Analyse raport hijackthis Résolu

Question

Bonjour, hier j'ai un scan antivir résulatat? 23 warning jamais antivir ne ma détecter autant de warning (normalement il me détecte que 2warnings sptd et pagefile alors pour éviter de perdre du temps j'ai fait un rapport Hijackthis (1ére utillisation) (je regarderais vos réponse plus tard)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:49:37, on 30/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\Philips\SPC220NC\Monitor.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NOBRAND\802.11 Wireless Adatper\Monitor.exe
C:\Program Files\Philips\Philips SPC220NC Webcam\TrayMin220.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet  XP-Demonn
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 cmicnfg3.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\Philips\SPC220NC\Monitor.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - Global Startup: 802.11g Wireless Adatper.lnk = C:\Program Files\NOBRAND\802.11 Wireless Adatper\Monitor.exe
O4 - Global Startup: TrayMin220.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: https://www.dailymotion.com/
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://m.boonty.com/webgames/_popcap/popcaploader_v10_fr.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

jlpjlp · Answer

slt

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau. 
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 

* Lance l'installation du programme en exécutant le fichier téléchargé. 
l
ance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée". 
! Ne ferme pas la fenêtre lors de la suppression ! 
Un rapport sera généré, poste son contenu ici. 

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches. 
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..." 
Tape explorer puis valide. 

_______________

colle un rapport avec antivir que tu as pour voir les warning!

Firefox3 · Answer

avant de faire toutes les manip juste une question pourquoi faire directement la supression sans passer par la recherche???
(Dois-je poster un rapport complet d'antivir?)

jlpjlp · Answer

car l'infection est vue ici:

mais si tu veux on peut faire en deux fois :)


R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll

O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll

Firefox3 · Answer

je préfére commencer par la recherche dis moi juste si les manip sont le memes ou si elles sont différentes plz

jlpjlp · Answer

tu fais toolbar mais un option 1 pour avoir que la recherche et tu colle un rapport antivir

Firefox3 · Answer

oui mais ça réponds toujours pas a ma question de mon 2éme message
(Dois-je coller un rapport complet d'antivir?)

jlpjlp · Answer

evidement qu'il faut un rapport complet

Firefox3 · Answer

Aie Aie Aie il va y avoir un problème c'est que le rapport complet d'antivir est beaucoup trop long pour être poster ici

Firefox3 · Answer

bon bah pour l'instant voila le rapport de la recherche:


   -----------\  ToolBar S&D 1.2.5   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free : AMD Sempron(tm)   2400+ )
   BIOS : Phoenix - Award BIOS v6.00PG
   USER : Demonn ( Administrator )
   BOOT : Normal boot
   Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:74 Go (Free:39 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 20-11-2008|20:25 )
   Option : [1] ( 03/12/2008|10:11 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\DOCUME~1\Demonn\APPLIC~1\Search Settings
   C:\DOCUME~1\Demonn\APPLIC~1\Search Settings\kb127
   C:\DOCUME~1\Demonn\APPLIC~1\Search Settings\kb127es
   C:\DOCUME~1\Demonn\APPLIC~1\Search Settings\kb127	emp
   C:\DOCUME~1\Demonn\APPLIC~1\Search Settings\kb127	emp\ws-14213.log
   C:\DOCUME~1\Demonn\APPLIC~1\Search Settings\kb127	emp\ws-14214.log
   C:\DOCUME~1\Demonn\APPLIC~1\Search Settings\kb127	emp\ws-14215.log
   C:\DOCUME~1\Demonn\APPLIC~1\Search Settings\kb127	emp\ws-14216.log
   C:\Program Files\Search Settings
   C:\Program Files\Search Settings\kb127
   C:\Program Files\Search Settings\SearchSettings.exe
   C:\Program Files\Search Settings\kb127es
   C:\Program Files\Search Settings\kb127\SearchSettings.dll
   C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
   C:\Program Files\Search Settings\kb127	emp
   C:\DOCUME~1\Demonn\LOCALS~1\Temp
sj85.tmp
   C:\DOCUME~1\Demonn\LOCALS~1\Temp
sn5D.tmp
   C:\DOCUME~1\Demonn\LOCALS~1\Temp
sv24.tmp

