Trojan.win.32.scapur.k

davidz7518 -  
bonjour voici mon probleme avec un virus merci a bientot
C:\Program Files\Fichiers communs\Yazzle1220OinAdmin.exe Infection: Trojan.Win32.Scapur.kLogfile of HijackThis v1.99.1
Scan saved at 17:13:45, on 05/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\Wireless 802.11g Monitor\WLService.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Wireless 802.11g Monitor\WLanCfgG.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\SDVita\SDVita.exe
C:\Program Files\AXVenore\AXVenore.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\eDonkey2000\edonkey2000.exe
C:\Program Files\ipwins\ipwins.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\PECarlin\PECarlin.exe
C:\Program Files\Common Files\svchostsys\svchostsys.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\eDonkey2000\friend.met.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\GreatMemo\GreatMemo.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\01URW1QR\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavil...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavil...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavil...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavil...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fourni par Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {FDF1F829-2F3C-A7AB-9A49-B9CF620DBACD} - C:\WINDOWS\mrhapjhy.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {30040038-A52E-8253-2B95-1E84EEB11BE2} - C:\WINDOWS\mrhapjhy.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\Dealio.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\Dealio.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [au] "C:\Program Files\Dealio\DealioAu.exe"
O4 - HKLM\..\Run: [eDonkey2000] "C:\Program Files\eDonkey2000\edonkey2000.exe" -t
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AXVenore] "C:\Program Files\AXVenore\AXVenore.exe"
O4 - HKCU\..\Run: [PECarlin] "C:\Program Files\PECarlin\PECarlin.exe"
O4 - HKCU\..\Run: [DNS] C:\Program Files\Fichiers communs\mc-110-12-0000122.exe
O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - Startup: GreatMemo.lnk = C:\Program Files\GreatMemo\GreatMemo.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\res\DealioSearch.html
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\Dealio.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Alice ADSL - {3C0A4DE2-6FD0-492E-8B1B-4AFF02980BC6} - https://portail.free.fr/ (file missing) (HKCU)
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O14 - IERESET.INF: START_PAGE_URL=https://portail.free.fr/
O16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/PackageHtmlCab.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Filter: text/html - {994D478A-45D0-4DB4-AE77-738B1E346E99} - C:\Program Files\SDVita\SDVita.dll
O20 - AppInit_DLLs: Runner.dll,bkecfmpm.dll,Runner.dll,amiogmpd.dll,SDRunner.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: R54G Wireless Service - Unknown owner - C:\Program Files\Wireless 802.11g Monitor\WLService.exe
voici mon rapport hitjackthis merci
Configuration: xp familiale

23 réponses

  1. phk30
    bonsoir je n'avait pas xp familial j'ai essayer avec xp pro mais il s'est installer a côté et n'a rien réparer est ce normal? est ce que je dois formater mais je vais perdre toute les données,comme word exel etc et l'on ne m'a pas donné de cd uand je l'ai acheté a confo, merci a bientot et encore merci pour les conseils.
    0
    1. phk30
      Salut david je viens demain on va faire le message de seb 08 et je pense que ca va marcher salut bonne nuit
      0
      2. davidz7518 Auteur
        salut je n'ai toujours rien sur ma page de bureau et quand je vais sur demarrer je n'ai rien non plus. salut a bientot
        0
        2. davidz7518 Auteur
          la resraueation n'a pas marche existe t'il autre pour recuperer les fichiers,bonne nuit et merci encore pour tous ces tuyaus
          0
          1. bernie61
            re
            tu peux essayer Démarrer/exécuter tappes là
            CMD

            une fenêtre dos s'ouvre tu vas à
            c:\windows\system32\restore\rstrui.exe

            cd.. pour descendre d'un niveau puis à nouveau si nécessaire pour être à c:

            puis tappes cd windows
            puis cd system32
            puis restore
            et là tappes rstrui.exe

            dis quoi
            0
            1. davidz7518 Auteur
              bonsoir une fenetre s'ouvre "HPIZplus450" qui veut installer un fichier windows merci pour + d'info
              0
              1. Séb08 Contributeur
                Bizarre...
                tu as redémarré ton PC ?
                0
                1. davidz7518 Auteur
                  re il n'y aplus rien dans le menu demarrer impossible d'activer merci comment lancer la restauration autrement merci
                  0
                  1. davidz7518 Auteur
                    re je sais il a effacer tout sur l'écran les progr etc et je ne peut plus activer demarrer accesoire restauration merci
                    0
                    1. bernie61
                      re
                      cleanup est bien aussi, comme ccleaner

