Antivurus2009
sandjack
Messages postés
20
Statut
Membre
-
benurrr Messages postés 9766 Statut Contributeur sécurité -
benurrr Messages postés 9766 Statut Contributeur sécurité -
Bonjour,
voila g eu aussi un souci avec antivirus2009 j'ai fait se qui etai recommmander de faire
donc je te join le rappor si tu peut me dire si je cour encore un risque
merci par avance
Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1460
Windows 5.1.2600 Service Pack 3
04/12/2008 20:08:23
mbam-log-2008-12-04 (20-08-23).txt
Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 123815
Temps écoulé: 1 hour(s), 0 minute(s), 17 second(s)
Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 4
Clé(s) du Registre infectée(s): 16
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 44
Processus mémoire infecté(s):
C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus 2009) -> Unloaded process successfully.
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\awtsQJYS.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\lvxiegll.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\opnmNHWn.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\wmcvzh.dll (Trojan.Vundo) -> Delete on reboot.
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0aee4d65-7458-47ed-8185-0ee3944e9a68} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{0aee4d65-7458-47ed-8185-0ee3944e9a68} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\opnmnhwn (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f951d799-359a-4f37-a86c-55b896a9bc6e} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f951d799-359a-4f37-a86c-55b896a9bc6e} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0aee4d65-7458-47ed-8185-0ee3944e9a68} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f951d799-359a-4f37-a86c-55b896a9bc6e} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9c8c7748 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\77928596978856326076313191354161 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center (Backdoor.Bot) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\awtsqjys -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\awtsqjys -> Delete on reboot.
Dossier(s) infecté(s):
C:\Program Files\Antivirus 2009 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\WINDOWS\system32\awtsQJYS.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\SYJQstwa.ini (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\SYJQstwa.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\opnmNHWn.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\lvxiegll.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\llgeixvl.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wmcvzh.dll (Trojan.BHO.H) -> Delete on reboot.
C:\wny.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\jacky\Local Settings\Temp\IXP000.TMP\pack.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\jacky\Local Settings\Temporary Internet Files\Content.IE5\3P7O1XF9\wny[1].jpg (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CDB90B9C-9FC1-4C46-95AB-9A0135D6AD76}\RP267\A0018444.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CDB90B9C-9FC1-4C46-95AB-9A0135D6AD76}\RP268\A0018460.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CDB90B9C-9FC1-4C46-95AB-9A0135D6AD76}\RP269\A0018487.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CDB90B9C-9FC1-4C46-95AB-9A0135D6AD76}\RP269\A0018491.cpl (Rogue.XPantivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\exuuyuhr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pmnnOigG.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\efcDssSI.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qoMGvTLB.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mlJApPIY.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cbXPjGwW.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cbXRHxXO.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqOGYrp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Errors.stg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_12_51_15.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_14_55_14.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_15_11_32.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_15_49_09.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_16_00_04.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_19_10_31.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_20_13_40.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_20_49_56.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_05_09_22_40.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_05_11_27_11.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_05_12_15_13.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_05_13_58_41.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2007-01-29_17-25-10.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2007-02-08_16-48-46.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2007-03-18_12-57-32.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2007-11-23_16-21-11.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2008-03-08_14-56-16.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2008-08-04_20-14-39.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\Errors.stg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.
voila g eu aussi un souci avec antivirus2009 j'ai fait se qui etai recommmander de faire
donc je te join le rappor si tu peut me dire si je cour encore un risque
merci par avance
Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1460
Windows 5.1.2600 Service Pack 3
04/12/2008 20:08:23
mbam-log-2008-12-04 (20-08-23).txt
Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 123815
Temps écoulé: 1 hour(s), 0 minute(s), 17 second(s)
Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 4
Clé(s) du Registre infectée(s): 16
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 44
Processus mémoire infecté(s):
C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus 2009) -> Unloaded process successfully.
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\awtsQJYS.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\lvxiegll.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\opnmNHWn.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\wmcvzh.dll (Trojan.Vundo) -> Delete on reboot.
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0aee4d65-7458-47ed-8185-0ee3944e9a68} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{0aee4d65-7458-47ed-8185-0ee3944e9a68} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\opnmnhwn (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f951d799-359a-4f37-a86c-55b896a9bc6e} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f951d799-359a-4f37-a86c-55b896a9bc6e} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0aee4d65-7458-47ed-8185-0ee3944e9a68} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f951d799-359a-4f37-a86c-55b896a9bc6e} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9c8c7748 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\77928596978856326076313191354161 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center (Backdoor.Bot) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\awtsqjys -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\awtsqjys -> Delete on reboot.
Dossier(s) infecté(s):
C:\Program Files\Antivirus 2009 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\WINDOWS\system32\awtsQJYS.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\SYJQstwa.ini (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\SYJQstwa.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\opnmNHWn.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\lvxiegll.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\llgeixvl.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wmcvzh.dll (Trojan.BHO.H) -> Delete on reboot.
