Rapport Hijackthis -
Résolu
Bonjour,
Depuis 2 jours, je me bats avec le fameux virus "Your computer is infected".
J'ai donc suivi la procédure qui était préposé sur le forum pour enrayer ce mal. Ce virus est apparemment parti mais mon pc ne répond pas comme d'habitude. J'ai toujours les fameux pop-ups désagréable que je n'avais pas avant et qui ralentit considérablement ma connection internet et qui se plante systématiquement. Merci d'avance
Ci-joint un rapport généré par Hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 9:39:57, on 19/08/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\Q0xFTUVOVElORQ\command.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
D:\i-\iTunesHelper.exe
C:\WINDOWS\System32\9336407c.exe
C:\windows\system32\stonedrv.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\spoolsvv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\NCLAUNCH.EXe
D:\WINZIP\WZQKPICK.EXE
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\{156718F5-0321-2060-1211-001202190020}\Update.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC04.EXE
C:\WINDOWS\explorer.exe
D:\Adaware\Hijackthis2\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.proximus.be/pickx
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr7/*https://fr.search.yahoo.com/
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {E63B6BD3-B56D-6AEC-024D-054A5A69E748} - C:\WINDOWS\dkyav1.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr-be\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\i-\iTunesHelper.exe"
O4 - HKLM\..\Run: [bikini] bikini.exe
O4 - HKLM\..\Run: [uydv1.exe] C:\WINDOWS\TEMP\uydv1.exe
O4 - HKLM\..\Run: [9336407c.exe] C:\WINDOWS\System32\9336407c.exe
O4 - HKLM\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\Run: [wrmdrv] rundll32.exe C:\WINDOWS\System32\wrmdrv.dll,start
O4 - HKLM\..\Run: [fam2f8e2] RUNDLL32.EXE w009e8a7.dll,n 0032f8df0000000a009e8a7
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [spoolsvv] C:\WINDOWS\System32\spoolsvv.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [9336407c.exe] C:\Documents and Settings\CLEMENTINE\Application Data\9336407c.exe
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - HKCU\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [WinMedia] C:\DOCUME~1\CLEMEN~1\LOCALS~1\Temp\41.tmp3072.exe
O4 - HKCU\..\Run: [Winsvr] C:\DOCUME~1\CLEMEN~1\LOCALS~1\Temp\41.tmp5120.exe
O4 - HKCU\..\Run: [taskdir] C:\WINDOWS\System32\taskdir.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\WINZIP\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://m6video.m6.fr/1click/install/files/installer2.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/9.20.0002/OCI/setup.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AA760512-9BD8-4B1B-9E7A-DD9BBE3CF119} (PandoraBoxCtrl Class) - http://front.boonty.com/Prometheus/PandoraX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D9CA5D65-52BE-4790-BEA3-F3E2F5A76B02} (WebRecomendada Class) - http://62.97.81.200/dll/clickweb.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/v3/InstallGoaIT/ChatAx/V4,0,5,4/npaxchat.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA4CB4EB-0588-4B6B-BD86-8FE82128FDAA}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: SMDEn - C:\WINDOWS\system32\guard.tmp (file missing)
O21 - SSODL: dLPAbXqTmuwT - {156718F6-BFCD-B25C-22E8-65CC54498F4D} - C:\WINDOWS\System32\zeid.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\2236_28.dll
O23 - Service: AVSync Manager (AvSynMgr) - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Q0xFTUVOVElORQ\command.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogYjl - Unknown owner - \\?\C:\Program Files\Fichiers communs\System\lpt4.exe (file missing)
O23 - Service: McShield - Unknown owner - C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
Depuis 2 jours, je me bats avec le fameux virus "Your computer is infected".