                      "tout effacer " > tu veux dire quoi là?

                      c'est quoi ton pbm?
                      a+
                      0
                      1. davidz7518 Auteur
                        re j'ai lancer 1 logiciel de merde cleanup 2 qui m'a tout effacer et je ne peut pas faire de restauration est ce que je peut en mode sans echec merci encore pour tout
                        0
                        1. bernie61
                          re
                          ensuite tu passes Ccleaner
                          tu redémarres et refais un hijack
                          a+
                          0
                          1. bernie61
                            re
                            donc tu effaces ces 2 fichiers aussi
                            a+
                            0
                            1. davidz7518 Auteur
                              VirusTotalVirusTotal is a free file analisys service that works using several antivirus engines.

                              Select file : DistributeSSL

                              Enter your email, choose the file to be scanned with multiple antivirus engines and click Send.Menu:
                              News Hot news in the virus/antivirus sector.
                              Estadisticas Statistics of VirusTotal procesing.
                              Virustotal More info about Virustotal.

                              STATUS: FINISHEDComplete scanning result of "Catcher.dll_", received in VirusTotal at 06.05.2006, 19:54:58 (CET).

                              Antivirus Version Update Result
                              AntiVir 6.34.1.37 06.05.2006 no virus found
                              Authentium 4.93.8 06.02.2006 no virus found
                              Avast 4.7.844.0 06.05.2006 no virus found
                              AVG 386 06.05.2006 no virus found
                              BitDefender 7.2 06.05.2006 no virus found
                              CAT-QuickHeal 8.00 06.05.2006 no virus found
                              ClamAV devel-20060426 06.05.2006 no virus found
                              DrWeb 4.33 06.05.2006 Adware.Maxifiles
                              eTrust-InoculateIT 23.72.28 06.04.2006 no virus found
                              eTrust-Vet 12.6.2243 06.05.2006 no virus found
                              Ewido 3.5 06.05.2006 Adware.Maxifiles
                              Fortinet 2.77.0.0 06.05.2006 no virus found
                              F-Prot 3.16f 06.02.2006 no virus found
                              Ikarus 0.2.65.0 06.02.2006 no virus found
                              Kaspersky 4.0.2.24 06.05.2006 not-a-virus:AdWare.Win32.Maxifiles.a
                              McAfee 4777 06.05.2006 potentially unwanted program Adware-Shorty
                              Microsoft 1.1441 06.05.2006 no virus found
                              NOD32v2 1.1579 06.05.2006 no virus found
                              Norman 5.90.17 06.05.2006 no virus found
                              Panda 9.0.0.4 06.05.2006 no virus found
                              Sophos 4.05.0 06.05.2006 no virus found
                              Symantec 8.0 06.05.2006 no virus found
                              TheHacker 5.9.8.155 06.05.2006 no virus found
                              UNA 1.83 06.05.2006 no virus found
                              VBA32 3.11.0 06.05.2006 no virus found

                              Aditional Information
                              File size: 528384 bytes
                              MD5: a6de7da83c695be6cbddc533e1240d39
                              SHA1: ae2b622569def5ee0d5ee1903cd138b8a7dcae9b

                              VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
                              > Ir a: Inicio Contactar En Español
                              --------------------------------------------------------------------------------
                              www.virustotal.com :: ©Hispasec Sistemas 2004-06:: e-mail info@virustotal.com
                              salut après du travail voici 1 rapport virus total
                              et voici l'autre
                              VirusTotalVirusTotal is a free file analisys service that works using several antivirus engines.

                              Select file : DistributeSSL

                              Enter your email, choose the file to be scanned with multiple antivirus engines and click Send.Menu:
                              News Hot news in the virus/antivirus sector.
                              Estadisticas Statistics of VirusTotal procesing.
                              Virustotal More info about Virustotal.