C:\wny.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\jacky\Local Settings\Temp\IXP000.TMP\pack.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\jacky\Local Settings\Temporary Internet Files\Content.IE5\3P7O1XF9\wny[1].jpg (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CDB90B9C-9FC1-4C46-95AB-9A0135D6AD76}\RP267\A0018444.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CDB90B9C-9FC1-4C46-95AB-9A0135D6AD76}\RP268\A0018460.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CDB90B9C-9FC1-4C46-95AB-9A0135D6AD76}\RP269\A0018487.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CDB90B9C-9FC1-4C46-95AB-9A0135D6AD76}\RP269\A0018491.cpl (Rogue.XPantivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\exuuyuhr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pmnnOigG.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\efcDssSI.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qoMGvTLB.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mlJApPIY.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cbXPjGwW.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cbXRHxXO.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqOGYrp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Errors.stg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_12_51_15.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_14_55_14.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_15_11_32.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_15_49_09.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_16_00_04.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_19_10_31.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_20_13_40.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_04_20_49_56.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_05_09_22_40.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_05_11_27_11.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_05_12_15_13.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2008_08_05_13_58_41.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2007-01-29_17-25-10.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2007-02-08_16-48-46.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2007-03-18_12-57-32.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2007-11-23_16-21-11.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2008-03-08_14-56-16.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2008-08-04_20-14-39.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\Errors.stg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.
Configuration: Windows XP Internet Explorer 7.0
14 réponses
-
bonjour,
Télécharge HijackThis (outils de dignostic) ici :
-> Fais un clic droit sur un des liens et choisi enregistrer la cible sous .... le bureau
-> http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
-> Fais un double-clic sur HJTInstall.exe afin de lancer l'installation
-> Clique sur Install ensuite sur I Accept
-> Clique sur Do a scan system and save log file
-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse-
voila le rappot merci de ton aide
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:40:05, on 05/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PCM4Everio\EverioService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hoolight.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EverioService] "C:\Program Files\CyberLink\PCM4Everio\EverioService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://lafleche25.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
- salut a vous
suite a ton mp me voila pour vérifier
1/ telecharger :
http://siri.urz.free.fr/Fix/SmitfraudFix.php
2/ double clique sur smitfraudfix. puis sélectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes
Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...)
-
-
non c bon tout compte fai jaten le rapport
desoler je debute -
c sa ??
SmitFraudFix v2.381
Rapport fait à 12:53:00,06, 05/12/2008
Executé à partir de C:\Documents and Settings\jacky\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PCM4Everio\EverioService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\jacky\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jacky
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\jacky\LOCALS~1\Temp
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jacky\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\jacky\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Ralink RT2500 Wireless LAN Card - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A31F128E-8EB9-44A5-85C7-F0C47935A065}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A31F128E-8EB9-44A5-85C7-F0C47935A065}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A31F128E-8EB9-44A5-85C7-F0C47935A065}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin-
re
c'etait bien sa t'est 2 rapport sont propre
une derniere chose avant de nettoyer les fix qui ont servit
1) Télécharge SDFix d' AndyManchesta
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe sur ton Bureau.
Double clique sur SDFix.exe et choisis Install. L'outil sera extrait à la racine du lecteur système (généralement le C:\)
N y touche pas pour l instant.
2) Redémarre en mode sans échec pour cela (tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter. )
3) SDFix
* Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
* Appuie sur Y pour commencer le processus de nettoyage.
* Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
* Appuie sur une touche pour redémarrer le PC.
* Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
* Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
· Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
-
-
re kan je vais dans le repertoire C il y a bien un fichier sdfixe je clique dessus il me met six icone,
dont un run this fichier de commande MS-DOS 943ko
donc je double clique dessus et sa m'ouvre une fenetre bleu et kan j'inscrit la lettre Y sa fait rien !!!!!!!!!!
