Infecté par gator a
bonjour à tous
je suis infectée par gator A et troj swizzor.dq et impossible de les supprimer avec pc cillin
il les met juste en quarantaine, je supprime mais ils reviennent
voici le log sur hijackthis
Quelqu'un peut-il m'aider svp
Logfile of HijackThis v1.99.1
Scan saved at 10:40:49, on 25/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\Icons\Seticon.exe
C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\RAMASST.exe
C:\Documents and Settings\GIL\Local Settings\Temp\snippy_snippy_0.22_anglais_15177.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCMAIN.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PccLog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.ifeozjsffpipxzibncy.com/POxAsd8yan_Nt8k9Gotxy0ZfMDjqFHTs_ym88QWNY2a06q...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cqzxbdrpcxvxxhsgwweesiy.com/POxAsd8yan9e7tdvUBb4ToCqj2GaxExEJenv9QEWXj...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {DD1671DA-DC10-2EDC-255F-AA2A2C74ECD1} - C:\DOCUME~1\GIL\APPLIC~1\tonsmess\SeekPlus.exe (file missing)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [Seticon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Beep New Trans Flaw] C:\Documents and Settings\All Users\Application Data\obj start beep new\BagsGlue.exe
O4 - HKLM\..\RunServices: [SystemSAS] system32.exe
O4 - HKCU\..\Run: [PURETIME] C:\DOCUME~1\GIL\APPLIC~1\CREATI~1\SUPPORT BALL ANTI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: PrecisionTime.lnk = C:\Program Files\PrecisionTime\PrecisionTime.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.caisse-epargne.fr/particuliers
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://eu.access.imerysnet.com/whalecom1a3da390a5a248560291036bd63acf950b4d06bdf...
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab27571.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://eu.access.imerysnet.com:/InternalSite/WhlCompMgr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab27571.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://register.tiscali.fr/configurateur/AccountHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
Merci d'avance pour vos réponse
Maria
je suis infectée par gator A et troj swizzor.dq et impossible de les supprimer avec pc cillin
il les met juste en quarantaine, je supprime mais ils reviennent
voici le log sur hijackthis
Quelqu'un peut-il m'aider svp
Logfile of HijackThis v1.99.1
Scan saved at 10:40:49, on 25/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\Icons\Seticon.exe
C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\RAMASST.exe
C:\Documents and Settings\GIL\Local Settings\Temp\snippy_snippy_0.22_anglais_15177.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCMAIN.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PccLog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.ifeozjsffpipxzibncy.com/POxAsd8yan_Nt8k9Gotxy0ZfMDjqFHTs_ym88QWNY2a06q...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cqzxbdrpcxvxxhsgwweesiy.com/POxAsd8yan9e7tdvUBb4ToCqj2GaxExEJenv9QEWXj...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {DD1671DA-DC10-2EDC-255F-AA2A2C74ECD1} - C:\DOCUME~1\GIL\APPLIC~1\tonsmess\SeekPlus.exe (file missing)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [Seticon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Beep New Trans Flaw] C:\Documents and Settings\All Users\Application Data\obj start beep new\BagsGlue.exe
O4 - HKLM\..\RunServices: [SystemSAS] system32.exe
O4 - HKCU\..\Run: [PURETIME] C:\DOCUME~1\GIL\APPLIC~1\CREATI~1\SUPPORT BALL ANTI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: PrecisionTime.lnk = C:\Program Files\PrecisionTime\PrecisionTime.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.caisse-epargne.fr/particuliers
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://eu.access.imerysnet.com/whalecom1a3da390a5a248560291036bd63acf950b4d06bdf...
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab27571.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://eu.access.imerysnet.com:/InternalSite/WhlCompMgr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab27571.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://register.tiscali.fr/configurateur/AccountHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
Merci d'avance pour vos réponse
Maria
20 réponses
Résumé de la discussion
L'infection par les malwares Gator.A et Swizzor.dq sur Windows XP est décrite, avec PC-Cillin qui ne supprime pas les menaces et les met en quarantaine sans élimination. Plusieurs intervenants recommandent des outils complémentaires et l'analyse de rapports, notamment lancer un scan BitDefender en ligne et partager les résultats pour vérifier les résidus. Des nettoyages successifs et suppressions de dossiers suspects, comme celui nommé SUPPORT BALL ANTI.exe, sont évoqués avec la réactualisation de HijackThis et l'examen des entrées de démarrage et de service. En dernière étape, un nouveau HijackThis est partagé après suppression du dossier Creat... et du fichier SUPPORT BALL ANTI, montrant une progression partielle et indiquant que d'autres vérifications restent utiles.