                              STATUS: FINISHEDComplete scanning result of "mc-110-12-0000122.exe_", received in VirusTotal at 06.05.2006, 20:01:42 (CET).

                              Antivirus Version Update Result
                              AntiVir 6.34.1.37 06.05.2006 no virus found
                              Authentium 4.93.8 06.02.2006 no virus found
                              Avast 4.7.844.0 06.05.2006 no virus found
                              AVG 386 06.05.2006 no virus found
                              BitDefender 7.2 06.05.2006 no virus found
                              CAT-QuickHeal 8.00 06.05.2006 (Suspicious) - DNAScan
                              ClamAV devel-20060426 06.05.2006 no virus found
                              DrWeb 4.33 06.05.2006 Adware.Maxifiles
                              eTrust-InoculateIT 23.72.28 06.04.2006 no virus found
                              eTrust-Vet 12.6.2243 06.05.2006 no virus found
                              Ewido 3.5 06.05.2006 no virus found
                              Fortinet 2.77.0.0 06.05.2006 Adware/Shorty
                              F-Prot 3.16f 06.02.2006 no virus found
                              Ikarus 0.2.65.0 06.02.2006 no virus found
                              Kaspersky 4.0.2.24 06.05.2006 no virus found
                              McAfee 4777 06.05.2006 potentially unwanted program Adware-Shorty
                              Microsoft 1.1441 06.05.2006 no virus found
                              NOD32v2 1.1579 06.05.2006 no virus found
                              Norman 5.90.17 06.05.2006 no virus found
                              Panda 9.0.0.4 06.05.2006 Adware/Maxifiles
                              Sophos 4.05.0 06.05.2006 no virus found
                              Symantec 8.0 06.05.2006 no virus found
                              TheHacker 5.9.8.155 06.05.2006 no virus found
                              UNA 1.83 06.05.2006 no virus found
                              VBA32 3.11.0 06.05.2006 no virus found

                              Aditional Information
                              File size: 342636 bytes
                              MD5: 84d5f05716bb0757445d5de1d3234d56
                              SHA1: dbd3391b489e08d61619fa4411bf692e9b7bcc2b

                              VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
                              > Ir a: Inicio Contactar En Español
                              --------------------------------------------------------------------------------
                              www.virustotal.com :: ©Hispasec Sistemas 2004-06:: e-mail info@virustotal.com
                              mille merci pour tout ces conseils a bientot
                              0
                              1. davidz7518 Auteur
                                Logfile of HijackThis v1.99.1
                                Scan saved at 19:40:19, on 05/06/2006
                                Platform: Windows XP SP2 (WinNT 5.01.2600)
                                MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                                Running processes:
                                C:\WINDOWS\System32\smss.exe
                                C:\WINDOWS\system32\winlogon.exe
                                C:\WINDOWS\system32\services.exe
                                C:\WINDOWS\system32\lsass.exe
                                C:\WINDOWS\system32\Ati2evxx.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\system32\Ati2evxx.exe
                                C:\WINDOWS\Explorer.EXE
                                C:\WINDOWS\system32\spoolsv.exe
                                C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
                                C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
                                C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
                                C:\WINDOWS\system32\HPZipm12.exe
                                C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
                                C:\Program Files\Wireless 802.11g Monitor\WLService.exe
                                C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
                                C:\Program Files\Wireless 802.11g Monitor\WLanCfgG.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\Program Files\F-Secure\Common\FSMA32.EXE
                                C:\Program Files\F-Secure\Common\FSMB32.EXE
                                C:\Program Files\F-Secure\Common\FCH32.EXE
                                C:\Program Files\F-Secure\Common\FAMEH32.EXE
                                C:\Program Files\F-Secure\Common\FNRB32.EXE
                                C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
                                C:\Program Files\F-Secure\Common\FIH32.EXE
                                C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                                C:\windows\system\hpsysdrv.exe
                                C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                C:\WINDOWS\AGRSMMSG.exe
                                C:\WINDOWS\system32\hphmon06.exe
                                C:\HP\KBD\KBD.EXE
                                C:\WINDOWS\ALCXMNTR.EXE
                                C:\Program Files\F-Secure\Common\FSM32.EXE
                                C:\Program Files\QuickTime\qttask.exe
                                C:\Program Files\eDonkey2000\edonkey2000.exe
                                C:\Program Files\Messenger\msmsgs.exe
                                C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                C:\Program Files\ipwins\date.exe
                                C:\WINDOWS\system32\wuauclt.exe
                                C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
                                C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
                                C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
                                C:\Program Files\Internet Explorer\IEXPLORE.EXE
                                C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\XHPYHDEC\HijackThis[1].exe

