L'invasion des pubs - Page 4

Précédent
  • 1
  • 2
  • 3
  • 4
  1. Utilisateur anonyme
     
    On recommence,
    Télécharge Navilog1 depuis-ce lien :
    http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

    Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
    Ensuite double clique sur navilog1.exe pour lancer l'installation.

    Une fois l'installation terminée, le fix s'exécutera automatiquement.
    (Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

    Au menu principal, Fais le choix 1 >> Recherche
    Laisse toi guider et patiente.
    Patiente jusqu'au message :
    *** Analyse Termine le ..... *** >>>>> Le fix peut durer une dizaine de minutes ;)
    Appuie sur une touche le bloc note va s'ouvrir.
    Copie-colle le rapport ici.

    A toute.
    ++
    0
  2. karimosouli
     
    tien:

    Search Navipromo version 3.6.9 commencé le 29/11/2008 à 15:19:00,43

    !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
    !!! Postez ce rapport sur le forum pour le faire analyser !!!
    !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

    Outil exécuté depuis C:\Program Files\navilog1
    Session actuelle : "Djouher"

    Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO

    Microsoft Windows XP [version 5.1.2600]
    Internet Explorer : 6.0.2900.2180
    Système de fichiers : NTFS

    Recherche executé en mode normal

    *** Recherche Programmes installés ***

    *** Recherche dossiers dans "C:\WINDOWS" ***

    *** Recherche dossiers dans "C:\Program Files" ***

    *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

    *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***

    *** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

    *** Recherche dossiers dans "C:\Documents and Settings\Djouher\applic~1" ***

    *** Recherche dossiers dans "C:\DOCUME~1\MOHAME~1\applic~1" ***

    *** Recherche dossiers dans "C:\DOCUME~1\PROPRI~1\applic~1" ***

    *** Recherche dossiers dans "C:\Documents and Settings\Djouher\locals~1\applic~1" ***

    *** Recherche dossiers dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" ***

    *** Recherche dossiers dans "C:\Documents and Settings\Djouher\menudm~1\progra~1" ***

    *** Recherche dossiers dans "C:\DOCUME~1\MOHAME~1\menudm~1\progra~1" ***

    *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
    pour + d'infos : http://www.gmer.net

    *** Recherche avec GenericNaviSearch ***
    !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
    !!! A vérifier impérativement avant toute suppression manuelle !!!

    * Recherche dans "C:\WINDOWS\system32" *

    * Recherche dans "C:\Documents and Settings\Djouher\locals~1\applic~1" *

    * Recherche dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" *

    *** Recherche fichiers ***

    *** Recherche clés spécifiques dans le Registre ***

    *** Module de Recherche complémentaire ***
    (Recherche fichiers spécifiques)

    1)Recherche nouveaux fichiers Instant Access :

    2)Recherche Heuristique :

    * Dans "C:\WINDOWS\system32" :

    * Dans "C:\Documents and Settings\Djouher\locals~1\applic~1" :

    * Dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" :

    3)Recherche Certificats :

    Certificat Egroup absent !
    Certificat Electronic-Group absent !
    Certificat Montorgueil absent !
    Certificat OOO-Favorit absent !
    Certificat Sunny-Day-Design-Ltd absent !

    4)Recherche fichiers connus :

    *** Analyse terminée le 29/11/2008 à 15:29:03,10 ***
    0
  3. Utilisateur anonyme
     
    --------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
    !! déconnecte toi, ferme toutes tes applications en cours et DÉSACTIVE TOUTES TES DÉFENSES (anti-virus, antispyware, pare-feu) le temps de la manipulation : en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!

    ---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

    Tuto ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
    ---------------------------------------------------------------------------------------------------------------------------------

    Ensuite :

    Double-clique sur C-Fix.exe (= combofix.exe ) .

    Appuie sur une touche pour démarrer le scan .

    Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

    Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp
    0
  4. karimosouli
     
    tien :

    ComboFix 08-11-29.03 - Djouher 2008-11-30 12:44:49.2 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.209 [GMT 1:00]
    Lancé depuis: c:\documents and settings\Djouher\Bureau\ComboFix.exe
    Commutateurs utilisés :: c:\documents and settings\Djouher\Bureau\WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
    * Un nouveau point de restauration a été créé
    .

    ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-28 au 2008-11-30 ))))))))))))))))))))))))))))))))))))
    .