help me -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
voili voilou tien moi ai jus ^^
[b]SDFix: Version 1.240 [/b]
Run by jacky on 05/12/2008 at 13:31
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\DOCUME~1\jacky\LOCALS~1\Temp\TMP2F.tmp - Deleted
C:\DOCUME~1\jacky\LOCALS~1\Temp\TMP30.tmp - Deleted
C:\DOCUME~1\jacky\LOCALS~1\Temp\TMP31.tmp - Deleted
C:\DOCUME~1\jacky\LOCALS~1\Temp\TMP32.tmp - Deleted
C:\DOCUME~1\jacky\LOCALS~1\Temp\TMP33.tmp - Deleted
C:\DOCUME~1\jacky\LOCALS~1\Temp\TMP46.tmp - Deleted
C:\DOCUME~1\jacky\LOCALS~1\Temp\TMP47.tmp - Deleted
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-05 13:41:49
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"="C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe:*:Enabled:LifeExp.exe"
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"="C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe:*:Enabled:LifeCam.exe"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Ex‚cuter une DLL en tant qu'application"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"="C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe:*:Enabled:Malwarebytes' Anti-Malware"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
[b]Remaining Files [/b]:
File Backups: - C:\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]:
Wed 10 Sep 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Tue 5 Aug 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 5 Sep 2008 0 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\Cache\Indiv01.tmp"
[b]Finished![/b]-
Télécharge UsbFix sur ton bureau
http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe
--> Lance l installation avec les paramètres par default
Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir
--> Double clic sur le raccourci UsbFix sur ton bureau
--> Le PC va redémarrer
-->Après redémarrage poste le rapport UsbFix.txt
Note : le rapport UsbFix.txt est sauvegardé a la racine du disque
Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides
-
-
-------------- UsbFix V2.413.3 ---------------
* User : jacky - JACKY-BB99A9V1D
* Outils mis a jours le 05/12/2008 par Chiquitine29 et Chimay8
* Recherche effectuée à 19:55:07 le 05/12/2008
* Windows Xp - Internet Explorer 7.0.5730.13
--------------- [ Processus actifs ] ----------------
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\userinit.exe
C:\DOCUME~1\jacky\LOCALS~1\Temp\1.tmp\b2e.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\CyberLink\PCM4Everio\EverioService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
--------------- [ Informations lecteurs ] ----------------
C: - Lecteur fixe
D: - Lecteur fixe
F: - Lecteur amovible
--------------- [ Lecteur C ] ----------------
C: - Lecteur fixe
+- Listing des fichiers présents :
[29/01/2007 16:56][--a------] C:\AUTOEXEC.BAT
[08/08/2008 10:41][-rahs----] C:\NTDETECT.COM
[08/08/2008 10:47][-rahsc---] C:\boot.ini
[05/12/2008 09:53][--a--c---] C:\log_lobby.txt
[05/12/2008 09:53][--a--c---] C:\log_lobby_dumper.txt
[05/12/2008 09:53][--a--c---] C:\rapport.txt
[05/12/2008 09:53][--a--c---] C:\UsbFix.txt
[29/01/2007 16:56][--a------] C:\CONFIG.SYS
[29/01/2007 16:56][--a------] C:\hiberfil.sys
[29/01/2007 16:56][--a------] C:\IO.SYS
[29/01/2007 16:56][--a------] C:\MSDOS.SYS
[29/01/2007 16:56][--a------] C:\pagefile.sys
--------------- [ Lecteur D ] ----------------
D: - Lecteur fixe
+- Listing des fichiers présents :
--------------- [ Lecteur F ] ----------------
F: - Lecteur amovible
+- Listing des fichiers présents :
--------------- [ Registre / Startup ] ----------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="https://www.google.com/?gws_rd=ssl"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
updateMgr=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
SoundMan=SOUNDMAN.EXE
VTTrayp=VTtrayp.exe
VTTimer=VTTimer.exe
AVG7_CC=C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
VX1000=C:\WINDOWS\vVX1000.exe
LifeCam="C:\Program Files\Microsoft LifeCam\LifeExp.exe"
SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
EverioService="C:\Program Files\CyberLink\PCM4Everio\EverioService.exe"
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
NoChange=1
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
<NO NAME>=
--------------- [ Registre / Mountpoint2 ] ----------------
-> Recherche négative.
--------------- [ Nettoyage des disques ] ----------------
Supprimé ! - [05/12/2008 12:53][--a------] C:\WINDOWS\system32\tmp.reg
Supprimé ! - [05/12/2008 12:53][--a------] C:\WINDOWS\system32\tmp.txt
--------------- [ Resumé ] ----------------
-> /!\ Le resultat doit etre interprété par un spécialiste /!\
[29/01/2007 16:56][--a------] C:\AUTOEXEC.BAT
[08/08/2008 10:41][-rahs----] C:\NTDETECT.COM
[08/08/2008 10:47][-rahsc---] C:\boot.ini
--------------- ! Fin du rapport ! ---------------- -
ba je comprend pas, quand je clic sur usbfix, il ne redemare pas.
usbfix par chiquitine 29
il me propose 1 nettoyage
2 vaccination
3 désinstaller usbfix
Q quitter
alors que dois-je faire please-
salut
je comprend pas se que tu veut dire pour usbfix car tu la passer mais tu peut toujours vacciner
Télécharge LOP S&D d'Eric71 ici https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2
Double-clique dessus pour lancer l'installation.
Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau.
Séléctionne la langue souhaitée , puis choisis l'Option 1 ( Recherche )
Patiente jusqu'à la fin du scan.