                                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
                                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavil...
                                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://portail.free.fr/
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavil...
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavil...
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=pavil...
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
                                R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
                                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fourni par Alice ADSL
                                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
                                O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                                O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
                                O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
                                O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                                O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                                O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                                O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                                O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
                                O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
                                O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                                O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                                O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                                O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
                                O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
                                O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
                                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                                O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
                                O4 - HKLM\..\Run: [eDonkey2000] "C:\Program Files\eDonkey2000\edonkey2000.exe" -t
                                O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
                                O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                                O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                                O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                                O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
                                O4 - HKCU\..\Run: [DNS] C:\Program Files\Fichiers communs\mc-110-12-0000122.exe
                                O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
                                O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                                O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
                                O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
                                O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
                                O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
                                O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
                                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                                O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\Dealio.dll (file missing)
                                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                O9 - Extra button: Alice ADSL - {3C0A4DE2-6FD0-492E-8B1B-4AFF02980BC6} - https://portail.free.fr/ (file missing) (HKCU)
                                O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
                                O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
                                O14 - IERESET.INF: START_PAGE_URL=https://portail.free.fr/
                                O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
                                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                                O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                                O20 - AppInit_DLLs: Runner.dll,bkecfmpm.dll,Runner.dll,amiogmpd.dll,SDRunner.dll
                                O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                                O23 - Service: F-Secure BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
                                O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
                                O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
                                O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
                                O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
                                O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
                                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                                O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                                O23 - Service: R54G Wireless Service - Unknown owner - C:\Program Files\Wireless 802.11g Monitor\WLService.exe

                                voici un rapport hitjackthis, je n'arrive pas a lancer virus total et je veut pas faire de bétise avec le repertoire des fichiers a effacer
                                merci a bientot
                                0
                                1. davidz7518 Auteur
                                  3. Effacer ces programmes .EXE et .DLL( et à la fin vider la corbeille)
                                  C:\WINDOWS\mrhapjhy.dll
                                  C:\Program Files\PECarlin\ > le répertoire
                                  C:\Program Files\Common Files\svchostsys\ > le répertoire
                                  C:\Program Files\Dealio\ > le répertoire
                                  C:\Program Files\AXVenore\ > le répertoire
                                  C:\Program Files\Fichiers communs\mc-110-12-0000122.exe > si méchant
                                  C:\Program Files\GreatMemo\ > le répertoire
                                  C:\Program Files\SDVita\ >> le répertoire
                                  salut ou est le repertoire faut il enlever tout le fichier merci a bientot
                                  0
                                  1. bernie61
                                    re
                                    oui il faut enlever tous les fichiers
                                    a+
                                    0
                                2. davidz7518 Auteur
                                  BitDefender Online Scanner

                                  Rapport d'analyse généré à: Mon, Jun 05, 2006 - 18:37:09

                                  Voie d'analyse: C:\;D:\;E:\;G:\;H:\;I:\;J:\;

                                  Statistiques

                                  Temps
                                  02:25:04

                                  Fichiers
                                  461785

                                  Directoires
                                  4718

                                  Secteurs de boot
                                  3

                                  Archives
                                  15311

                                  Paquets programmes
                                  40960

                                  Résultats

                                  Virus identifiés
                                  6

                                  Fichiers infectés
                                  9

                                  Fichiers suspects
                                  0

                                  Avertissements
                                  0

                                  Désinfectés
                                  0

                                  Fichiers effacés
                                  5

                                  Info sur les moteurs

                                  Définition virus
                                  386524

                                  Version des moteurs
                                  AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)