J'ai donc suivi la procédure qui était préposé sur le forum pour enrayer ce mal. Ce virus est apparemment parti mais mon pc ne répond pas comme d'habitude. J'ai toujours les fameux pop-ups désagréable que je n'avais pas avant et qui ralentit considérablement ma connection internet et qui se plante systématiquement. Merci d'avance
Ci-joint un rapport généré par Hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 9:39:57, on 19/08/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\Q0xFTUVOVElORQ\command.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
D:\i-\iTunesHelper.exe
C:\WINDOWS\System32\9336407c.exe
C:\windows\system32\stonedrv.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\spoolsvv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\NCLAUNCH.EXe
D:\WINZIP\WZQKPICK.EXE
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\{156718F5-0321-2060-1211-001202190020}\Update.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC04.EXE
C:\WINDOWS\explorer.exe
D:\Adaware\Hijackthis2\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.proximus.be/pickx
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr7/*https://fr.search.yahoo.com/
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {E63B6BD3-B56D-6AEC-024D-054A5A69E748} - C:\WINDOWS\dkyav1.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr-be\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\i-\iTunesHelper.exe"
O4 - HKLM\..\Run: [bikini] bikini.exe
O4 - HKLM\..\Run: [uydv1.exe] C:\WINDOWS\TEMP\uydv1.exe
O4 - HKLM\..\Run: [9336407c.exe] C:\WINDOWS\System32\9336407c.exe
O4 - HKLM\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\Run: [wrmdrv] rundll32.exe C:\WINDOWS\System32\wrmdrv.dll,start
O4 - HKLM\..\Run: [fam2f8e2] RUNDLL32.EXE w009e8a7.dll,n 0032f8df0000000a009e8a7
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [spoolsvv] C:\WINDOWS\System32\spoolsvv.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [9336407c.exe] C:\Documents and Settings\CLEMENTINE\Application Data\9336407c.exe
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - HKCU\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [WinMedia] C:\DOCUME~1\CLEMEN~1\LOCALS~1\Temp\41.tmp3072.exe
O4 - HKCU\..\Run: [Winsvr] C:\DOCUME~1\CLEMEN~1\LOCALS~1\Temp\41.tmp5120.exe
O4 - HKCU\..\Run: [taskdir] C:\WINDOWS\System32\taskdir.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\WINZIP\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://m6video.m6.fr/1click/install/files/installer2.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/9.20.0002/OCI/setup.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AA760512-9BD8-4B1B-9E7A-DD9BBE3CF119} (PandoraBoxCtrl Class) - http://front.boonty.com/Prometheus/PandoraX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D9CA5D65-52BE-4790-BEA3-F3E2F5A76B02} (WebRecomendada Class) - http://62.97.81.200/dll/clickweb.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/v3/InstallGoaIT/ChatAx/V4,0,5,4/npaxchat.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA4CB4EB-0588-4B6B-BD86-8FE82128FDAA}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: SMDEn - C:\WINDOWS\system32\guard.tmp (file missing)
O21 - SSODL: dLPAbXqTmuwT - {156718F6-BFCD-B25C-22E8-65CC54498F4D} - C:\WINDOWS\System32\zeid.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\2236_28.dll
O23 - Service: AVSync Manager (AvSynMgr) - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Q0xFTUVOVElORQ\command.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogYjl - Unknown owner - \\?\C:\Program Files\Fichiers communs\System\lpt4.exe (file missing)
O23 - Service: McShield - Unknown owner - C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
Configuration: Windows XP pro
16 réponses
Résumé de la discussion
Le fil porte sur une infection affichant le message 'Your computer is infected' sur un PC Windows XP, provoquant des pop-ups, des lenteurs réseau et des plantages malgré une procédure de désinfection suivie. Des analyses avec HijackThis et des rapports répétés révèlent de multiples entrées suspectes et des services problématiques; des mesures évoquées incluent SmitFraudFix, ewido/anti-spyware, et le contrôle via VirusTotal. D'autres interventions recommandent d'activer un pare-feu et un antivirus à jour, de supprimer les éléments de démarrage suspects et de nettoyer les barres d'outils ou DLL potentiellement malveillantes. Plusieurs rapports montrent des entrées et des modules résidants qui persistent malgré les nettoyages, soulignant la complexité de ce type d'infection.
-
Salut,
Tu as tout ce qu'il faut au choix ci dessous ;
nettoyeur de registre
JV16
télécharger la version gratuite de JV16
Vous pouvez télécharger JV16 sur les sites suivant :
https://puntocr.it/index.php?module=downloads_riz&func=display&pid(...)
ou
http://david.duchamp.free.fr/Telechargement/jv16%20PowerTools1.3.0.195.exe
Tuto è http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Maintenance/compatible-vista-windows-sujet_167629_1.htm
télécharger la version gratuite de Ccleaner
nettoyeur de registre, cookies+temps+tempos+prefetch+historique+etc..