-
Re
Non y'a rien qui me permet de cocher
Un petit carré est à droite de mon titre mais ne sert pas à ça
Tant pis
@++++++
maria -
Re
merci encore
Mais où dois-je coher STP
bye
@+ -
Bonsoir et
merci beaucoup pour ton aide précieuse
@+
maria -
eh voila
C ok non?
This is a report processed by VirusTotal on 03/30/2006 at 19:56:33 (CET) after scanning the file "XCSyncML.exe" file.
Antivirus Version Update Result
AntiVir 6.34.0.14 03.30.2006 no virus found
Avast 4.6.695.0 03.29.2006 no virus found
AVG 386 03.30.2006 no virus found
Avira 6.34.0.54 03.30.2006 no virus found
BitDefender 7.2 03.30.2006 no virus found
CAT-QuickHeal 8.00 03.30.2006 no virus found
ClamAV devel-20060202 03.29.2006 no virus found
DrWeb 4.33 03.30.2006 no virus found
eTrust-InoculateIT 23.71.115 03.30.2006 no virus found
eTrust-Vet 12.4.2144 03.30.2006 no virus found
Ewido 3.5 03.30.2006 no virus found
Fortinet 2.71.0.0 03.30.2006 no virus found
F-Prot 3.16c 03.28.2006 no virus found
Ikarus 0.2.59.0 03.30.2006 no virus found
Kaspersky 4.0.2.24 03.30.2006 no virus found
McAfee 4730 03.30.2006 no virus found
NOD32v2 1.1462 03.30.2006 no virus found
Norman 5.70.10 03.30.2006 no virus found
Panda 9.0.0.4 03.30.2006 no virus found
Sophos 4.04.0 03.30.2006 no virus found
Symantec 8.0 03.30.2006 no virus found
TheHacker 5.9.7.122 03.30.2006 no virus found
UNA 1.83 03.23.2006 no virus found
VBA32 3.10.5 03.30.2006 no virus found
@+
maria -
Bonjour,
De retour sur le forum
Voila le hijackthis demandé après avoir supprimer le dossier Creat....et surtout le fichier SUPPORT BALL ANTI
merci pour ton analyse
Logfile of HijackThis v1.99.1
Scan saved at 19:00:25, on 30/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\Icons\Seticon.exe
C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\GIL\Mes documents\Maria\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tiscali.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [Seticon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
@+
maria-
Re :-)
Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
¤Analyse ce fichier: C:\WINDOWS\system32\XCSyncML.exe
http://www.virustotal.com/flash/index_en.html
quand tu es sur le site, tu cliques sur "parcourir" jusqu'au fichieren gras puis tu cliquera sur ok.
Tu attendra un peu puis si tu peux colles le rapport ici ou dit moi ce qu'il t'aura marqué.
Si non, je pense que ça sera bon et de ton côté ?
-
-
Re,
je vais me coucher
Bonne nuit
A demain si tu veux
@+
maria -
Re,
Désolée je ne suis pas encore couchée
dans ta procédure tu me demande de supprimer le dossier qui commence par CREAT... Impossible il ne veut pas se supprimer SUPPORT BALL ANTI.exe
que faire stp ?
merci
maria -
Re,
Merci
Je fais le hijackthis ce soir et le reste de la procédure demain car il est minuit
Je te recontacte demain si tu peux? et te donne le résultat.
OK?
en attendant bonne nuit et à demain
@+
maria -
Merci pour ton analyse
A part ça pourquoi dois-je supprimer cette ligne ci dessous car "imerys" est la société dans laquelle je travaille et elle nous permet de lire nos courriel de chez nous
est-ce vraiment un virus? et pourquoi?
Merci de me dire s'il faut tout de même supprimer les lignes faisant apparaitre le nom d'imerys.
Merci pour ta réponse avant que je commence la procédure que tu m'a donnée à faire.