    2008-11-29 14:47 . 2008-11-29 15:29 <REP> d-------- c:\program files\Navilog1
    2008-11-28 20:30 . 2008-11-29 13:26 <REP> d-------- c:\program files\FindyKill
    2008-11-26 21:16 . 2008-11-29 13:26 <REP> d-------- c:\windows\ERUNT
    2008-11-26 21:16 . 2008-11-26 21:42 <REP> d-------- C:\Backups
    2008-11-25 20:00 . 2008-11-25 20:00 <REP> d-------- c:\documents and settings\Djouher\Application Data\Malwarebytes
    2008-11-25 20:00 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
    2008-11-25 19:59 . 2008-11-25 20:00 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
    2008-11-25 19:59 . 2008-11-25 19:59 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2008-11-25 19:59 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
    2008-11-24 22:03 . 2008-11-24 22:03 <REP> d-------- c:\program files\Auslogics
    2008-11-24 22:03 . 2008-11-24 22:03 <REP> d-------- c:\documents and settings\Djouher\Application Data\Auslogics
    2008-11-23 18:52 . 2008-11-23 19:35 <REP> d-------- c:\program files\Ad-remover
    2008-11-23 17:57 . 2008-11-23 17:58 <REP> d-------- c:\program files\Spyware Terminator
    2008-11-23 17:57 . 2008-11-23 17:58 <REP> d-------- c:\documents and settings\Djouher\Application Data\Spyware Terminator
    2008-11-23 17:57 . 2008-11-23 17:57 <REP> d-------- c:\documents and settings\All Users\Application Data\Spyware Terminator
    2008-11-23 17:57 . 2008-11-23 17:57 142,592 --a------ c:\windows\system32\drivers\sp_rsdrv2.sys
    2008-11-22 13:03 . 2008-11-22 13:03 <REP> d-------- c:\documents and settings\Djouher\Application Data\Phoenix
    2008-11-21 09:52 . 2008-11-21 09:54 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
    2008-11-19 13:33 . 2008-11-21 19:58 <REP> d-------- c:\program files\weblin
    2008-11-19 13:32 . 2008-11-21 19:58 <REP> d-------- c:\documents and settings\Djouher\Application Data\zweitgeist
    2008-11-15 22:48 . 2008-11-15 22:48 0 --ah----- c:\windows\SwSys2.bmp
    2008-11-15 22:48 . 2008-11-15 22:48 0 --ah----- c:\windows\SwSys1.bmp
    2008-11-15 22:44 . 2008-11-21 19:56 <REP> d-------- c:\program files\Legacy Interactive
    2008-11-09 11:12 . 2008-11-09 11:12 <REP> d-------- c:\program files\VideoLAN
    2008-11-09 10:20 . 2002-07-09 18:07 724,992 --------- c:\windows\NuNinst.exe
    2008-11-09 10:19 . 2002-03-13 14:13 610,304 --------- c:\windows\UNNMP.exe
    2008-11-09 10:19 . 2002-03-13 14:44 39,936 --------- c:\windows\UNNMP.cfg
    2008-11-09 10:18 . 2008-11-21 09:40 <REP> d-------- c:\program files\Ahead
    2008-11-03 20:43 . 2008-11-03 20:43 <REP> d-------- c:\windows\system32\Midnight Club Los Angeles dir
    2008-11-03 20:43 . 2008-11-03 20:43 520,192 --a------ c:\windows\system32\Midnight Club Los Angeles.scr
    2008-11-02 21:25 . 2008-11-02 21:25 <REP> d-------- c:\documents and settings\Djouher\Application Data\OpenOffice.org2