Poste le rapport généré (situé aussi ici C:\lopR.txt )
( Si le Bureau ne réapparaît pas, lance le gestionnaire des tâches en cliquant sur Ctrl + Alt + Suppr , puis Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide )
-
-
desoler pas pu finir hier
voila le rapport
--------------------\\ Lop S&D 4.2.4-9c XP/Vista
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Mobile AMD Sempron(tm) Processor 3000+ )
BIOS : Insyde Software MobilePRO BIOS Version 4.00.05
USER : jacky ( Administrator )
BOOT : Normal boot
Antivirus : AVG 7.5.552 7.5.552 (Activated)
C:\ (Local Disk) - NTFS - Total:16 Go (Free:5 Go)
D:\ (Local Disk) - NTFS - Total:20 Go (Free:1 Go)
E:\ (CD or DVD)
"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( 06/12/2008|11:43 )
--------------------\\ Listing des dossiers dans APPLIC~1
[04/08/2008|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[05/03/2008|09:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[31/03/2008|14:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[27/03/2007|09:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg7
[29/01/2007|17:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
[04/08/2008|18:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[29/01/2007|17:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[10/06/2008|13:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[05/08/2008|14:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[09/04/2008|09:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[07/08/2008|15:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[05/08/2008|08:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
[26/08/2008|12:00] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe
[28/10/2008|18:07] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\avg7
[10/09/2008|11:44] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Cyberlink
[08/08/2008|14:18] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Downloaded Installations
[29/11/2008|12:59] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\EnterNHelp
[21/08/2008|17:43] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google
[08/08/2008|12:17] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Grisoft
[04/12/2008|18:59] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
[17/11/2008|12:45] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft
[08/08/2008|10:17] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\MSN6
[29/11/2008|13:00] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Nikon
[26/08/2008|12:07] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\NOS
[09/08/2008|13:28] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\pixelStorm
[29/11/2008|12:59] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Stingers
[24/08/2008|10:07] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
[29/11/2008|12:59] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Ultima_T15
[08/08/2008|12:26] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Genuine Advantage
[10/09/2008|17:15] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller
[29/01/2007|16:56] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[07/08/2008|16:40] C:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\Microsoft
[26/08/2008|11:42] C:\DOCUME~1\jacky\APPLIC~1\Adobe
[26/08/2008|11:47] C:\DOCUME~1\jacky\APPLIC~1\AdobeUM
[06/12/2008|11:36] C:\DOCUME~1\jacky\APPLIC~1\AVG7
[28/10/2008|19:34] C:\DOCUME~1\jacky\APPLIC~1\CVitae
[10/09/2008|11:45] C:\DOCUME~1\jacky\APPLIC~1\CyberLink
[31/08/2008|15:24] C:\DOCUME~1\jacky\APPLIC~1\GARMIN
[21/08/2008|17:44] C:\DOCUME~1\jacky\APPLIC~1\Google
[08/08/2008|10:32] C:\DOCUME~1\jacky\APPLIC~1\Help
[07/08/2008|16:49] C:\DOCUME~1\jacky\APPLIC~1\Identities
[07/08/2008|17:04] C:\DOCUME~1\jacky\APPLIC~1\Macromedia
[04/12/2008|18:59] C:\DOCUME~1\jacky\APPLIC~1\Malwarebytes
[29/11/2008|13:01] C:\DOCUME~1\jacky\APPLIC~1\Microsoft
[08/08/2008|10:18] C:\DOCUME~1\jacky\APPLIC~1\MSN6
[29/10/2008|18:32] C:\DOCUME~1\jacky\APPLIC~1\OpenOffice.org
[28/10/2008|19:25] C:\DOCUME~1\jacky\APPLIC~1\OpenOffice.org2
[19/08/2008|12:02] C:\DOCUME~1\jacky\APPLIC~1\Sun
[07/08/2008|17:40] C:\DOCUME~1\jacky\APPLIC~1\vlc
[07/08/2008|17:45] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\AVG7
[13/09/2008|12:24] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\Microsoft
[08/08/2008|12:17] C:\DOCUME~1\NETWOR~1.AUT\APPLIC~1\Microsoft
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[06/12/2008 11:35][--a------] C:\WINDOWS\tasks\lprixgxa.job
[06/12/2008 11:35][--ah-----] C:\WINDOWS\tasks\SA.DAT
[30/08/2002 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[26/08/2008|11:59] C:\Program Files\Adobe
[05/03/2008|09:17] C:\Program Files\Apple Software Update
[29/11/2008|12:58] C:\Program Files\ArcSoft
[09/04/2008|09:07] C:\Program Files\Common Files
[29/01/2007|16:54] C:\Program Files\ComPlus Applications
[04/08/2008|19:05] C:\Program Files\CVitae
[31/08/2008|09:44] C:\Program Files\CyberLink
[24/04/2007|17:40] C:\Program Files\Dictionnaire
[07/08/2008|17:25] C:\Program Files\DIFX