@+
maria
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://eu.access.imerysnet.com:/InternalSite/WhlCompMgr.cab -
voilà !!!!
Peux-tu m'expliquer le problème?
Merci
@+
maria
Logfile of HijackThis v1.99.1
Scan saved at 22:34:49, on 29/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\Icons\Seticon.exe
C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\RAMASST.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\snippy_snippy_0.22_anglais_15177.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccVScan.exe
C:\Documents and Settings\GIL\Mes documents\Maria\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tiscali.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {DD1671DA-DC10-2EDC-255F-AA2A2C74ECD1} - (no file)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [Seticon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\RunServices: [SystemSAS] system32.exe
O4 - HKCU\..\Run: [PURETIME] C:\DOCUME~1\GIL\APPLIC~1\CREATI~1\SUPPORT BALL ANTI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.caisse-epargne.fr/particuliers
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://eu.access.imerysnet.com/whalecom1a3da390a5a248560291036bd63acf950b4d06bdf...
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab27571.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://eu.access.imerysnet.com:/InternalSite/WhlCompMgr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab27571.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://register.tiscali.fr/configurateur/AccountHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe-
Tu as encore deux virus que l'on peut voir là
Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"
O2 - BHO: (no name) - {DD1671DA-DC10-2EDC-255F-AA2A2C74ECD1} - (no file)
O4 - HKLM\..\RunServices: [SystemSAS] system32.exe
O4 - HKCU\..\Run: [PURETIME] C:\DOCUME~1\GIL\APPLIC~1\CREATI~1\SUPPORT BALL ANTI.exe
O15 - Trusted Zone: https://www.caisse-epargne.fr/particuliers
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://eu.access.imerysnet.com/whalecom1a3da390a5a248560291036bd63acf950b4d06bdf...
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab27571.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://eu.access.imerysnet.com:/InternalSite/WhlCompMgr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab27571.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://register.tiscali.fr/configurateur/AccountHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
Fais ceci:
Affiche tous les fichiers et dossiers :
Clique sur démarrer, panneau de configuration, outils ,option des dossiers, affichage
Coche: afficher les fichiers et dossiers cachés
Appliquer, puis ok
1. cliques sur demarrer, poste de travail, C:, documents and settings, GIL, application data, cherches et supprimes ce dossier:
CREATI.. < commence par CREATI
2. cliques sur demarrer, executer, tapes: msconfig ,vas dans l'onglet "services" coches la ase "masquer les services microsoft" puis recherches et si tu vois cette ligne decoches la ligne devant cette ligne:
SystemSAS
3.Refais un scan anti-virus en ligne et colles le rapport ici dès qu'il est terminé
https://www.bitdefender.com/toolbox/
A+++
-
-
Eh voila !!!! Enfin c fait
J'ai bien suivi toute la procédure que tu m'a donné et j'espère que maintenant grâce à ton aide et tes conseils je pourrai à l'avenir résoudre et nettoyer plus efficacement mon PC et surtout ne plus me laisser envahir par les virus, trojan et autres attaques .....
Je mets le lien de ce forum dans mes favoris car c'est le premier qui m'a donné rapidement une solution à mon problème
et merci à tous ceux qui donnent de leur temps pour aider des utilisateurs comme moi - Continuez -Bravo -
Merci pour ta patience
@
maria -
Je te remercie de me rappeler à l'ordre mais c comme ça qu'on apprends
Donc je fais et te re-message si j'ai réussi ou pas
A tout à l'heure
@+
maria -
Bonsoir,
Je pense aussi que c bon mais un peu plus haut dans la discussion tu me dis de faire un point de restauration manuel
Faut-il vraiment le faire?
en attendant je te remercie pour ton aide
Je ne connaissais pas ce forum et c le premier qui me donne la solution à mon problème.
merci
@+-
Re,
si tu as bien lu ce que je t'avais marqué, ta restauration du systeme est infecté..donc le fait de suivre ce que je t'ai marqué au dessus te supprimera les points infecté et si tu suis bien ce que je t'ai dit tu aura un point tout neuf tout propre en cas de probléme, comme ça tu ne remets pas les virus au cas ou tu restaures ton Pc :-)
Si tu as d'autres questions ou probléme hésite pas le forum est là ;-)
-
-
Bonsoir....