Vous pouvez télécharger Ccleaner sur le site suivant :
https://www.ccleaner.com/ccleaner/download
Tuto ->
https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php
anti-spywares
télécharger la version gratuite de Ad-Aware SE
Vous pouvez télécharger Ad-Aware SE sur le site suivant
https://www.google.com
Tuto => http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/question-aware-personal-sujet_169105_1.htm
antivirus gratuits
télécharger la version gratuite de Avast
Vous pouvez télécharger Avast sur le site suivant
https://www.avast.com/free-antivirus-download
Tuto ->
http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/questions-avast-sujet_176199_1.htm
pare-feu gratuits
télécharger la version gratuite de Zone alarm
Vous pouvez télécharger ZoneAlarm depuis le site suivant :
https://www.zonealarm.com
Il faut cliquer sur le lien Téléchargez la version GRATUITE de ZoneAlarm®
Tuto =>
http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/zonealarm-tutorial-sujet_169658_1.htm#post5519058
désactivé les parties filtrage web et antivirus de ZA ! C'est important
ou
télécharger la version gratuite de Kerio (avec Avast => moins de conflits)
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
Tuto =>
https://www.vulgarisation-informatique.com/kerio.php
================
antivirus gratuit lequel choisir
A conserver
https://sebsauvage.net/
A++ -
Contributeur sécuritésalut
si tu ne peux le mettre a jour, installer pare feu et antivirus !
ou en sont tes soucis?
a+-
Il y a un pare-feu en principe avec XP Pro, dois-je en mettre encore un. Dois-je rechercher dans le commerce un nouvel anti-virus + firewall ?
Ce qui est étonnant, c'est qu'en 5 ans d'utilisation sur le net, c'est bien la première fois que mon pc chope un virus aussi tenace.
Pour mes soucis, c'est incroyable comme malgré les bons conseils que tu m'as donné fonctionne un temps et puis tout d'un coup, il y a des pop-ups qui apparaissent je ne sais d'où et toujours dans la crainte de retrouver cette fameuse croix rouge "Your computer is infected" parmi ces fameux pop-ups.
-
-
Contributeur sécuritésalut
parce que tu n as pas mis a jour windows !
Télécharge ceci: (merci a S!RI pour ce programme).
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.
----------------------------------------------------------------------------
Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
Relance le programme Smitfraud,
Cette fois choisit l’option 2, répond oui a tous ;
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum
Bye-
Merci de ton aide...
Malheureusement, je ne sais plus mettre mon windows à jour du fait que ce n'est pas la version origininale.
Voici mon rapport smitfraudix
SmitFraudFix v2.81
Rapport fait à 18:52:31,17, mar. 29/08/2006
Executé à partir de D:\fix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Fix executé en mode sans echec
»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304BB2236}"="DCOM Server 2236"
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
C:\drsmartload?.exe supprimé
»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.
»»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304BB2236}"="DCOM Server 2236"
»»»»»»»»»»»»»»»»»»»»»»»» Fin
-
-
Voici, le rapport hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 19:55:49, on 27/08/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\Q0xFTUVOVElORQ\command.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
D:\fix\ewido anti-spyware 4.0\guard.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
D:\i-\iTunesHelper.exe
C:\WINDOWS\System32\taskmngr32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Fichiers communs\{156718F5-0321-2060-1211-001202190020}\Update.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\NCLAUNCH.EXe
D:\WINZIP\WZQKPICK.EXE
C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\DOCUME~1\CLEMEN~1\LOCALS~1\Temp\15dfec89.exe
D:\Adaware\Hijackthis2\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr-be\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\i-\iTunesHelper.exe"
O4 - HKLM\..\Run: [Task Manager Win32] C:\WINDOWS\System32\taskmngr32.exe
O4 - HKLM\..\Run: [scmlib] rundll32.exe C:\WINDOWS\System32\scmlib.dll,start
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\WINZIP\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA4CB4EB-0588-4B6B-BD86-8FE82128FDAA}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVSync Manager (AvSynMgr) - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Q0xFTUVOVElORQ\command.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\fix\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe -
Salut clemence,
Bonjour Régis, si cela ne te dérange pas.........
Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} - http://m6video.m6.fr/1click/install/files/installer2.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/9.20.0002/OCI/setup.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AA760512-9BD8-4B1B-9E7A-DD9BBE3CF119} (PandoraBoxCtrl Class) - http://front.boonty.com/Prometheus/PandoraX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D9CA5D65-52BE-4790-BEA3-F3E2F5A76B02} - http://62.97.81.200/dll/clickweb.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} - http://images.goa.com/v3/InstallGoaIT/ChatAx/V4,0,5,4/npaxchat.cab
Refais un Hitjakthis.