    2008-11-02 11:23 . 2008-11-03 10:39 <REP> d-------- c:\documents and settings\Djouher\Application Data\Epson
    2008-11-01 20:20 . 2008-11-01 20:20 0 --a------ c:\windows\EEventManager.INI
    2008-11-01 19:21 . 2007-12-07 03:08 86,528 --a------ c:\windows\system32\E_FLBEME.DLL
    2008-11-01 19:21 . 2007-12-07 03:01 78,848 --a------ c:\windows\system32\E_FD4BEME.DLL
    2008-11-01 19:21 . 2007-04-10 02:06 8,192 --a------ c:\windows\system32\E_DCINST.DLL
    2008-11-01 19:19 . 2008-11-01 19:19 <REP> d-------- c:\documents and settings\All Users\Application Data\UDL
    2008-11-01 19:17 . 2008-11-01 19:18 <REP> d-------- c:\program files\Epson Software
    2008-11-01 19:15 . 2008-11-01 19:22 <REP> d-------- c:\documents and settings\All Users\Application Data\EPSON
    2008-10-27 20:16 . 2003-07-02 17:54 475,136 --a------ c:\windows\system32\SLLights.dll
    2008-10-27 20:16 . 2003-07-02 17:23 401,408 --a------ c:\windows\system32\slcpappl.cpl
    2008-10-27 20:16 . 2003-07-02 17:12 376,832 --a------ c:\windows\system32\slmh.exe
    2008-10-27 20:16 . 2003-07-02 17:12 351,388 --a------ c:\windows\system32\slmh.cab
    2008-10-27 20:16 . 2003-07-02 16:39 167,936 --a------ c:\windows\system32\minirec.exe
    2008-10-27 20:16 . 2003-07-02 16:41 155,648 --a------ c:\windows\system32\amr_cpl.dll
    2008-10-27 20:16 . 2003-05-15 15:31 138,560 --a------ c:\windows\system32\slcpappl.chm
    2008-10-27 20:16 . 2003-07-16 12:40 135,168 --a------ c:\windows\system32\SLMOHServ.dll
    2008-10-27 20:16 . 2003-06-09 10:25 130,190 --a------ c:\windows\sl.lng
    2008-10-27 20:16 . 2003-07-02 17:44 61,440 --a------ c:\windows\SmCfg.exe
    2008-10-27 20:16 . 2003-07-02 18:38 14,976 --a------ c:\windows\system32\drivers\winddx.sys
    2008-10-23 16:22 . 2008-11-21 20:11 <REP> d-------- c:\program files\Mes Vacances en Photo
    2008-10-18 09:32 . 2008-11-30 10:21 <REP> d-------- c:\documents and settings\Mohamed-Amine\Tracing
    2008-10-16 19:47 . 2008-10-20 08:04 <REP> d-------- c:\program files\Picasa2
    2008-10-16 13:48 . 2008-10-16 13:48 <REP> d-------- c:\program files\Microsoft Office Outlook Connector
    2008-10-16 13:48 . 2008-09-04 21:03 56,344 --a------ c:\windows\system32\drivers\fssfltr.sys
    2008-10-16 13:38 . 2008-10-16 13:38 <REP> d-------- c:\program files\Microsoft
    2008-10-16 13:26 . 2008-10-16 13:26 <REP> d-------- c:\program files\Fichiers communs\Windows Live
    2008-10-15 19:21 . 2008-11-21 18:19 <REP> d-------- c:\program files\iTunes
    2008-10-15 19:18 . 2008-10-15 19:19 <REP> d-------- c:\program files\QuickTime
    2008-10-15 18:35 . 2008-10-15 18:35 <REP> d-------- c:\program files\Bonjour
    2008-10-09 18:21 . 2008-11-30 12:39 <REP> d-------- c:\documents and settings\Djouher\Tracing