Me revoila avec le rapport du nouveau scan de bitfender
pas de virus trouver ouf !!!!!
que dois-je faire maintenant svp?
BitDefender Online Scanner
Scan report generated at: Wed, Mar 29, 2006 - 21:03:49
Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;
Statistics
Time
01:15:27
Files
495925
Folders
7639
Boot Sectors
2
Archives
4721
Packed Files
68516
Results
Identified Viruses
0
Infected Files
0
Suspect Files
0
Warnings
0
Disinfected
0
Deleted Files
0
Engines Info
Virus Definitions
349792
Engine build
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)
Scan plugins
13
Archive plugins
39
Unpack plugins
4
E-mail plugins
6
System plugins
1
Scan Settings
First Action
Disinfect
Second Action
Delete
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
*;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes
Scanned File
Status
No virus found. -
bonsoir,
Comme le scan dure tout de meme plus d'une heure je le lancerai demain soir et me permetrai de vous recontacter à ce moment là
merci pour votre patience
a demain
maria -
voila j'ai fais le ccleaner
malheureusement quand je fais lancer le nettoyage il me dit :
NETTOYAGE COMPLET - (0,132 secs)
------------------------------------------------------------------------------------------
6,61KB supprimés.
------------------------------------------------------------------------------------------
Détails des fichiers à effacer
------------------------------------------------------------------------------------------
Fichiers Temporaires d'Internet Explorer (fichiers 3) 6,61KB
ensuite je fais analyse et voila :
ANALYSE COMPLETE - (0,131 secs)
------------------------------------------------------------------------------------------
36,15KB ont été supprimé. (Taille approximative)
------------------------------------------------------------------------------------------
Détails des fichiers à supprimer (Note: AUCUN fichier n'a pour l'instant été supprimé)
------------------------------------------------------------------------------------------
C:\DOCUME~1\GIL\LOCALS~1\Temp\CmdLineExt02.dll 36,00KB
C:\WINDOWS\Debug\UserMode\userenv.log 154 bytes
je clique plusieurs fois et c'est toujours pareil
Est-ce normal ?
merci
maria-
rien de mechant apparament ne t'inquietes pas :-)
refait un scan avec Bitdefender et colles à nouveau le rapport ici stp
(redemarres le Pc si tu ne l'as pas fait avant de refaire le scna anti-virus en ligne)
https://www.bitdefender.com/toolbox/
-
-
bonsoir,
voila le scan effectué avec bitfender
merci
maria
BitDefender Online Scanner
Scan report generated at: Tue, Mar 28, 2006 - 21:51:09
Scan path: C:\;D:\;E:\;G:\;H:\;I:\;
Statistics
Time
01:23:07
Files
527741
Folders
8030
Boot Sectors
2
Archives
6415
Packed Files
69310
Results
Identified Viruses
20
Infected Files
61
Suspect Files
0
Warnings
0
Disinfected
0
Deleted Files
61
Engines Info
Virus Definitions
342327
Engine build
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)
Scan plugins
13
Archive plugins
39
Unpack plugins
4
E-mail plugins
6
System plugins
1
Scan Settings
First Action
Disinfect
Second Action
Delete
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
*;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes
Scanned File
Status
C:\Documents and Settings\GIL\Application Data\Creative play\ezlakewp.exe
Infected with: Trojan.Swizzor.CZ
C:\Documents and Settings\GIL\Application Data\Creative play\ezlakewp.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\ezlakewp.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\ganslbxr.exe
Infected with: Trojan.Swizzor.CK
C:\Documents and Settings\GIL\Application Data\Creative play\ganslbxr.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\ganslbxr.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\hwrsygjo.exe
Infected with: Trojan.Swizzor.AX
C:\Documents and Settings\GIL\Application Data\Creative play\hwrsygjo.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\hwrsygjo.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\mdudieku.exe
Infected with: Trojan.Downloader.Swizzor.DF
C:\Documents and Settings\GIL\Application Data\Creative play\mdudieku.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\mdudieku.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\moqbkcaj.exe
Infected with: Trojan.Downloader.Swizzor.DH
C:\Documents and Settings\GIL\Application Data\Creative play\moqbkcaj.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\moqbkcaj.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\nqlwszfw.exe
Infected with: Trojan.Swizzor.BA
C:\Documents and Settings\GIL\Application Data\Creative play\nqlwszfw.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\nqlwszfw.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\nyegfafn.exe
Infected with: Trojan.Downloader.Swizzor.CC
C:\Documents and Settings\GIL\Application Data\Creative play\nyegfafn.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\nyegfafn.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\oxtwikwu.exe
Infected with: MemScan:Trojan.Downloader.Swizzor.DV
C:\Documents and Settings\GIL\Application Data\Creative play\oxtwikwu.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\oxtwikwu.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\suikxsyi.exe