Une fois ton pc clean, n'oublie pas de mettre ton Windows à jour
A++
-
Contributeur sécuritéBonjour,
Méthode à suivre dans l'ordre...
----------------------------------------------------------------------------
¤Télécharge ces logiciels mais que tu n‘utilises pas tout de suite:
1/
Spybot S&D 1.4
https://www.safer-networking.org/
Démo d’utilisation (merci à Balltrap34 pour cette réalisation).
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
2/
Ad-Aware SE 1.06
https://www.adaware.com/
-Une aide:
http://usa.lucretius-ada.com/zcvisitor/8782d344-4821-11ea-83ce-0a2cdf2c6be7?campaignid=0d1dff40-82d7-11e9-9533-0a157bfa6bfc
- installe le patch français, tu pourras le trouver ici:
http://download.lavasoft.de.edgesuite.net/public/pllangs.exe
et une petite vidéo d'utilisation ici:(merci à Moe31 pour cette réalisation).
http://pageperso.aol.fr/balltrap34/adawrevid.asf
3/ Ewido:
http://perso.orange.fr/entraide-hijackthis/Ewido/
Installation puis mises à jour.
4/ Ccleaner :
https://www.pcastuces.com/logitheque/ccleaner.htm
----------------------------------------------------------------------------
¤Affiche tous les fichiers et dossiers :
Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage
Coche « afficher les fichiers et dossiers cachés »
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Décoche « masquer les extensions dont le type est connu »
Puis fais «Ok» pour valider les changements.
Et appliquer !
----------------------------------------------------------------------------
¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :
R3 - Default URLSearchHook is missing
O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)
O4 - HKLM\..\Run: [9336407c.exe] C:\WINDOWS\System32\9336407c.exe
O4 - HKLM\..\Run: [fam2f8e2] RUNDLL32.EXE w009e8a7.dll,n 0032f8df0000000a009e8a7
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKCU\..\Run: [9336407c.exe] C:\Documents and Settings\CLEMENTINE\Application Data\9336407c.exe
O16 - DPF: {AA760512-9BD8-4B1B-9E7A-DD9BBE3CF119} (PandoraBoxCtrl Class) - http://front.boonty.com/Prometheus/PandoraX.cab
O16 - DPF: {D9CA5D65-52BE-4790-BEA3-F3E2F5A76B02} - http://62.97.81.200/dll/clickweb.cab
O21 - SSODL: dLPAbXqTmuwT - {156718F6-BFCD-B25C-22E8-65CC54498F4D} - C:\WINDOWS\System32\zeid.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - (no file)
O23 - Service: Win32 Kernel Update (Win32Kernel) - Unknown owner - C:\WINDOWS\win32host.exe (file missing)
----------------------------------------------------------------------------
¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
¤Recherche et supprime ceci:
attention seulement les fichiers (si présents).
C:\WINDOWS\System32\9336407c.exe
C:\Program Files\ipwins
C:\Documents and Settings\CLEMENTINE\Application Data\9336407c.exe
C:\WINDOWS\win32host.exe
----------------------------------------------------------------------------
¤Arrête ces services :
Clique sur Démarrer->exécuter->tape: services.msc
Double-clique: Service: Win32 Kernel Update
Règle-le sur "Arrêté" et "Désactivé".
----------------------------------------------------------------------------
¤ Lancer et exécuter Ewido pour un scan complet et copier/coller le rapport en forum.
----------------------------------------------------------------------------
¤ Passe Ad-Aware et supprime tout ce qu’il trouve + supprime les quarantaines…
----------------------------------------------------------------------------
¤ Passe Spybot et corrige tout ce qu’il trouve + vaccine + supprime les quarantaines…
-------------------------------------------------------------------------------------------
¤ Lance CCleaner.
Suppression des fichiers temporaires
Va dans la section "Options" situé dans la marge gauche. Va dans "Avancé" et décoche "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Retourne ensuite dans la section "Nettoyeur"
Fais bien attention de cocher toutes les cases dans la marge gauche (Internet Explorer/Windows Explorer/Système/Avancé)
• Clique sur Analyse
• Patiente le temps du scan, qui peut prendre un peu de temps si c'est la première fois.