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Bar"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "SearchMigratedDefaultURL"="https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Demonn\Cookies\demonn@www.greatcracks[1].txt
   C:\DOCUME~1\Demonn\Cookies\demonn@www.zcrack[1].txt
   C:\DOCUME~1\Demonn\Mes documents\Mes fichiers re‡us\Empire.Earth.FRENCH.By.Kekee51230-1\Crack



   1 - "C:\ToolBar SD\TB_1.txt" - 03/12/2008|10:12 - Option : [1]

   -----------\  Fin du rapport a 10:12:12,75

Firefox3 · Answer

UsrClass.dat
    [WARNING]   The file could not be opened!
pagefile.sys
    [WARNING]   The file could not be opened!
  NTUSER.DAT
    [WARNING]   The file could not be opened!
  ntuser.dat.LOG
   [WARNING]   The file could not be opened!
UsrClass.dat.LOG
    [WARNING]   The file could not be opened!
Perflib_Perfdata_3f0.dat
    [WARNING]   The file could not be opened!
--> Sponsor Agreement (es).rtf
          [WARNING]   The archive is encrypted
UsrClass.dat
    [WARNING]   The file could not be opened!
  UsrClass.dat.LOG
    [WARNING]   The file could not be opened!
NTUSER.DAT
    [WARNING]   The file could not be opened!
  ntuser.dat.LOG
    [WARNING]   The file could not be opened!
--> arrow1.bmp
      [WARNING]   The archive is encrypted
C:\System Volume Information\
  
    [WARNING]   System error [5]: Accès refusé.
default
    [WARNING]   The file could not be opened!
  default.LOG
    [WARNING]   The file could not be opened!
SAM
    [WARNING]   The file could not be opened!
  SAM.LOG
    [WARNING]   The file could not be opened!
  SecEvent.Evt
  SECURITY
    [WARNING]   The file could not be opened!
  SECURITY.LOG
    [WARNING]   The file could not be opened!
  software
    [WARNING]   The file could not be opened!
  software.LOG
    [WARNING]   The file could not be opened!
 system
    [WARNING]   The file could not be opened!
system.LOG
    [WARNING]   The file could not be opened!

jlpjlp · Answer

refais toolbar sd et choisi l'option 2 et colle le rapport

Firefox3 · Answer

Voila !

Rapport:

   -----------\  ToolBar S&D 1.2.5   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free : AMD Sempron(tm)   2400+ )
   BIOS : Phoenix - Award BIOS v6.00PG
   USER : Demonn ( Administrator )
   BOOT : Normal boot
   Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:74 Go (Free:39 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 20-11-2008|20:25 )
   Option : [2] ( 04/12/2008|12:18 )

   -----------\ SUPPRESSION

   Supprime! - C:\DOCUME~1\Demonn\APPLIC~1\Search Settings\kb127
   Supprime! - C:\Program Files\Search Settings\kb127
   Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
   Supprime! - C:\DOCUME~1\Demonn\LOCALS~1\Temp
sj85.tmp
   Supprime! - C:\DOCUME~1\Demonn\LOCALS~1\Temp
sn5D.tmp
   Supprime! - C:\DOCUME~1\Demonn\LOCALS~1\Temp
sv24.tmp
   Supprime! - C:\DOCUME~1\Demonn\APPLIC~1\Search Settings
   Supprime! - C:\Program Files\Search Settings

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Bar"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "SearchMigratedDefaultURL"="https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Demonn\Cookies\demonn@www.greatcracks[1].txt
   C:\DOCUME~1\Demonn\Cookies\demonn@www.zcrack[1].txt
   C:\DOCUME~1\Demonn\Mes documents\Mes fichiers re‡us\Empire.Earth.FRENCH.By.Kekee51230-1\Crack



   1 - "C:\ToolBar SD\TB_1.txt" - 03/12/2008|10:12 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 04/12/2008|12:19 - Option : [2]

   -----------\  Fin du rapport a 12:19:55,37

Firefox3 · Answer

Dernier rapport HJT?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:40:26, on 04/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\Philips\SPC220NC\Monitor.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NOBRAND\802.11 Wireless Adatper\Monitor.exe
C:\Program Files\Philips\Philips SPC220NC Webcam\TrayMin220.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet  XP-Demonn
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 cmicnfg3.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\Philips\SPC220NC\Monitor.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - Global Startup: 802.11g Wireless Adatper.lnk = C:\Program Files\NOBRAND\802.11 Wireless Adatper\Monitor.exe
O4 - Global Startup: TrayMin220.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: https://www.dailymotion.com/
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://m.boonty.com/webgames/_popcap/popcaploader_v10_fr.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

jlpjlp · Answer

désactive ta restauration système puis redémarre ton ordi puis réactive la . Puis remets un rapport antivir pour voir