Infected with: Trojan.Downloader.Swizzor.DV
C:\Documents and Settings\GIL\Application Data\Creative play\suikxsyi.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\ThatPileSixth.exe
Infected with: Trojan.Swizzor.DH
C:\Documents and Settings\GIL\Application Data\Creative play\ThatPileSixth.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\ThatPileSixth.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\thoybzsq.exe
Infected with: Trojan.Downloader.Swizzor.DR
C:\Documents and Settings\GIL\Application Data\Creative play\thoybzsq.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\thoybzsq.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\tiyzholu.exe
Infected with: Trojan.Swizzor.CZ
C:\Documents and Settings\GIL\Application Data\Creative play\tiyzholu.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\tiyzholu.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\uuyxoehw.exe
Infected with: Trojan.Downloader.Swizzor.DE
C:\Documents and Settings\GIL\Application Data\Creative play\uuyxoehw.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\uuyxoehw.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\vzlveymh.exe
Infected with: Trojan.Downloader.Swizzor.DH
C:\Documents and Settings\GIL\Application Data\Creative play\vzlveymh.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\vzlveymh.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\wolylmgj.exe
Infected with: Trojan.Downloader.Swizzor.CC
C:\Documents and Settings\GIL\Application Data\Creative play\wolylmgj.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\wolylmgj.exe
Deleted
C:\Documents and Settings\GIL\Application Data\Creative play\woyppccb.exe
Infected with: Trojan.Downloader.Swizzor.CA
C:\Documents and Settings\GIL\Application Data\Creative play\woyppccb.exe
Disinfection failed
C:\Documents and Settings\GIL\Application Data\Creative play\woyppccb.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\1791af3.exe
Infected with: MemScan:Trojan.Downloader.Swizzor.DV
C:\Documents and Settings\GIL\Local Settings\Temp\1791af3.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\1791af3.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\56e33.exe
Infected with: Trojan.Downloader.Swizzor.DR
C:\Documents and Settings\GIL\Local Settings\Temp\56e33.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\56e33.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\56f48.exe
Infected with: Trojan.Downloader.Swizzor.DR
C:\Documents and Settings\GIL\Local Settings\Temp\56f48.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\56f48.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\dfnqtyfm.exe
Infected with: Trojan.Swizzor.X
C:\Documents and Settings\GIL\Local Settings\Temp\dfnqtyfm.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\dfnqtyfm.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\dqljzmbt.exe
Infected with: Trojan.Lopad.G
C:\Documents and Settings\GIL\Local Settings\Temp\dqljzmbt.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\dqljzmbt.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\lfgqbaai.exe
Infected with: Trojan.Swizzor.X
C:\Documents and Settings\GIL\Local Settings\Temp\lfgqbaai.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\lfgqbaai.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\lopremover.exe
Detected with: Adware.Lop
C:\Documents and Settings\GIL\Local Settings\Temp\lopremover.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\lopremover.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\npkzehlg.exe
Infected with: Trojan.Lopad.G
C:\Documents and Settings\GIL\Local Settings\Temp\npkzehlg.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\npkzehlg.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\pbikoltw.exe
Infected with: Trojan.Lopad.M
C:\Documents and Settings\GIL\Local Settings\Temp\pbikoltw.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\pbikoltw.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\pqvjkrwq.exe
Infected with: Trojan.Lopad.G
C:\Documents and Settings\GIL\Local Settings\Temp\pqvjkrwq.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\pqvjkrwq.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\qyvybatx.exe
Infected with: Trojan.Lopad.M
C:\Documents and Settings\GIL\Local Settings\Temp\qyvybatx.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\qyvybatx.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\rsxpeyfa.exe
Infected with: Trojan.Lopad.G
C:\Documents and Settings\GIL\Local Settings\Temp\rsxpeyfa.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\rsxpeyfa.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\swwscxgy.exe
Infected with: Trojan.Swizzor.X
C:\Documents and Settings\GIL\Local Settings\Temp\swwscxgy.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\swwscxgy.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\tedcpalb.exe
Infected with: Trojan.Swizzor.X
C:\Documents and Settings\GIL\Local Settings\Temp\tedcpalb.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\tedcpalb.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\vhtnzdvs.exe
Infected with: Trojan.Swizzor.X