• Une fois le scan terminé, clique sur Lancer le Nettoyage
Suppression des incohérence du registre
• Clique sur l'icône Erreurs situés dans la marge à gauche.
• Puis clique sur Analyser les erreurs
• Patiente pendant que CCleaner scan ton registre.
• Une fois le scan terminé, coche toutes les entrèes qu'il t'aura trouvée.
• Tu peux cliquer ensuite sur Corriger les erreurs.
Si tu n'est pas sur de ce que tu fais, tu peux choisir de sauvegarder les entrées cochées pour les restaurer ultérieurement
----------------------------------------------------------------------------
¤ Vide ta Corbeille.
----------------------------------------------------------------------------
¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.
Précise tes soucis s’il en reste....
Tiens-moi au courant
A+-
Merci en tout cas.
A première vue, je n'ai plus de problème de pop-ups ou autres bizarreries néfastes.
Voici le rapport Hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 14:32:01, on 27/08/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
D:\fix\ewido anti-spyware 4.0\guard.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
D:\i-\iTunesHelper.exe
C:\WINDOWS\System32\taskmngr32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Fichiers communs\{156718F5-0321-2060-1211-001202190020}\Update.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\NCLAUNCH.EXe
D:\WINZIP\WZQKPICK.EXE
C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
C:\Program Files\iPod\bin\iPodService.exe
D:\Adaware\Hijackthis2\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr-be\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\i-\iTunesHelper.exe"
O4 - HKLM\..\Run: [Task Manager Win32] C:\WINDOWS\System32\taskmngr32.exe
O4 - HKLM\..\Run: [scmlib] rundll32.exe C:\WINDOWS\System32\scmlib.dll,start
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\WINZIP\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} - http://m6video.m6.fr/1click/install/files/installer2.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/9.20.0002/OCI/setup.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AA760512-9BD8-4B1B-9E7A-DD9BBE3CF119} (PandoraBoxCtrl Class) - http://front.boonty.com/Prometheus/PandoraX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D9CA5D65-52BE-4790-BEA3-F3E2F5A76B02} - http://62.97.81.200/dll/clickweb.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} - http://images.goa.com/v3/InstallGoaIT/ChatAx/V4,0,5,4/npaxchat.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: dLPAbXqTmuwT - {156718F6-BFCD-B25C-22E8-65CC54498F4D} - C:\WINDOWS\System32\zeid.dll
O23 - Service: AVSync Manager (AvSynMgr) - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\fix\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe -
-
Bonjour et encore merci pour tout ce que vous avez pu m'aider.
Mais pourquoi ai-je encore été victime du fameux virus "Your computer is infected"?
Voici mon rapport hijackthis :
Logfile of HijackThis v1.99.1
Scan saved at 23:39:10, on 28/08/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\Q0xFTUVOVElORQ\command.exe
C:\WINDOWS\Explorer.EXE
D:\fix\ewido anti-spyware 4.0\guard.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
D:\i-\iTunesHelper.exe
C:\WINDOWS\System32\taskmngr32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Fichiers communs\{156718F5-0321-2060-1211-001202190020}\Update.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\iPod\bin\iPodService.exe
D:\WINZIP\WZQKPICK.EXE
D:\fix\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\CLEMEN~1\LOCALS~1\Temp\15dfec89.exe
C:\PROGRA~1\MICROS~1\OFFICE\OUTLOOK.EXE
C:\WINDOWS\msagent\AgentSvr.exe
D:\Adaware\Hijackthis2\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr-be\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\i-\iTunesHelper.exe"
O4 - HKLM\..\Run: [Task Manager Win32] C:\WINDOWS\System32\taskmngr32.exe
O4 - HKLM\..\Run: [scmlib] rundll32.exe C:\WINDOWS\System32\scmlib.dll,start
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\WINZIP\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site....
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA4CB4EB-0588-4B6B-BD86-8FE82128FDAA}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: dLPAbXqTmuwT - {156718F6-BFCD-B25C-22E8-65CC54498F4D} - C:\WINDOWS\System32\zeid.dll
O23 - Service: AVSync Manager (AvSynMgr) - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\fix\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
-
-
Contributeur sécuritéSalut
d accord, remet un Hijack this et je te donne une manip
a+-
Bonsoir et encore merci pour ton aide.