[31/08/2008|09:36] C:\Program Files\Digital Photo Navigator 1.5
[25/09/2008|09:23] C:\Program Files\eMule
[06/08/2008|15:53] C:\Program Files\EoRezo
[05/12/2008|21:31] C:\Program Files\Everest Poker
[04/12/2008|17:25] C:\Program Files\Fichiers communs
[22/05/2007|09:30] C:\Program Files\Firaxis Games
[22/08/2008|07:28] C:\Program Files\Google
[29/01/2007|17:23] C:\Program Files\Grisoft
[29/11/2008|12:58] C:\Program Files\InstallShield Installation Information
[15/10/2008|12:15] C:\Program Files\Internet Explorer
[04/12/2008|15:52] C:\Program Files\Java
[29/10/2008|19:10] C:\Program Files\JRE
[29/01/2007|17:01] C:\Program Files\Media Player Classic
[26/08/2008|11:51] C:\Program Files\Messenger
[05/08/2008|16:35] C:\Program Files\microsoft frontpage
[08/08/2008|20:59] C:\Program Files\Microsoft LifeCam
[28/10/2008|19:35] C:\Program Files\Microsoft Office
[29/01/2007|17:48] C:\Program Files\Microsoft.NET
[10/06/2008|13:08] C:\Program Files\Mindscape
[26/08/2008|09:14] C:\Program Files\movie maker
[04/08/2008|19:03] C:\Program Files\Mozilla Firefox
[26/08/2008|09:14] C:\Program Files\msn
[05/08/2008|16:35] C:\Program Files\msn gaming zone
[01/09/2008|21:09] C:\Program Files\MSXML 4.0
[26/08/2008|09:09] C:\Program Files\netmeeting
[29/11/2008|13:00] C:\Program Files\Nikon
[26/08/2008|12:07] C:\Program Files\NOS
[30/01/2007|07:57] C:\Program Files\Ontrack
[28/10/2008|19:27] C:\Program Files\OpenOffice.org 2.4
[29/10/2008|19:10] C:\Program Files\OpenOffice.org 3
[26/08/2008|09:08] C:\Program Files\outlook express
[05/02/2008|18:48] C:\Program Files\PowerPoint Viewer
[27/08/2008|19:21] C:\Program Files\PowerQuest
[01/11/2008|17:33] C:\Program Files\QuickTime
[29/01/2007|17:01] C:\Program Files\Real Alternative
[24/08/2008|10:07] C:\Program Files\Registry Mechanic
[04/08/2008|17:19] C:\Program Files\SAGEM
[29/01/2007|17:02] C:\Program Files\Satsuki Decoder Pack
[04/08/2008|14:25] C:\Program Files\Securitoo
[29/01/2007|17:37] C:\Program Files\Serials 2005
[07/08/2008|16:39] C:\Program Files\Services en ligne
[04/12/2008|17:28] C:\Program Files\Softwin
[09/04/2008|09:09] C:\Program Files\Sony
[17/02/2005|01:01] C:\Program Files\Stardock
[29/01/2007|17:05] C:\Program Files\Synaptics
[05/12/2008|11:39] C:\Program Files\Trend Micro
[05/08/2008|16:35] C:\Program Files\Uninstall Information
[05/12/2008|21:09] C:\Program Files\UsbFix
[29/01/2007|17:06] C:\Program Files\VIA
[10/09/2008|10:52] C:\Program Files\VideoLAN
[08/08/2008|14:18] C:\Program Files\VirginMega
[09/10/2008|12:10] C:\Program Files\Windows Live
[19/08/2008|11:51] C:\Program Files\Windows Live Toolbar
[05/08/2008|13:48] C:\Program Files\Windows Media Connect 2
[05/09/2008|17:07] C:\Program Files\Windows Media Player
[26/08/2008|09:08] C:\Program Files\Windows NT
[07/08/2008|16:37] C:\Program Files\WindowsUpdate
[29/01/2007|17:02] C:\Program Files\WinRAR
[10/06/2008|13:11] C:\Program Files\WMV9_VCM
[05/08/2008|16:35] C:\Program Files\xerox
[04/12/2008|16:07] C:\Program Files\Yahoo!
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[19/08/2008|11:49] C:\Program Files\Fichiers communs\Adobe
[04/08/2008|18:14] C:\Program Files\Fichiers communs\Adobe AIR
[05/03/2008|09:17] C:\Program Files\Fichiers communs\Apple
[29/01/2007|17:47] C:\Program Files\Fichiers communs\DESIGNER
[06/08/2008|15:56] C:\Program Files\Fichiers communs\InstallShield
[29/01/2007|17:01] C:\Program Files\Fichiers communs\Java
[28/10/2008|19:16] C:\Program Files\Fichiers communs\Microsoft Shared
[29/01/2007|16:55] C:\Program Files\Fichiers communs\MSSoap
[29/11/2008|13:00] C:\Program Files\Fichiers communs\muvee Technologies
[29/11/2008|13:01] C:\Program Files\Fichiers communs\Nikon
[29/01/2007|17:49] C:\Program Files\Fichiers communs\ODBC
[07/08/2008|16:38] C:\Program Files\Fichiers communs\Services
[04/12/2008|17:28] C:\Program Files\Fichiers communs\Softwin
[09/04/2008|09:09] C:\Program Files\Fichiers communs\Sony Shared
[05/08/2008|16:35] C:\Program Files\Fichiers communs\speechengines
[26/08/2008|09:08] C:\Program Files\Fichiers communs\System
[08/08/2008|12:46] C:\Program Files\Fichiers communs\WindowsLiveInstaller
--------------------\\ Process
( 41 Processes )
IEXPLORE.EXE ~ [PID:3676]
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
C:\DOCUME~1\jacky\Cookies\jacky@advertstream[1].txt
C:\DOCUME~1\jacky\Cookies\jacky@advertising[2].txt
C:\DOCUME~1\jacky\Cookies\jacky@banner.cotedazurpalace[1].txt
C:\DOCUME~1\jacky\Cookies\jacky@adopt.euroclick[2].txt
C:\DOCUME~1\jacky\Cookies\jacky@banner.32vegas[1].txt
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-06 11:44:48
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 2
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
[F:28][D:32]-> C:\DOCUME~1\jacky\LOCALS~1\Temp
[F:492][D:0]-> C:\DOCUME~1\jacky\Cookies
[F:378][D:13]-> C:\DOCUME~1\jacky\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - 06/12/2008|11:46 - Option : [1]
--------------------\\ Fin du rapport a 11:46:03-
salut
Relance LOP S&D d'Eric71
Choisis cette fois ci l'Option 3 ( Suppression )
Ne ferme pas la fenêtre lors de la suppression !