C:\Documents and Settings\GIL\Local Settings\Temp\vhtnzdvs.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\vhtnzdvs.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\wgujcscl.exe
Infected with: Trojan.Lopad.N
C:\Documents and Settings\GIL\Local Settings\Temp\wgujcscl.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\wgujcscl.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\xflwormc.exe
Infected with: Trojan.Swizzor.X
C:\Documents and Settings\GIL\Local Settings\Temp\xflwormc.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\xflwormc.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\yephfylo.exe
Infected with: Trojan.Swizzor.X
C:\Documents and Settings\GIL\Local Settings\Temp\yephfylo.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\yephfylo.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\yuwlzhvr.exe
Infected with: Trojan.Swizzor.X
C:\Documents and Settings\GIL\Local Settings\Temp\yuwlzhvr.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\yuwlzhvr.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temp\zpqvkgnz.exe
Infected with: Trojan.Swizzor.X
C:\Documents and Settings\GIL\Local Settings\Temp\zpqvkgnz.exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temp\zpqvkgnz.exe
Deleted
C:\Documents and Settings\GIL\Local Settings\Temporary Internet Files\Content.IE5\SNCPWX4Z\new_uninstall[1].exe
Detected with: Adware.Lop
C:\Documents and Settings\GIL\Local Settings\Temporary Internet Files\Content.IE5\SNCPWX4Z\new_uninstall[1].exe
Disinfection failed
C:\Documents and Settings\GIL\Local Settings\Temporary Internet Files\Content.IE5\SNCPWX4Z\new_uninstall[1].exe
Deleted
C:\Documents and Settings\GIL\Mes documents\Mes images\Alexandra\petit film\Fitnessdesdoigts.exe
Infected with: Joke.Buttons
C:\Documents and Settings\GIL\Mes documents\Mes images\Alexandra\petit film\Fitnessdesdoigts.exe
Disinfection failed
C:\Documents and Settings\GIL\Mes documents\Mes images\Alexandra\petit film\Fitnessdesdoigts.exe
Deleted
C:\Documents and Settings\GIL\Mes documents\Stéphanie\petit fim\Fitnessdesdoigts.exe
Infected with: Joke.Buttons
C:\Documents and Settings\GIL\Mes documents\Stéphanie\petit fim\Fitnessdesdoigts.exe
Disinfection failed
C:\Documents and Settings\GIL\Mes documents\Stéphanie\petit fim\Fitnessdesdoigts.exe
Deleted
C:\Program Files\eMule\Incoming\Comment Gagner gros sur internet by ANGE\La 1ère astuce pour tricher avec eurobarre.zip=>La 1Šre astuce pour tricher avec eurobarre/Eurofake.exe
Infected with: Win32.Worm.Kelvir.BP
C:\Program Files\eMule\Incoming\Comment Gagner gros sur internet by ANGE\La 1ère astuce pour tricher avec eurobarre.zip=>La 1Šre astuce pour tricher avec eurobarre/Eurofake.exe
Disinfection failed
C:\Program Files\eMule\Incoming\Comment Gagner gros sur internet by ANGE\La 1ère astuce pour tricher avec eurobarre.zip=>La 1Šre astuce pour tricher avec eurobarre/Eurofake.exe
Deleted
C:\Program Files\eMule\Incoming\Comment Gagner gros sur internet by ANGE\La 1ère astuce pour tricher avec eurobarre.zip
Updated
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009647.exe
Infected with: MemScan:Trojan.Downloader.Swizzor.DV
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009647.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009647.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009648.exe
Infected with: Trojan.Swizzor.DH
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009648.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009648.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009680.exe
Detected with: Adware.Lop
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009680.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009680.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP53\A0009791.exe
Infected with: Trojan.Swizzor.DH
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP53\A0009791.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP53\A0009791.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP56\A0009947.exe
Infected with: Trojan.Swizzor.DH
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP56\A0009947.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP56\A0009947.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010322.exe
Infected with: Trojan.Swizzor.CZ
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010322.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010322.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010323.exe
Infected with: Trojan.Swizzor.CK
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010323.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010323.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010324.exe
Infected with: Trojan.Swizzor.AX
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010324.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010324.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010325.exe
Infected with: Trojan.Downloader.Swizzor.DF
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010325.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010325.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010326.exe
Infected with: Trojan.Downloader.Swizzor.DH
