Aide a lire toolbar s.d
Résolu
Bonjour,
j avais 1 probleme desinstaller vuze toolbar..et g cherche des solution..et g trouve ce programme <toolbar s.d....
sur ce site https://www.commentcamarche.net/faq/9685-supprimer-les-barres-d-outils-toolbars-indesirables
Mais j aimerais bien 1 connaisseur m aide...a debarase de ce foutu vuze.voici le rapport
-----------\\ ToolBar S&D 1.2.9 XP/Vista
Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-58 )
BIOS : PhoenixBIOS 4.0 Release 6.1
USER : Mohammed ( Administrator )
BOOT : Normal boot
Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
Firewall : ZoneAlarm Firewall 7.0.483.000 (Activated)
C:\ (Local Disk) - NTFS - Total:142 Go (Free:84 Go)
D:\ (Local Disk) - NTFS - Total:6 Go (Free:6 Go)
"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [1] ( 17.03.2010| 0:28 )
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ Extensions
(Mohammed) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user
(Mohammed) - {40a1f5d7-afc2-498f-b264-02668d616ff6} => megamanager
(Mohammed) - {ba14329e-9550-4989-b3f2-9732e92d17cc} => vuze_remote
(Mohammed) - {EEE6C361-6118-11DC-9C72-001320C79847} => sweetim-toolbar
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr/"
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
1 - "C:\ToolBar SD\TB_1.txt" - 17.03.2010| 0:30 - Option : [1]
-----------\\ Fin du rapport a 0:30:38,35
j avais 1 probleme desinstaller vuze toolbar..et g cherche des solution..et g trouve ce programme <toolbar s.d....
sur ce site https://www.commentcamarche.net/faq/9685-supprimer-les-barres-d-outils-toolbars-indesirables
Mais j aimerais bien 1 connaisseur m aide...a debarase de ce foutu vuze.voici le rapport
-----------\\ ToolBar S&D 1.2.9 XP/Vista
Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-58 )
BIOS : PhoenixBIOS 4.0 Release 6.1
USER : Mohammed ( Administrator )
BOOT : Normal boot
Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
Firewall : ZoneAlarm Firewall 7.0.483.000 (Activated)
C:\ (Local Disk) - NTFS - Total:142 Go (Free:84 Go)
D:\ (Local Disk) - NTFS - Total:6 Go (Free:6 Go)
"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [1] ( 17.03.2010| 0:28 )
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ Extensions
(Mohammed) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user
(Mohammed) - {40a1f5d7-afc2-498f-b264-02668d616ff6} => megamanager
(Mohammed) - {ba14329e-9550-4989-b3f2-9732e92d17cc} => vuze_remote
(Mohammed) - {EEE6C361-6118-11DC-9C72-001320C79847} => sweetim-toolbar
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr/"
--------------------\\ Recherche d'autres infections
Aucune autre infection trouvée !
1 - "C:\ToolBar SD\TB_1.txt" - 17.03.2010| 0:30 - Option : [1]
-----------\\ Fin du rapport a 0:30:38,35
Configuration: Windows XP / Firefox 3.0.18
18 réponses
-
slt,
MBAM n as rien trouve...tt est ok...g crois...
Grands Merci a vous. -
OK destrio...Merci pour ton aide g collerais le rapport lorske ce fini
-
ModérateurJe vais dormir, bonne nuit.
---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse. -
oh Merci..ce enlever..mais j aimerais bien ke tu jette 1 coup d oeil sur mon hijackthis..juste pour voir..si tt est normale.mon antivirus avira a trouve fakAlert trojan..y a 2 jours..et g le supprimer..mais..g ss pas..