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    3427-09-25 20:40 2,191,881 ----a-w c:\windows\system32\naruto.scr
    2008-11-30 11:42 --------- d-----w c:\program files\Prayer
    2008-11-30 11:42 --------- d-----w c:\documents and settings\Djouher\Application Data\DMCache
    2008-11-26 12:52 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
    2008-11-21 17:16 --------- d-----w c:\program files\LogProtect
    2008-11-21 17:00 --------- d-----w c:\program files\speed-bit
    2008-11-21 16:58 --------- d-----w c:\program files\Time4Worker
    2008-11-21 16:47 --------- d-----w c:\program files\Google
    2008-11-21 16:39 --------- d-----w c:\program files\Java
    2008-11-21 16:31 --------- d-----w c:\program files\Lavasoft
    2008-11-21 16:31 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
    2008-11-21 09:43 --------- d--h--w c:\program files\InstallShield Installation Information
    2008-11-21 09:09 --------- d-----w c:\program files\Transparent
    2008-11-21 09:08 --------- d-----w c:\program files\Axialis
    2008-11-21 09:07 --------- d-----w c:\program files\AVS4YOU
    2008-11-01 18:18 --------- d-----w c:\program files\Fichiers communs\InstallShield
    2008-11-01 18:18 --------- d-----w c:\program files\EPSON
    2008-10-27 19:14 --------- d-----w c:\program files\Microsoft Silverlight
    2008-10-27 18:38 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
    2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
    2008-10-24 11:10 453,632 ------w c:\windows\system32\dllcache\mrxsmb.sys
    2008-10-16 19:46 --------- d-----w c:\program files\DivX
    2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
    2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
    2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
    2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
    2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
    2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
    2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
    2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
    2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
    2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
    2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
    2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
    2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
    2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
    2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
    2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
    2008-10-16 12:48 --------- d-----w c:\program files\Windows Live
    2008-10-16 12:41 --------- d-----w c:\program files\Windows Live Toolbar
    2008-10-15 18:18 --------- d-----w c:\program files\Fichiers communs\Apple
    2008-10-15 17:43 --------- d-----w c:\program files\Safari
    2008-10-15 16:59 332,800 ------w c:\windows\system32\dllcache\netapi32.dll
    2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
    2008-09-25 17:02 3,120 ----a-w c:\windows\system32\6ffdbcaf-f6c1-42d3-a4a9-c7957224a70b.dll
    2008-09-16 00:14 524,288 ----a-w c:\windows\system32\DivXsm.exe
    2008-09-16 00:14 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
    2008-09-16 00:12 81,920 ----a-w c:\windows\system32\dpl100.dll
    2008-09-16 00:12 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
    2008-09-16 00:12 57,344 ----a-w c:\windows\system32\dpv11.dll
    2008-09-16 00:12 53,248 ----a-w c:\windows\system32\dpuGUI10.dll
    2008-09-16 00:12 344,064 ----a-w c:\windows\system32\dpus11.dll
    2008-09-16 00:12 294,912 ----a-w c:\windows\system32\dpu11.dll
    2008-09-16 00:12 294,912 ----a-w c:\windows\system32\dpu10.dll
    2008-09-16 00:12 200,704 ----a-w c:\windows\system32\ssldivx.dll
    2008-09-16 00:12 196,608 ----a-w c:\windows\system32\dtu100.dll
    2008-09-16 00:12 1,044,480 ----a-w c:\windows\system32\libdivx.dll
    2008-09-16 00:11 823,296 ----a-w c:\windows\system32\divx_xx0c.dll
    2008-09-16 00:11 823,296 ----a-w c:\windows\system32\divx_xx07.dll
    2008-09-16 00:11 815,104 ----a-w c:\windows\system32\divx_xx0a.dll
    2008-09-16 00:11 802,816 ----a-w c:\windows\system32\divx_xx11.dll
    2008-09-16 00:11 683,520 ----a-w c:\windows\system32\DivX.dll
    2008-09-16 00:11 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
    2008-09-16 00:11 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
    2008-09-15 15:39 1,846,144 ----a-w c:\windows\system32\win32k.sys
    2008-09-15 15:39 1,846,144 ------w c:\windows\system32\dllcache\win32k.sys
    2008-09-08 22:03 51,712 ----a-w c:\windows\system32\sirenacm.dll
    2008-09-05 13:56 287,744 ----a-w c:\windows\WLXPGSS.SCR
    2008-09-04 16:45 1,106,944 ----a-w c:\windows\system32\msxml3.dll
    2008-09-04 16:45 1,106,944 ------w c:\windows\system32\dllcache\msxml3.dll
    2008-08-29 08:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
    2008-08-29 07:53 61,440 ----a-w c:\windows\system32\dnssd.dll
    2008-08-28 10:04 333,056 ------w c:\windows\system32\dllcache\srv.sys
    2008-08-19 09:38 18,432 ------w c:\windows\system32\dllcache\iedw.exe
    2008-08-14 13:44 2,182,400 ------w c:\windows\system32\dllcache\ntoskrnl.exe
    2008-08-14 13:44 2,138,112 ----a-w c:\windows\system32\ntoskrnl.exe
    2008-08-14 13:44 2,138,112 ------w c:\windows\system32\dllcache\ntkrnlmp.exe
    2008-08-14 13:44 2,059,776 ------w c:\windows\system32\dllcache\ntkrnlpa.exe
    2008-08-14 13:44 2,017,792 ----a-w c:\windows\system32\ntkrnlpa.exe
    2008-08-14 13:44 2,017,792 ------w c:\windows\system32\dllcache\ntkrpamp.exe
    2008-08-14 09:51 138,368 ------w c:\windows\system32\dllcache\afd.sys
    .