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010326.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010326.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010327.exe
Infected with: Trojan.Swizzor.BA
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010327.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010327.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010328.exe
Infected with: Trojan.Downloader.Swizzor.CC
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010328.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010328.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010329.exe
Infected with: MemScan:Trojan.Downloader.Swizzor.DV
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010329.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010329.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010330.exe
Infected with: Trojan.Downloader.Swizzor.DV
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010330.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010331.exe
Infected with: Trojan.Swizzor.DH
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010331.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010331.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010332.exe
Infected with: Trojan.Downloader.Swizzor.DR
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010332.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010332.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010333.exe
Infected with: Trojan.Swizzor.CZ
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010333.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010333.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010334.exe
Infected with: Trojan.Downloader.Swizzor.DE
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010334.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010334.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010335.exe
Infected with: Trojan.Downloader.Swizzor.DH
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010335.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010335.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010336.exe
Infected with: Trojan.Downloader.Swizzor.CC
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010336.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010336.exe
Deleted
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010337.exe
Infected with: Trojan.Downloader.Swizzor.CA
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010337.exe
Disinfection failed
C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010337.exe
Deleted-
fais ceci et seulement après tu mets un nouveau rapport hijackthis ;-)
¤Telecharges et installes ceci, dans la colonne de gauche cliques sur "erreurs" coches toutes les cases, puis cliques en bas sur "chercher des erreurs" une fois finit, cliques sur "reparer les erreurs" et tu aura un message pour sauvegarder ta base de registre tu dis "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs
CCleaner:
Ccleaner
¤Relance Ccleaner ,vas dans l'onglet "nettoyeur" present sur la gauche, decoches la derniere case (Avancé si elle est cochée) puis cliques sur "lancer le nettoyage"
Alors ceci C:\System Volume Information\_restore indique que ta restauration du systeme est infecté.Nous allons Tout supprimer et créer un point propre.
Cliques sur demarrer, cliques droit sur poste de travail, propriétés, onglet "restauratuion du systeme"
-coches la case, puis cliques sur "appliquer"
-decoches la case et cliques sur "appluiquer" puis "ok".
Maintenant, que l'ont à effacés les point infectés, nous allons créer un point propre:
Cliques sur demarrer, tout les programmes, accessoires, outils systemes, restauration du systeme, choisis "creer un point de restauration" nommes le " ccm" par exemple, cliques sur "creer" puis "ok".
-
-
ok
je lance le scan
je mange avec ma petite famille
et je reviens
merci encore pour tout
maria -
Re bonjour
voici le log du hijack après scan ewido
merci pour ton analyse
Logfile of HijackThis v1.99.1
Scan saved at 20:04:21, on 28/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\Icons\Seticon.exe
C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\RAMASST.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\snippy_snippy_0.22_anglais_15177.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccVScan.exe
C:\Documents and Settings\GIL\Mes documents\Maria\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tiscali.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {DD1671DA-DC10-2EDC-255F-AA2A2C74ECD1} - C:\DOCUME~1\GIL\APPLIC~1\tonsmess\SeekPlus.exe (file missing)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [Seticon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\RunServices: [SystemSAS] system32.exe
O4 - HKCU\..\Run: [PURETIME] C:\DOCUME~1\GIL\APPLIC~1\CREATI~1\SUPPORT BALL ANTI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: PrecisionTime.lnk = C:\Program Files\PrecisionTime\PrecisionTime.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.caisse-epargne.fr/particuliers
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://eu.access.imerysnet.com/whalecom1a3da390a5a248560291036bd63acf950b4d06bdf...
