run-GhostSurf Reminder - c:\program files\GhostSurf 2005\Privacy Control Center.exe
.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\kaled\Application Data\Mozilla\Firefox\Profiles\kq5sanvh.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fr.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-14 17:37:55
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Akamai]
"ServiceDll"="C:/Program Files/Fichiers communs/Akamai/rswin_3447.dll"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Akamai]
"ServiceDll"="C:/Program Files/Fichiers communs/Akamai/rswin_3447.dll"
.
Heure de fin: 2008-11-14 17:44:52
ComboFix-quarantined-files.txt 2008-11-14 16:43:49
Avant-CF: 8 933 453 824 octets libres
Après-CF: 9,103,802,368 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
259 --- E O F --- 2008-11-14 09:45:00
et voici le log hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:54:10, on 14/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\PROGRAM FILES\RISING\RAV\RavMon.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\logiciels\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ircdown.com/fr/index.php?rvs=hompag&d=79918891e=6079
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = https://www.topnet.tn/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\system32\IETie.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TOPNET\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MaxTV.lnk = C:\Program Files\DMV\MaxTV4\maxtv.exe
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: LG SyncManager.lnk = ?
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2195ED1-580D-4D40-AC6F-A49E79A17101}: NameServer = 213.150.176.196 193.95.67.20
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Information Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:54:10, on 14/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\PROGRAM FILES\RISING\RAV\RavMon.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\logiciels\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ircdown.com/fr/index.php?rvs=hompag&d=79918891e=6079
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = https://www.topnet.tn/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\system32\IETie.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\TOPNET\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MaxTV.lnk = C:\Program Files\DMV\MaxTV4\maxtv.exe
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: LG SyncManager.lnk = ?
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2195ED1-580D-4D40-AC6F-A49E79A17101}: NameServer = 213.150.176.196 193.95.67.20
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Information Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
Salut !!
Relance hijackthis en cliquant sur scan only et coches ces lignes stp :
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\system32\IETie.dll (file missing)
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: LG SyncManager.lnk = ?
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
puis tu cliques sur fix checked.
ensuite :
▶ Télécharge JavaRa.zip
▶ Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)
▶ Double-clique sur le répertoire JavaRa obtenu.
▶ Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher)
▶ Clique sur Search For Updates.
▶ Sélectionne Update Using jucheck.exe puis clique sur Search.
▶ Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes.
▶ Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions.
▶ Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.
▶ Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse.
* Note : le rapport se trouve aussi là : ( C:\JavaRa.log )
▶ Ferme l'application et dis moi si tu as encore des problèmes.
Relance hijackthis en cliquant sur scan only et coches ces lignes stp :
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\system32\IETie.dll (file missing)
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: LG SyncManager.lnk = ?
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
puis tu cliques sur fix checked.
ensuite :
▶ Télécharge JavaRa.zip
▶ Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)
▶ Double-clique sur le répertoire JavaRa obtenu.
▶ Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher)
▶ Clique sur Search For Updates.
▶ Sélectionne Update Using jucheck.exe puis clique sur Search.
▶ Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes.
▶ Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions.
▶ Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.
▶ Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse.
* Note : le rapport se trouve aussi là : ( C:\JavaRa.log )
▶ Ferme l'application et dis moi si tu as encore des problèmes.
voici le rapport complet de java ra :
JavaRa 1.11 Removal Log.
Report follows after line.
------------------------------------
The JavaRa removal process was started on Sat Nov 15 18:23:29 2008
Found and removed: C:\Program Files\Java\jre1.6.0_06
Found and removed: Software\JavaSoft\Java2D\1.5.0
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}
Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610006
Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610006
Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610006
Found and removed: SOFTWARE\Classes\JavaPlugin.160_06
Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_06
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_06
Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610006
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610006
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610006
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160060}
Found and removed: Software\Classes\JavaPlugin.160_06
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_06\
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_06\bin\
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_06
Found and removed: Software\JavaSoft\Java2D\1.6.0_06
Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_06
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}
------------------------------------
Finished reporting.
et mnt? t'a lu mon message privé ( les problemes de la fenetre bleu ) ?
JavaRa 1.11 Removal Log.
Report follows after line.
------------------------------------
The JavaRa removal process was started on Sat Nov 15 18:23:29 2008
Found and removed: C:\Program Files\Java\jre1.6.0_06
Found and removed: Software\JavaSoft\Java2D\1.5.0
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}
Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610006
Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610006
Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610006
Found and removed: SOFTWARE\Classes\JavaPlugin.160_06
Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_06
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_06
Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610006
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610006
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610006
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160060}
Found and removed: Software\Classes\JavaPlugin.160_06
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_06\
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_06\bin\
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_06
Found and removed: Software\JavaSoft\Java2D\1.6.0_06
Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_06
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}
------------------------------------
Finished reporting.
et mnt? t'a lu mon message privé ( les problemes de la fenetre bleu ) ?
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
BIOS : Award Modular BIOS v6.00PG
USER : kaled ( Administrator )
BOOT : Normal boot
Antivirus : Rising Antivirus (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:7 Go)
D:\ (Local Disk) - NTFS - Total:37 Go (Free:2 Go)
E:\ (CD or DVD)
"C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
Option : [1] ( 13/11/2008|16:11 )
-----------\\ Recherche de Fichiers / Dossiers ...
C:\DOCUME~1\kaled\LOCALS~1\Temp\nsd4D.tmp
C:\DOCUME~1\kaled\LOCALS~1\Temp\nsh122.tmp
C:\DOCUME~1\kaled\LOCALS~1\Temp\nst10D.tmp
C:\DOCUME~1\kaled\LOCALS~1\Temp\nsxF9.tmp
Faites les mises à jour
puis en mode sans échec
Lancez le ,en examen complet ,sur tous tes disques durs
Une fois le scan terminé, cliquez sur supprimer