Firefox3 · Answer

Je ne comprends pas ce que tu veut dire par, "recolle un rapport antivir"

jlpjlp · Answer

tu refais un scan antivir après toutes ces manip pour voir ce qu'il en est

Firefox3 · Answer

Daccord

jlpjlp · Answer

ok j'attends 

et vire les cracks....

Firefox3 · Answer

Bon bas c'est pire 31 warnings!!
 pagefile.sys
    [WARNING]   The file could not be opened!
NTUSER.DAT
    [WARNING]   The file could not be opened!
  ntuser.dat.LOG
    [WARNING]   The file could not be opened!
places.sqlite-journal
    [WARNING]   The file could not be opened!
parent.lock
    [WARNING]   The file could not be opened!
UsrClass.dat
    [WARNING]   The file could not be opened!
  UsrClass.dat.LOG
    [WARNING]   The file could not be opened!
 etilqs_XoMOqcdUzmOBgUxVREOI
    [WARNING]   The file could not be opened!
--> Sponsor Agreement (es).rtf
          [WARNING]   The archive is encrypted
NTUSER.DAT
    [WARNING]   The file could not be opened!
  ntuser.dat.LOG
    [WARNING]   The file could not be opened!
 UsrClass.dat
    [WARNING]   The file could not be opened!
  UsrClass.dat.LOG
    [WARNING]   The file could not be opened!
NTUSER.DAT
    [WARNING]   The file could not be opened!
  ntuser.dat.LOG
    [WARNING]   The file could not be opened!
UsrClass.dat
    [WARNING]   The file could not be opened!
  UsrClass.dat.LOG
    [WARNING]   The file could not be opened!
--> arrow1.bmp
      [WARNING]   The archive is encrypted
edb.log
    [WARNING]   The file could not be opened!
tmp.edb
    [WARNING]   The file could not be opened!
C:\WINDOWS\system32\config\
  Antiviru.evt
  Antivirus.Evt
  AppEvent.Evt
  default
    [WARNING]   The file could not be opened!
  default.LOG
    [WARNING]   The file could not be opened!
  default.sav
  Internet.evt
  SAM
    [WARNING]   The file could not be opened!
  SAM.LOG
    [WARNING]   The file could not be opened!
  SecEvent.Evt
  SECURITY
    [WARNING]   The file could not be opened!
  SECURITY.LOG
    [WARNING]   The file could not be opened!
  software
    [WARNING]   The file could not be opened!
  software.LOG
    [WARNING]   The file could not be opened!
  software.sav
  SysEvent.Evt
  system
    [WARNING]   The file could not be opened!
  system.LOG
    [WARNING]   The file could not be opened!
sptd.sys
    [WARNING]   The file could not be opened!

jlpjlp · Answer

colle le rapport d'un scan en ligne
avec un des suivants:

kaspersky en ligne:
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr



Panda en ligne :
http://pandasoftware.fr

Firefox3 · Answer

comment on fait pour lancer un scan kaspersky

jlpjlp · Answer

tu clique sur le lien

Firefox3 · Answer

oui mais ça se lance pas

jlpjlp · Answer

essaye panda alors


rq: il faut utiliser internet explorer et pas firefox

Firefox3 · Answer

je suis au courent
Edit: on me demande de m'enrengistrer c'est payant?

jlpjlp · Answer

non l'analyse est gratuite!





sinon




bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Firefox3 · Answer

ok

Firefox3 · Answer

Kaspersky: j'arrive pas analyser

Panda: idem

Bitdefender: Analyse réussie! (Aucun virus ou saleté détecté) mais il ne veut pas m'envoyer le rapport

Autre proposotion?

jlpjlp · Answer

je pense que tu n'es plus infecté 

et donc qu'il n'y a que des alertes non infectieuses

Analyse raport hijackthis

29 réponses

Votre réponse

Discussions similaires

Newsletters