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab27571.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://eu.access.imerysnet.com:/InternalSite/WhlCompMgr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab27571.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://register.tiscali.fr/configurateur/AccountHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe -
ContributeurBonjour Maria,
~~ Fais ceci dans l'ordre ~~
1/ Télécharge et scanne ton PC avec Ewido Security Suite : https://www.01net.com/telecharger/
Copie/colle le rapport entier sur le forum.
2/ Scanne ton PC avec cet antivirus en ligne :
https://www.bitdefender.com/toolbox/
Clique sur "I Agree" et scanne tout le PC.
Pense à accepter l'ActiveX bloqué par la barre anti-popup du SP2 (elle clignotera en haut).
Copie/colle le rapport entier sur le forum.
3/ Remets un nouveau log HijackThis.
Bonne chance.
++
-
Bonjour
Désolée de ne pas t'avoir répondu plus tot cause déplacement
voici le rapport de mon scan avec ewido
ensuite de te posterai le nouveau hijack
merci encore pour ton aide
---------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------
+ Créé le: 19:47:02, 28/03/2006
+ Somme de contrôle: E17FA0D4
+ Résultats du scan:
C:\Documents and Settings\GIL\Cookies\gil@112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@247realmedia[2].txt -> TrackingCookie.247realmedia : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@2o7[2].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@66.220.17[1].txt -> TrackingCookie.66.220.17.154 : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@adtech[2].txt -> TrackingCookie.Adtech : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@advertising[2].txt -> TrackingCookie.Advertising : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@as-eu.falkag[2].txt -> TrackingCookie.Falkag : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@as1.falkag[1].txt -> TrackingCookie.Falkag : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@banner.clubdicecasino[2].txt -> TrackingCookie.Clubdicecasino : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@banner.goldenpalace[2].txt -> TrackingCookie.Goldenpalace : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@casalemedia[2].txt -> TrackingCookie.Casalemedia : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@casinodelrio[1].txt -> TrackingCookie.Casinodelrio : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@casinopays[1].txt -> TrackingCookie.Casinopays : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@centrport[1].txt -> TrackingCookie.Centrport : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@com[2].txt -> TrackingCookie.Com : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@crbanner.casinopays[2].txt -> TrackingCookie.Casinopays : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@ehg-ads.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@ehg-nokiafin.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@estat[1].txt -> TrackingCookie.Estat : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@fastclick[2].txt -> TrackingCookie.Fastclick : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@fun.com.18345.fb.dbbsrv[1].txt -> TrackingCookie.Dbbsrv : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@goldenpalace[2].txt -> TrackingCookie.Goldenpalace : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@image.masterstats[1].txt -> TrackingCookie.Masterstats : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@images.lop[1].txt -> TrackingCookie.Lop : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@overture[2].txt -> TrackingCookie.Overture : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@perf.overture[1].txt -> TrackingCookie.Overture : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@questionmarket[1].txt -> TrackingCookie.Questionmarket : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@redcats.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@revenue[2].txt -> TrackingCookie.Revenue : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@search.starware[1].txt -> TrackingCookie.Starware : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@sel.as-eu.falkag[2].txt -> TrackingCookie.Falkag : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@sfr.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@tacoda[1].txt -> TrackingCookie.Tacoda : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@weborama[2].txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@webstat[1].txt -> TrackingCookie.Web-stat : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@wreport.weborama[1].txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@www.casinodelrio[2].txt -> TrackingCookie.Casinodelrio : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@www.goldenpalace[1].txt -> TrackingCookie.Goldenpalace : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Cookies\gil@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder
C:\Documents and Settings\GIL\Local Settings\Temporary Internet Files\Content.IE5\SNCPWX4Z\WinFixer2005ScannerInstallFRA[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Nettoyer et sauvegarder
C:\Program Files\eMule\Incoming\Comment Gagner gros sur internet by ANGE\La 1ère astuce pour tricher avec eurobarre.zip/La 1Šre astuce pour tricher avec eurobarre/Eurofake.exe -> Worm.Kelvir.bp : Erreur durant le nettoyage
::Fin du rapport
-