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:36:16, on 17.03.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\windows\System32\smss.exe
C:\windows\SYSTEM32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\Programfiler\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Programfiler\Avira\AntiVir Desktop\sched.exe
C:\Programfiler\Fellesfiler\Acronis\Schedule2\schedul2.exe
C:\Programfiler\Avira\AntiVir Desktop\avguard.exe
C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programfiler\Bonjour\mDNSResponder.exe
C:\windows\System32\svchost.exe
C:\Programfiler\Java\jre6\bin\jqs.exe
C:\Programfiler\Fellesfiler\LightScribe\LSSrvc.exe
C:\windows\system32\nvsvc32.exe
C:\Programfiler\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\Programfiler\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\windows\system32\svchost.exe
C:\Programfiler\Fellesfiler\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programfiler\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\windows\system32\ICO.EXE
C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
C:\Programfiler\Windows Defender\MSASCui.exe
C:\windows\system32\rundll32.exe
C:\Programfiler\Avira\AntiVir Desktop\avgnt.exe
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
C:\Programfiler\Hewlett-Packard\Shared\HpqToaster.exe
C:\Programfiler\Winamp\winampa.exe
C:\Programfiler\Java\jre6\bin\jusched.exe
C:\windows\system32\ctfmon.exe
C:\Programfiler\Messenger\msmsgs.exe
C:\Programfiler\Ares\Ares.exe
C:\Programfiler\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programfiler\Megaupload\Mega Manager\MegaManager.exe
C:\windows\explorer.exe
C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programfiler\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre6\bin\ssv.dll
O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Programfiler\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programfiler\Java\jre6\bin\jp2ssv.dll
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programfiler\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programfiler\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programfiler\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Programfiler\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Programfiler\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programfiler\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Programfiler\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avgnt] "C:\Programfiler\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programfiler\Fellesfiler\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programfiler\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ares] "C:\Programfiler\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: PalTalk.lnk = C:\Programfiler\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Programfiler\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {7A0D1738-10EA-47FF-92BE-4E137B5BE1A4} (Stm Class) - https://mpsnare.iesnare.com/StmOCX.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (Ma-Config control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_0_2_0.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programfiler\Fellesfiler\Acronis\Schedule2\schedul2.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Programfiler\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programfiler\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programfiler\Bonjour\mDNSResponder.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: Service Google Update (gupdate1c9e863b3228e84) (gupdate1c9e863b3228e84) - Google Inc. - C:\Programfiler\Google\Update\GoogleUpdate.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programfiler\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programfiler\Fellesfiler\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Programfiler\ma-config.com\maconfservice.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Programfiler\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Programfiler\Fellesfiler\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
-
ModérateurSinon, c'est expliqué ici :
http://wiki.vuze.com/?View=entry&EntryID=206 -
pour le programme vuze...g des-installer longtime..mais le tolbar reste encore..g ss pas cmt enleveer pcq...g vois pas de tolbar vuze installer sur ajout/supprimer
-
Contributeursalut destrio5
j´ai des liens datant de l´avant guerre on dirait :)
bises`-
-
Contributeur@Destrio5suis plus à la page; claire...
bonne nuit`
-
-
ModérateurTu ne peux pas tout simplement la désinstaller à partir du Panneau de configuration ?
-
oui..mais g tjrs tolbar vuze..sur mon mozilla....ke dois faire..???
-
Modérateur--> Relance Ad-Remover et choisis Désinstaller.
Le problème est réglé ? -
Bonsoir destrio voici le rapport de ad-remover
.
======= RAPPORT D'AD-REMOVER 2.0.0.0,A | ONLY XP/VISTA/7 =======
.
Updated by C_XX on 15/03/10 à 17:00
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Started: 02:13:24 le 17/03/2010 | Normal boot | Option: CLEAN
Executed from: C:\Ad-Remover\ADR.exe
Operating systèm: Microsoft® Windows XP™ Service Pack 3
Computer name: HP | Current user: Mohammed (Administrator)
.
============== FIXED ELEMENTS ==============
.
.
C:\DOCUME~1\Mohammed\LOKALE~1\Temp\ASKSUTBLOG
C:\DOCUME~1\Mohammed\LOKALE~1\Temp\Del_AskHPRFF.VBS
C:\Documents and Settings\Mohammed\Programdata\Mozilla\FireFox\Profiles\84dm41mz.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
C:\Documents and Settings\Mohammed\Programdata\Mozilla\FireFox\Profiles\84dm41mz.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
C:\Documents and Settings\Mohammed\Programdata\Mozilla\FireFox\Profiles\84dm41mz.default\searchplugins\askcom.xml
C:\Documents and Settings\Mohammed\Programdata\Mozilla\FireFox\Profiles\84dm41mz.default\SweetIMToolbarData
C:\Programfiler\Mozilla FireFox\Components\AskSearch.js
(!) -- Deleted temporary files.
.
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKLM\Software\Microsoft\ESENT\Process\SweetIM
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}
.
============== ADDITIONNAL SCAN ==============
.
* Mozilla FireFox Version 3.0.18 (fr) *
.