    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9421DD08-935F-4701-A9CA-22DF90AC4EA6}]
    2008-04-02 13:24 266240 --a------ c:\program files\Epson Software\Easy Photo Print\EPTBL.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fcd5ee58-54d8-4d33-aa8d-54ae85597966}]
    2008-11-22 22:27 1784856 --a------ c:\program files\islamuslim\tbisl0.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{fcd5ee58-54d8-4d33-aa8d-54ae85597966}"= "c:\program files\islamuslim\tbisl0.dll" [2008-11-22 1784856]
    "{9421DD08-935F-4701-A9CA-22DF90AC4EA6}"= "c:\program files\Epson Software\Easy Photo Print\EPTBL.dll" [2008-04-02 266240]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{FCD5EE58-54D8-4D33-AA8D-54AE85597966}"= "c:\program files\islamuslim\tbisl0.dll" [2008-11-22 1784856]

    [HKEY_CLASSES_ROOT\clsid\{fcd5ee58-54d8-4d33-aa8d-54ae85597966}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IDMan"="c:\documents and settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe" [2007-12-21 2573744]
    "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
    "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-09-08 3513344]
    "Google Update"="c:\documents and settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-26 133104]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-01-29 185896]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
    "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
    "EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-05-07 591696]
    "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

    c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Bilal.lnk - c:\program files\Prayer\Prayer.exe [2006-02-03 1447424]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{88485281-8b4b-4f8d-9ede-82e29a064277}"= "c:\progra~1\MarkAny\CONTEN~1\MACSMA~1.DLL" [2004-11-23 192512]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
    "UIHost"="c:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%ProgramFiles%\\AOL 9.0\\aol.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\APPS\\Inventime\\my.exe"=
    "c:\\WINDOWS\\system32\\muzapp.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\sixteen tons entertainment\\Emergency 4\\Em4.exe"=
    "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    "c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Documents and Settings\\All Users\\Application Data\\TuneUp Software\\TuneUp Utilities\\WinStyler\\tu_logonui.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

    R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2007-12-21 33800]
    R2 fssfltr;FssFltr;c:\windows\system32\DRIVERS\fssfltr.sys [2008-10-16 56344]
    S3 fsssvc;Windows Live Family Safety;"c:\program files\Windows Live\Family Safety\fsssvc.exe" [2008-09-04 512536]

    *Newly Created Service* - IP6FW
    .
    Contenu du dossier 'Tâches planifiées'

    2008-11-30 c:\windows\Tasks\1-Click Maintenance.job
    - c:\program files\TuneUp Utilities 2008\OneClickStarter.exe []

    2008-11-29 c:\windows\Tasks\GoogleUpdateTaskUser.job
    - c:\documents and settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-26 14:00]

    2008-11-29 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]

    2007-08-30 c:\windows\Tasks\Rappel d'enregistrement 2.job
    - c:\windows\system32\OOBE\oobebaln.exe [2004-08-05 13:00]
    .
    .
    ------- Examen supplémentaire -------
    .
    FireFox -: Profile - c:\documents and settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\
    FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr
    FF -: plugin - c:\documents and settings\Djouher\Local Settings\Application Data\Google\Update\1.2.131.27\npGoogleOneClick6.dll
    FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
    FF -: plugin - c:\program files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
    FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30401.0.dll
    FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
    FF -: plugin - c:\program files\Picasa2\npPicasa2.dll
    FF -: plugin - c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
    FF -: plugin - c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
    FF -: plugin - c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
    FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-11-30 12:47:48
    Windows 5.1.2600 Service Pack 2 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MysqlInventime]
    "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime"
    .
    --------------------- DLLs chargées dans les processus actifs ---------------------

    - - - - - - - > 'winlogon.exe'(572)
    c:\windows\system32\midimap.dll
    .
    Heure de fin: 2008-11-30 12:49:24
    ComboFix-quarantined-files.txt 2008-11-30 11:49:20

    Avant-CF: 102 840 356 864 octets libres
    Après-CF: 102,833,602,560 octets libres

    262 --- E O F --- 2008-11-23 16:24:18
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Utilisateur anonyme
     
    Télécharger HijackThis sur cette page : https://www.commentcamarche.net/telecharger/ 159 hijackthis

    Utilisation :

    * L'installer dans un dossier prévu à cet effet.
    o Par exemple, C:\HijackThis
    o Choisir l'option "do a system scan and save a logfile"; un rapport va être généré…
    o Copier/coller le rapport sur le forum virus/sécurité de CCM.