Voici le rapport Hijackthis :
Logfile of HijackThis v1.99.1
Scan saved at 21:24:35, on 26/08/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
D:\fix\ewido anti-spyware 4.0\guard.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
D:\i-\iTunesHelper.exe
C:\WINDOWS\System32\9336407c.exe
C:\Program Files\ipwins\ipwins.exe
C:\WINDOWS\System32\taskmngr32.exe
C:\WINDOWS\System32\pavsvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\NCLAUNCH.EXe
D:\WINZIP\WZQKPICK.EXE
C:\Program Files\Fichiers communs\{156718F5-0321-2060-1211-001202190020}\Update.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Adaware\Hijackthis2\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R3 - Default URLSearchHook is missing
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr-be\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\i-\iTunesHelper.exe"
O4 - HKLM\..\Run: [9336407c.exe] C:\WINDOWS\System32\9336407c.exe
O4 - HKLM\..\Run: [fam2f8e2] RUNDLL32.EXE w009e8a7.dll,n 0032f8df0000000a009e8a7
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [Task Manager Win32] C:\WINDOWS\System32\taskmngr32.exe
O4 - HKLM\..\Run: [pavsvc] C:\WINDOWS\System32\pavsvc.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [9336407c.exe] C:\Documents and Settings\CLEMENTINE\Application Data\9336407c.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\WINZIP\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} - http://m6video.m6.fr/1click/install/files/installer2.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/9.20.0002/OCI/setup.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AA760512-9BD8-4B1B-9E7A-DD9BBE3CF119} (PandoraBoxCtrl Class) - http://front.boonty.com/Prometheus/PandoraX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D9CA5D65-52BE-4790-BEA3-F3E2F5A76B02} - http://62.97.81.200/dll/clickweb.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} - http://images.goa.com/v3/InstallGoaIT/ChatAx/V4,0,5,4/npaxchat.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA4CB4EB-0588-4B6B-BD86-8FE82128FDAA}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: dLPAbXqTmuwT - {156718F6-BFCD-B25C-22E8-65CC54498F4D} - C:\WINDOWS\System32\zeid.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - (no file)
O23 - Service: AVSync Manager (AvSynMgr) - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\fix\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogYjl - Unknown owner - \\?\C:\Program Files\Fichiers communs\System\lpt4.exe (file missing)
O23 - Service: McShield - Unknown owner - C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
O23 - Service: Win32 Kernel Update (Win32Kernel) - Unknown owner - C:\WINDOWS\win32host.exe (file missing)
-
-
Contributeur sécuritéSalut,
Rend toi sur ce site :
http://www.virustotal.com/xhtml/virustotal_en.html
Clik sur parcourir
Recherche ceci :
C:\Program Files\Fichiers communs\System\lpt4.exe
Clik send et colle le rapport stp
A+-
Voici le rapport venant du site virustotal
STATUS: FINISHEDComplete scanning result of "lpt4.exe", received in VirusTotal at 08.25.2006, 23:34:06 (CET).
Antivirus Version Update Result
AntiVir n - no virus found
Authentium n - no virus found
Avast n - no virus found
AVG n - no virus found
BitDefender n - no virus found
CAT-QuickHeal n - no virus found
ClamAV n - no virus found
DrWeb n - no virus found
eTrust-InoculateIT n - no virus found
eTrust-Vet n - no virus found
Ewido n - no virus found
Fortinet n - no virus found
F-Prot n - no virus found
F-Prot4 n - no virus found
Ikarus n - no virus found
Kaspersky n - no virus found
McAfee n - no virus found
Microsoft n - no virus found
NOD32v2 n - no virus found
Norman n - no virus found
Panda n - no virus found
Sophos n - no virus found
Symantec n - no virus found
TheHacker n - no virus found
UNA n - no virus found
VBA32 n - no virus found
VirusBuster n - no virus found
Aditional Information
File size: 0 bytes
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
-
-
Contributeur sécuritéSalut
Wahou y a du nettoyage a faire
relance le et choisis l option delete ( = supprimer)
Puis remet le rapport
a+-
Merci pour ton aide en tout cas.
Malgré toute mes actions, je reste encore avec des pop-up intempestifs genre "Spyware removal Wyzar" et l'autre avec "Integrety....." et autres.