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\Mohammed\\Mine dokumenter\\Mine bilder
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.search.defaultenginename: Ask
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.search.defaulturl: hxxp://search.sweetim.com/search.asp?src=2&q=
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.search.selectedEngine: Ask
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.startup.homepage: www.google.fr
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.0.18
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - sweetim.toolbar.previous.browser.search.defaultenginename: Live Search
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - sweetim.toolbar.previous.browser.search.defaulturl: hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - sweetim.toolbar.previous.browser.search.selectedEngine: Live Search
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - sweetim.toolbar.previous.browser.startup.homepage: hxxp://go.microsoft.com/fwlink/?LinkId=69157
C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - sweetim.toolbar.previous.keyword.URL: hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
.
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("extensions.snipit.chromeURL", "hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q={searchTerms}&crm=1");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.mode.debug", "false");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "Live Search");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://search.live.com/results.aspx?FORM=IEFM1&q=");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "Live Search");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://go.microsoft.com/fwlink/?LinkId=69157");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.live.com/results.aspx?FORM=IEFM1&q=");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.search.history.capacity", "10");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.simapp_id", "{23FDE954-6171-411E-A4DA-F09790FAD874}");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com");
ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.version", "1.0.0.8");
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKCU\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
.
[HKLM\Software\Microsoft\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
.
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
.
========================================
.
C:\DOCUME~1\Mohammed\LOKALE~1\Temp: 3 Files, 6 Folders
C:\windows\temp: 4 Files, 9 Folders
Temporary Internet Files: 2 Files, 23 Folders
.
C:\Ad-Remover\Quarantine: 4 Files
C:\Ad-Remover\Backup: 14 Files
.
C:\Ad-Report-CLEAN[1].txt - 9302 Byte(s)
.
End at:02:20:41, 17/03/2010
.
============== E.O.F - CLEAN[1] ============== -
ModérateurBonjour (Salut g!rly),
● Télécharge Ad-Remover (de C_XX) sur ton Bureau.
● Déconnecte-toi d'Internet et ferme toutes applications en cours.
● Double-clique sur le programme AD-R situé sur ton Bureau.
● Clique sur Nettoyer puis valide.
● Poste le rapport généré (C:\Ad-Report-CLEAN.log).
(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller) -
Dsl..mon pc est norvegiens ....donc...
Voici.le rapport..
17.03.2010 ---- 1:34:33,67
----------------------------------
§§§§§§ [vuze] §§§§§§
----------------------------------
[X] Registre
[ ] Fichier (rapide)
[ ] Fichier (disque systeme)
[X] Fichier (complete)
********************
[Registre]
********************
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vuze]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vuze]
@="Vuze"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Azureus]
@="Vuze Download"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-vuze]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-vuze]
"Extension"=".vuze"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Vuze]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Vuze]
@="Vuze File"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Vuze\DefaultIcon]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Vuze\shell]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Vuze\shell\open]
[HKEY_LOCAL_MACHINE\SOFTWARE\magnet\Handlers\Azureus]
"Description"="Download with Vuze (formerly Azureus)"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\9d1d354a-604e-4ee6-a69c-9bc3a00e4867]
"AppPath"="C:\\Programfiler\\Vuze_Remote"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\9d1d354a-604e-4ee6-a69c-9bc3a00e4867]
"AppName"="Vuze_RemoteToolbarHelper.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Azureus Vuze]
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Conduit\AppPaths\Vuze.exe]
"c:\\documents and settings\\mohammed\\lokale innstillinger\\temporary internet files\\content.ie5\\nadf71fd\\vuze_installer[1].exe"=dword:000016fc
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="vuze"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Azureus Vuze]
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\.vuze]
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\.vuze]
@="Vuze"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\.vuze]
"Content Type"="application/x-vuze"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\Azureus]
@="Vuze Download"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\MIME\Database\Content Type\application/x-vuze]
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\MIME\Database\Content Type\application/x-vuze]
"Extension"=".vuze"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\Vuze]
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\Vuze]
@="Vuze File"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\Vuze]
"Content Type"="application/x-vuze"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\Vuze\shell]
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\.vuze]
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\.vuze]
@="Vuze"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\.vuze]
"Content Type"="application/x-vuze"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\Azureus]
@="Vuze Download"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\MIME\Database\Content Type\application/x-vuze]
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\MIME\Database\Content Type\application/x-vuze]
"Extension"=".vuze"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\Vuze]
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\Vuze]
@="Vuze File"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\Vuze]
"Content Type"="application/x-vuze"
[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\Vuze\shell]
*******************
[Fichier]
*******************
c:\Documents and Settings\All Users\Skrivebord\Vuze.lnk
c:\Documents and Settings\Mohammed\Programdata\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
c:\Programfiler\Azureus\Vuze.ico
*********************
[Même date]
*********************
Aucun fichier créé à la même date détecté
----------------------------------
§§§§§ Fin Rapport §§§§§
---------------------------------- -
Contributeurfais comme ton instinct te dicte :)
-
bsoir g vois pas de cadre niveau de privilege ke g dois crocher...dois je contunuer ou..me le redire d 1 autre maniere
Mrci -
Contributeuril y a bien un tas de toolbar mais pas de vuze ?!