    Tutoriel d'utilisation, section "Générer un rapport" ici : http://pageperso.aol.fr/balltrap34/demohijack.htm
    (Merci à balltrap34 pour cette réalisation)
    0
  7. karimosouli
     
    le voila:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:30:17, on 30/11/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    c:\APPS\HIDSERVICE\HIDSERVICE.exe
    C:\Program Files\Spyware Terminator\sp_rsser.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\PROGRA~1\MI3AA1~1\rapimgr.exe
    C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\Prayer\Prayer.exe
    C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Windows Live\Mail\wlmail.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Player\rpbrowserrecordplugin.dll
    O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
    O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim\tbisl0.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim\tbisl0.dll
    O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
    O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
    O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
    O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
    O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
    O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
    O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
    O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
    O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
    O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
    O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32\rsvp.exe
    O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
    0
  8. Utilisateur anonyme
     
    Mais a jour malwarebyte's anti-malware et fait un scan complet en mode sans échec, montre le rapport ensuite !
    0
  9. karimosouli
     
    tien:

    Malwarebytes' Anti-Malware 1.30
    Version de la base de données: 1454
    Windows 5.1.2600 Service Pack 2

    03/12/2008 21:55:52
    mbam-log-2008-12-03 (21-55-52).txt

    Type de recherche: Examen complet (C:\|)
    Eléments examinés: 243716
    Temps écoulé: 2 hour(s), 18 minute(s), 48 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 2
    Valeur(s) du Registre infectée(s): 0
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 3

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055c089-8582-441b-a0bf-17b458c2a3a8} (Trojan.BHO.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{0055c089-8582-441b-a0bf-17b458c2a3a8} (Trojan.BHO.H) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll (Trojan.BHO.H) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HADJAB\Local Settings\Temporary Internet Files\Content.IE5\EWRWEQEM\style[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HADJAB\Local Settings\Temporary Internet Files\Content.IE5\M3MDITSD\style[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
    0
  10. Utilisateur anonyme
     
    Bon, tu as encore des prb ??

    Refait un hijack stp
    0
  11. karimosouli
     
    non je n'ai plus de probleme merci:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:37:34, on 12/12/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    c:\APPS\HIDSERVICE\HIDSERVICE.exe
    C:\WINDOWS\system32\slserv.exe
    C:\Program Files\Spyware Terminator\sp_rsser.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\Prayer\Prayer.exe
    C:\PROGRA~1\MI3AA1~1\rapimgr.exe
    C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Player\rpbrowserrecordplugin.dll
    O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
    O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (file missing)
    O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim\tbisl0.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim\tbisl0.dll
    O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (file missing)
    O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
    O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'HADJAB')
    O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S (User 'HADJAB')
    O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'HADJAB')
    O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" (User 'HADJAB')
    O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'HADJAB')
    O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [EPSON PX800FW Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEME.EXE /FU "C:\WINDOWS\TEMP\E_S5D7.tmp" /EF "HKCU" (User 'HADJAB')
    O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Netlog Music Tool] "C:\Program Files\Netlog Music Tool\NetlogMusicTool.exe" (User 'HADJAB')
    O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Heartbags] C:\DOCUME~1\HADJAB\APPLIC~1\ITCHSE~1\DASH BLEH.exe (User 'HADJAB')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
    O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
    O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
    O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
    O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
    O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
    O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
    O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
    O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
    O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32\rsvp.exe
    O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
    0
  12. Utilisateur anonyme
     
    Salut,
    Rien de bien vilan dans ce log.
    Qu'une certaine 'lourdeur.
    Beaucoup d'auto-démarrages inutiles et bouffeurs de ressources, mais sans grand effets, sinon un démarrage plus lent.

    Parcontre Java est désuet.
    https://filehippo.com/download_jre_32/?ex=CORE-116.0

    Bien-sûr, les vieux java tu les supprimes.
    Justement, 'Filehippo Update Checker', te serait d'un bon secours, pour tout garder à jour.
    https://filehippo.com/windows/tuning-utilities/

    Mais pour les mise à jour, lis ceci : http://ww1.purforum.com

    Refait un hijack ensuite
    0
Précédent
  • 1
  • 2
  • 3
  • 4

Discussions similaires

publicité intempestive
alost -
HelpiOS -

5 réponses
Pub intempestive sur smartphone Android.
Camitte -
Yoyo -

31 réponses
Publicité s'ouvre toute seule ! ?
RRD91 -
Vinz -

52 réponses
Pub incessantes sur mon téléphone
safiya.l -
Mia -

6 réponses
Publicités : même son coupé, elles sont à fond
Leboss104 -
loisou17 -

5 réponses