                                  Analyse des plugins
                                  13

                                  Archive des plugins
                                  40

                                  Unpack des plugins
                                  4

                                  E-mail plugins
                                  6

                                  Système plugins
                                  1

                                  Paramètres d'analyse

                                  Première action
                                  Désinfecté

                                  Seconde Action
                                  Supprimé

                                  Heuristique
                                  Oui

                                  Acceptez les avertissements
                                  Oui

                                  Extensions analysées
                                  *;

                                  Excludez les extensions

                                  Analyse d'emails
                                  Oui

                                  Analyse des Archives
                                  Oui

                                  Analyser paquets programmes
                                  Oui

                                  Analyse des fichiers
                                  Oui

                                  Analyse de boot
                                  Oui

                                  Fichier analysé
                                  Statut

                                  C:\Program Files\AXVenore\AXVenore.exe
                                  Infecté par: Trojan.Agent.LM

                                  C:\Program Files\AXVenore\AXVenore.exe
                                  Echec de la désinfection

                                  C:\Program Files\AXVenore\AXVenore.exe
                                  Echec de la suppression

                                  C:\Program Files\Common Files\misc001\Mendoza.exe
                                  Infecté par: Dropped:Trojan.Dropper.VB.MZ

                                  C:\Program Files\Common Files\misc001\Mendoza.exe
                                  Echec de la désinfection

                                  C:\Program Files\Common Files\misc001\Mendoza.exe
                                  Supprimé

                                  C:\Program Files\PECarlin\PECarlin.exe
                                  Infecté par: Trojan.Agent.LM

                                  C:\Program Files\PECarlin\PECarlin.exe
                                  Echec de la désinfection

                                  C:\Program Files\PECarlin\PECarlin.exe
                                  Echec de la suppression

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP127\A0014771.exe
                                  Infecté par: Trojan.Downloader.6298.B

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP127\A0014771.exe
                                  Echec de la désinfection

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP127\A0014771.exe
                                  Supprimé

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP158\A0022252.dll
                                  Infecté par: Trojan.Dloader.F

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP158\A0022252.dll
                                  Echec de la désinfection

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP158\A0022252.dll
                                  Supprimé

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP158\A0022462.exe
                                  Infecté par: Dropped:Trojan.Dropper.VB.MZ

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP158\A0022462.exe
                                  Echec de la désinfection

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP158\A0022462.exe
                                  Supprimé

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP98\A0012225.dll
                                  Détecté avec: Application.Adware.NewDotNet.B

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP98\A0012225.dll
                                  Echec de la désinfection

                                  C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP98\A0012225.dll
                                  Supprimé

                                  C:\WINDOWS\system32\amiogmpd.dll
                                  Infecté par: Trojan.Cmapp.A

                                  C:\WINDOWS\system32\amiogmpd.dll
                                  Echec de la désinfection

                                  C:\WINDOWS\system32\amiogmpd.dll
                                  Echec de la suppression

                                  C:\WINDOWS\system32\bkecfmpm.dll
                                  Infecté par: Trojan.Cmapp.A

                                  C:\WINDOWS\system32\bkecfmpm.dll
                                  Echec de la désinfection

                                  C:\WINDOWS\system32\bkecfmpm.dll
                                  Echec de la suppression

                                  voici le rapport bit defender, je n'arrive pas a lancer virus total merci a +
                                  0
                                  1. bernie61
                                    re
                                    éh oui avec ces jeunes aux examens,lol,
                                    a+
                                    0
                                    1. incognito02 Contributeur
                                      Salut Bernie :-)

                                      Tu nous fais un one-man show ce week end ! lol

                                      0
                                      • 1
                                      • 2

                                      Discussions similaires

                                      À quoi correspond 32x32 US en taille française pour un jean ?
                                      Alison1958

                                      1 réponse
                                      svp 32Gb est il egal a 32Go??
                                      William Fernand

                                      3 réponses
                                      Quelle est la différence entre les GO et GB ?
                                      badour

                                      37 réponses
                                      32 GO, est-ce suffisant ?
                                      Alexia14

                                      2 réponses
                                      Problème de décodeur TV Bouygues Telecom
                                      Massi119

                                      188 réponses