fais ceci :
Télécharge sur ton bureau OAD (Outil Aide Diagnostic) de !aur3n7 : http://sosvirus.changelog.fr/OAD.exe
Clique droit sur le fichier OAD.exe et sur Propriétés, dans l'onglet Compatibilité, Cadre "Niveau de privilège" coche
"Exécuter ce programme en tant qu'administrateur".
Lance-le en cliquant sur OAD.exe, entre le nom du fichier suivant "Vuze", puis Entrée.
Dans la fenêtre suivante tape 6 puis entrée et laisse le scan se terminer.
Copie-colle la totalité du rapport qui s'ouvre dans le blocnote dans ta prochaine réponse.
-
bonsoir, Merci de repondre si vite..voici le rapport hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:14:43, on 17.03.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\windows\System32\smss.exe
C:\windows\SYSTEM32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\Programfiler\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Programfiler\Avira\AntiVir Desktop\sched.exe
C:\Programfiler\Fellesfiler\Acronis\Schedule2\schedul2.exe
C:\Programfiler\Avira\AntiVir Desktop\avguard.exe
C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programfiler\Bonjour\mDNSResponder.exe
C:\windows\System32\svchost.exe
C:\Programfiler\Java\jre6\bin\jqs.exe
C:\Programfiler\Fellesfiler\LightScribe\LSSrvc.exe
C:\windows\system32\nvsvc32.exe
C:\Programfiler\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\Programfiler\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\windows\system32\svchost.exe
C:\Programfiler\Fellesfiler\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\windows\Explorer.EXE
C:\Programfiler\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\windows\system32\ICO.EXE
C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
C:\windows\system32\RUNDLL32.EXE
C:\Programfiler\Windows Defender\MSASCui.exe
C:\windows\system32\rundll32.exe
C:\Programfiler\Avira\AntiVir Desktop\avgnt.exe
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
C:\Programfiler\Hewlett-Packard\Shared\HpqToaster.exe
C:\Programfiler\Winamp\winampa.exe
C:\Programfiler\Java\jre6\bin\jusched.exe
C:\windows\system32\ctfmon.exe
C:\Programfiler\Windows Live\Messenger\MsnMsgr.Exe
C:\Programfiler\Messenger\msmsgs.exe
C:\Programfiler\Ares\Ares.exe
C:\Programfiler\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programfiler\Mozilla Firefox\firefox.exe
C:\Programfiler\Megaupload\Mega Manager\MegaManager.exe
C:\windows\system32\wuauclt.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programfiler\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre6\bin\ssv.dll
O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Programfiler\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programfiler\Java\jre6\bin\jp2ssv.dll
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programfiler\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programfiler\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programfiler\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Programfiler\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Programfiler\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programfiler\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Programfiler\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avgnt] "C:\Programfiler\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programfiler\Fellesfiler\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programfiler\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ares] "C:\Programfiler\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: PalTalk.lnk = C:\Programfiler\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Programfiler\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - https://www.eset.com/
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {7A0D1738-10EA-47FF-92BE-4E137B5BE1A4} (Stm Class) - https://mpsnare.iesnare.com/StmOCX.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (Ma-Config control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_0_2_0.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programfiler\Fellesfiler\Acronis\Schedule2\schedul2.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Programfiler\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programfiler\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programfiler\Bonjour\mDNSResponder.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: Service Google Update (gupdate1c9e863b3228e84) (gupdate1c9e863b3228e84) - Google Inc. - C:\Programfiler\Google\Update\GoogleUpdate.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programfiler\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programfiler\Fellesfiler\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Programfiler\ma-config.com\maconfservice.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Programfiler\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Programfiler\Fellesfiler\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
-
Contributeursalut
donne moi de quoi voir.
Télécharge HijackThis ici :
-> https://www.commentcamarche.net/telecharger/securite/11747-hijackthis/
Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)
-> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm
Post le rapport généré ici stp...