Poste le rapport généré (situé aussi ici C:\lopR.txt )
Par Manque De Curiosité On Risque De Mourir Ignorant;Tu es libre de penser que tu es C..,
Mais C.. de penser que tu es libre...Merci a australe13
-
-
voili voilou
--------------------\\ Lop S&D 4.2.4-9c XP/Vista
Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Mobile AMD Sempron(tm) Processor 3000+ )
BIOS : Insyde Software MobilePRO BIOS Version 4.00.05
USER : jacky ( Administrator )
BOOT : Normal boot
Antivirus : AVG 7.5.552 7.5.552 (Activated)
C:\ (Local Disk) - NTFS - Total:16 Go (Free:5 Go)
D:\ (Local Disk) - NTFS - Total:20 Go (Free:1 Go)
E:\ (CD or DVD)
"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [3] ( 06/12/2008|12:01 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION
Supprime! - C:\DOCUME~1\jacky\Cookies\jacky@advertstream[1].txt
Supprime! - C:\DOCUME~1\jacky\Cookies\jacky@banner.cotedazurpalace[1].txt
Supprime! - C:\DOCUME~1\jacky\Cookies\jacky@adopt.euroclick[2].txt
Supprime! - C:\DOCUME~1\jacky\Cookies\jacky@banner.32vegas[1].txt
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing des dossiers dans APPLIC~1
[04/08/2008|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[05/03/2008|09:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[31/03/2008|14:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[27/03/2007|09:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg7
[29/01/2007|17:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
[04/08/2008|18:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[29/01/2007|17:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[10/06/2008|13:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[05/08/2008|14:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[09/04/2008|09:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[07/08/2008|15:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[05/08/2008|08:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
[26/08/2008|12:00] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe
[28/10/2008|18:07] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\avg7
[10/09/2008|11:44] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Cyberlink
[08/08/2008|14:18] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Downloaded Installations
[29/11/2008|12:59] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\EnterNHelp
[21/08/2008|17:43] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google
[08/08/2008|12:17] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Grisoft
[04/12/2008|18:59] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
[17/11/2008|12:45] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft
[08/08/2008|10:17] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\MSN6
[29/11/2008|13:00] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Nikon
[26/08/2008|12:07] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\NOS
[09/08/2008|13:28] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\pixelStorm
[29/11/2008|12:59] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Stingers
[24/08/2008|10:07] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
[29/11/2008|12:59] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Ultima_T15
[08/08/2008|12:26] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Genuine Advantage
[10/09/2008|17:15] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller
[29/01/2007|16:56] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[07/08/2008|16:40] C:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\Microsoft
[26/08/2008|11:42] C:\DOCUME~1\jacky\APPLIC~1\Adobe
[26/08/2008|11:47] C:\DOCUME~1\jacky\APPLIC~1\AdobeUM
[06/12/2008|11:36] C:\DOCUME~1\jacky\APPLIC~1\AVG7
[28/10/2008|19:34] C:\DOCUME~1\jacky\APPLIC~1\CVitae
[10/09/2008|11:45] C:\DOCUME~1\jacky\APPLIC~1\CyberLink
[31/08/2008|15:24] C:\DOCUME~1\jacky\APPLIC~1\GARMIN
[21/08/2008|17:44] C:\DOCUME~1\jacky\APPLIC~1\Google
[08/08/2008|10:32] C:\DOCUME~1\jacky\APPLIC~1\Help
[07/08/2008|16:49] C:\DOCUME~1\jacky\APPLIC~1\Identities
[07/08/2008|17:04] C:\DOCUME~1\jacky\APPLIC~1\Macromedia
[04/12/2008|18:59] C:\DOCUME~1\jacky\APPLIC~1\Malwarebytes
[29/11/2008|13:01] C:\DOCUME~1\jacky\APPLIC~1\Microsoft
[08/08/2008|10:18] C:\DOCUME~1\jacky\APPLIC~1\MSN6
[29/10/2008|18:32] C:\DOCUME~1\jacky\APPLIC~1\OpenOffice.org
[28/10/2008|19:25] C:\DOCUME~1\jacky\APPLIC~1\OpenOffice.org2
[19/08/2008|12:02] C:\DOCUME~1\jacky\APPLIC~1\Sun
[07/08/2008|17:40] C:\DOCUME~1\jacky\APPLIC~1\vlc
[07/08/2008|17:45] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\AVG7
[13/09/2008|12:24] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\Microsoft
[08/08/2008|12:17] C:\DOCUME~1\NETWOR~1.AUT\APPLIC~1\Microsoft
--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks
[06/12/2008 12:00][--a------] C:\WINDOWS\tasks\lprixgxa.job
[06/12/2008 11:35][--ah-----] C:\WINDOWS\tasks\SA.DAT
[30/08/2002 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini
--------------------\\ Listing des dossiers dans C:\Program Files
[26/08/2008|11:59] C:\Program Files\Adobe
[05/03/2008|09:17] C:\Program Files\Apple Software Update
[29/11/2008|12:58] C:\Program Files\ArcSoft
[09/04/2008|09:07] C:\Program Files\Common Files
[29/01/2007|16:54] C:\Program Files\ComPlus Applications
[04/08/2008|19:05] C:\Program Files\CVitae
[31/08/2008|09:44] C:\Program Files\CyberLink
[24/04/2007|17:40] C:\Program Files\Dictionnaire
[07/08/2008|17:25] C:\Program Files\DIFX
[31/08/2008|09:36] C:\Program Files\Digital Photo Navigator 1.5
[25/09/2008|09:23] C:\Program Files\eMule
[06/08/2008|15:53] C:\Program Files\EoRezo
[05/12/2008|21:31] C:\Program Files\Everest Poker
[04/12/2008|17:25] C:\Program Files\Fichiers communs
[22/05/2007|09:30] C:\Program Files\Firaxis Games
[22/08/2008|07:28] C:\Program Files\Google
[29/01/2007|17:23] C:\Program Files\Grisoft
[29/11/2008|12:58] C:\Program Files\InstallShield Installation Information
[15/10/2008|12:15] C:\Program Files\Internet Explorer
[04/12/2008|15:52] C:\Program Files\Java
[29/10/2008|19:10] C:\Program Files\JRE
[29/01/2007|17:01] C:\Program Files\Media Player Classic
[26/08/2008|11:51] C:\Program Files\Messenger
[05/08/2008|16:35] C:\Program Files\microsoft frontpage
[08/08/2008|20:59] C:\Program Files\Microsoft LifeCam
[28/10/2008|19:35] C:\Program Files\Microsoft Office
[29/01/2007|17:48] C:\Program Files\Microsoft.NET
[10/06/2008|13:08] C:\Program Files\Mindscape
[26/08/2008|09:14] C:\Program Files\movie maker
[04/08/2008|19:03] C:\Program Files\Mozilla Firefox
[26/08/2008|09:14] C:\Program Files\msn
[05/08/2008|16:35] C:\Program Files\msn gaming zone
[01/09/2008|21:09] C:\Program Files\MSXML 4.0
[26/08/2008|09:09] C:\Program Files\netmeeting
[29/11/2008|13:00] C:\Program Files\Nikon
[26/08/2008|12:07] C:\Program Files\NOS
[30/01/2007|07:57] C:\Program Files\Ontrack
[28/10/2008|19:27] C:\Program Files\OpenOffice.org 2.4
[29/10/2008|19:10] C:\Program Files\OpenOffice.org 3
[26/08/2008|09:08] C:\Program Files\outlook express
[05/02/2008|18:48] C:\Program Files\PowerPoint Viewer
[27/08/2008|19:21] C:\Program Files\PowerQuest
[01/11/2008|17:33] C:\Program Files\QuickTime
[29/01/2007|17:01] C:\Program Files\Real Alternative
[24/08/2008|10:07] C:\Program Files\Registry Mechanic
[04/08/2008|17:19] C:\Program Files\SAGEM
[29/01/2007|17:02] C:\Program Files\Satsuki Decoder Pack
[04/08/2008|14:25] C:\Program Files\Securitoo
[29/01/2007|17:37] C:\Program Files\Serials 2005
[07/08/2008|16:39] C:\Program Files\Services en ligne
[04/12/2008|17:28] C:\Program Files\Softwin
[09/04/2008|09:09] C:\Program Files\Sony
[17/02/2005|01:01] C:\Program Files\Stardock
[29/01/2007|17:05] C:\Program Files\Synaptics
[05/12/2008|11:39] C:\Program Files\Trend Micro
[05/08/2008|16:35] C:\Program Files\Uninstall Information
[05/12/2008|21:09] C:\Program Files\UsbFix
[29/01/2007|17:06] C:\Program Files\VIA
[10/09/2008|10:52] C:\Program Files\VideoLAN
[08/08/2008|14:18] C:\Program Files\VirginMega
[09/10/2008|12:10] C:\Program Files\Windows Live
[19/08/2008|11:51] C:\Program Files\Windows Live Toolbar
[05/08/2008|13:48] C:\Program Files\Windows Media Connect 2
[05/09/2008|17:07] C:\Program Files\Windows Media Player
[26/08/2008|09:08] C:\Program Files\Windows NT
[07/08/2008|16:37] C:\Program Files\WindowsUpdate
[29/01/2007|17:02] C:\Program Files\WinRAR
[10/06/2008|13:11] C:\Program Files\WMV9_VCM
[05/08/2008|16:35] C:\Program Files\xerox
[04/12/2008|16:07] C:\Program Files\Yahoo!
--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs
[19/08/2008|11:49] C:\Program Files\Fichiers communs\Adobe
[04/08/2008|18:14] C:\Program Files\Fichiers communs\Adobe AIR
[05/03/2008|09:17] C:\Program Files\Fichiers communs\Apple
[29/01/2007|17:47] C:\Program Files\Fichiers communs\DESIGNER
[06/08/2008|15:56] C:\Program Files\Fichiers communs\InstallShield
[29/01/2007|17:01] C:\Program Files\Fichiers communs\Java
[28/10/2008|19:16] C:\Program Files\Fichiers communs\Microsoft Shared
[29/01/2007|16:55] C:\Program Files\Fichiers communs\MSSoap
[29/11/2008|13:00] C:\Program Files\Fichiers communs\muvee Technologies
[29/11/2008|13:01] C:\Program Files\Fichiers communs\Nikon
[29/01/2007|17:49] C:\Program Files\Fichiers communs\ODBC
[07/08/2008|16:38] C:\Program Files\Fichiers communs\Services
[04/12/2008|17:28] C:\Program Files\Fichiers communs\Softwin
[09/04/2008|09:09] C:\Program Files\Fichiers communs\Sony Shared
[05/08/2008|16:35] C:\Program Files\Fichiers communs\speechengines
[26/08/2008|09:08] C:\Program Files\Fichiers communs\System
[08/08/2008|12:46] C:\Program Files\Fichiers communs\WindowsLiveInstaller
--------------------\\ Process
( 40 Processes )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
C:\DOCUME~1\jacky\Cookies\jacky@advertising[1].txt
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-06 12:02:33
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 2
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
[F:31][D:32]-> C:\DOCUME~1\jacky\LOCALS~1\Temp
[F:491][D:0]-> C:\DOCUME~1\jacky\Cookies
[F:849][D:13]-> C:\DOCUME~1\jacky\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - 06/12/2008|11:46 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 06/12/2008|12:03 - Option : [3]
--------------------\\ Fin du rapport a 12:03:22 -
voila
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:24:59, on 06/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PCM4Everio\EverioService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EverioService] "C:\Program Files\CyberLink\PCM4Everio\EverioService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://lafleche25.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
-
ok ton rapport est propre
pour nettoyer les fix qui ont servit
Ferme toutes les applications en cours, puis télécharge ToolsCleaner2 sur ton Bureau.
http://www.commentcamarche.net/telecharger/telechargement 34055291 toolscleaner
Double clique sur ToolsCleaner2.exe >
puis Recherche
et sur Suppression
Note : ton bureau va disparaître, c'est normal. S'il n'apparaît pas à la fin du scan, fais la manip suivante :
CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"
Tape explorer.exe et valide. Cela fera re-apparaître le Bureau
tu poste le rapport générer après suppression
-
-
-
je croi ke c bon
[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]
-->- Recherche:
C:\lopR.txt: trouvé !
C:\Lop SD: trouvé !
C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\jacky\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\jacky\Recent\UsbFix.lnk: trouvé !
C:\Program Files\UsbFix: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
---------------------------------
-->- Suppression:
C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\jacky\Bureau\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\lopR.txt: supprimé !
C:\Documents and Settings\jacky\Recent\UsbFix.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Lop SD: supprimé !
C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\UsbFix: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !-
Ok
tu va télécharger Ccleaner https://www.ccleaner.com/ccleaner/download
ouvre "Ccleaner" vas dans l'onglet "Option" puis "Avancé" puis décoches "Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures."
. Puis vas dans l'onglet "Nettoyeur" fais "Analyse" puis "Lancer le nettoyage".
Puis vas dans l'onglet "Registre" puis fait "Chercher des erreurs" puis "Réparer les erreurs sélectionnée"
. Tu refais tous ca 4-5 fois (le nettoyage et le registre).
Puis reste dans "Ccleaner" puis va dans "Option" puis "Propriété" puis coches "Nettoyer automatiquement l'ordinateur au démarrage".
içi mode d'emploi pour ccleaner
https://www.malekal.com/tutoriel-ccleaner/
après sa tu redémarre et regarde si ta des soucie et tien nous au courant
-
-
bon bé je croit ke c bon je n'avait pas trop de soucis avan d'avoir cette antivirus2009
donc aucun soucis particulier il est comme avant
merci bien de ton aide puis jte di pas a tres bientot car c le brin comme on di dans le nord ^^
bonne continuation -
a si une derniere question je peut désinstaller tou se ke g telechargé pour netoyer lordi ???