Voici mon rapport de E-wido qui n'a plus grand chose à nettoyer et j'ai fait suivre mon dernier rapport Hijackthis.
ewido anti-spyware - Scan Report
---------------------------------------------------------
+ Created at: 19:02:44 23/08/2006
+ Scan result:
C:\Program Files\TheSearchAccelerator -> Adware.UCmore : No action taken.
::Report end
Rapport Hijackthis
ogfile of HijackThis v1.99.1
Scan saved at 19:06:40, on 23/08/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
D:\fix\ewido anti-spyware 4.0\guard.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
D:\i-\iTunesHelper.exe
C:\WINDOWS\System32\9336407c.exe
C:\Program Files\ipwins\ipwins.exe
C:\WINDOWS\System32\ytisvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\NCLAUNCH.EXe
D:\WINZIP\WZQKPICK.EXE
C:\Program Files\iPod\bin\iPodService.exe
D:\fix\ewido anti-spyware 4.0\ewido.exe
D:\Adaware\Hijackthis2\HijackThis.exe
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {E63B6BD3-B56D-6AEC-024D-054A5A69E748} - C:\WINDOWS\dkyav1.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr-be\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\i-\iTunesHelper.exe"
O4 - HKLM\..\Run: [uydv1.exe] C:\WINDOWS\TEMP\uydv1.exe
O4 - HKLM\..\Run: [9336407c.exe] C:\WINDOWS\System32\9336407c.exe
O4 - HKLM\..\Run: [fam2f8e2] RUNDLL32.EXE w009e8a7.dll,n 0032f8df0000000a009e8a7
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [ytisvc] C:\WINDOWS\System32\ytisvc.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [9336407c.exe] C:\Documents and Settings\CLEMENTINE\Application Data\9336407c.exe
O4 - HKCU\..\Run: [Winsvr] C:\DOCUME~1\CLEMEN~1\LOCALS~1\Temp\41.tmp5120.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\WINZIP\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://m6video.m6.fr/1click/install/files/installer2.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/9.20.0002/OCI/setup.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AA760512-9BD8-4B1B-9E7A-DD9BBE3CF119} (PandoraBoxCtrl Class) - http://front.boonty.com/Prometheus/PandoraX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D9CA5D65-52BE-4790-BEA3-F3E2F5A76B02} (WebRecomendada Class) - http://62.97.81.200/dll/clickweb.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/v3/InstallGoaIT/ChatAx/V4,0,5,4/npaxchat.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: dLPAbXqTmuwT - {156718F6-BFCD-B25C-22E8-65CC54498F4D} - C:\WINDOWS\System32\zeid.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\2236_28.dll (file missing)
O23 - Service: AVSync Manager (AvSynMgr) - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\fix\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogYjl - Unknown owner - \\?\C:\Program Files\Fichiers communs\System\lpt4.exe (file missing)
O23 - Service: McShield - Unknown owner - C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
-
-
Voici le rapport et merci encore pour ton aide :
--------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------
+ Created at: 21:58:32 21/08/2006
+ Scan result:
D:\Adaware\Hjt-aware\backups\backup-20041230-203457-811.dll -> Adware.BiSpy : No action taken.
C:\WINDOWS\Q0xFTUVOVElORQ\asappsrv.dll -> Adware.CommAd : No action taken.
C:\WINDOWS\Q0xFTUVOVElORQ\command.exe -> Adware.CommAd : No action taken.
HKLM\SOFTWARE\Effective-i -> Adware.EffectiveBrandToolbar : No action taken.
HKLM\SOFTWARE\Effective-i\TheSearchAccelerator -> Adware.EffectiveBrandToolbar : No action taken.
HKLM\SOFTWARE\Effective-i\TheSearchAccelerator\IE5 -> Adware.EffectiveBrandToolbar : No action taken.
HKU\.DEFAULT\Software\Effective-i -> Adware.EffectiveBrandToolbar : No action taken.
HKU\.DEFAULT\Software\Effective-i\TheSearchAccelerator -> Adware.EffectiveBrandToolbar : No action taken.
HKU\.DEFAULT\Software\Effective-i\TheSearchAccelerator\IE5 -> Adware.EffectiveBrandToolbar : No action taken.
HKU\S-1-5-18\Software\Effective-i -> Adware.EffectiveBrandToolbar : No action taken.
HKU\S-1-5-18\Software\Effective-i\TheSearchAccelerator -> Adware.EffectiveBrandToolbar : No action taken.
HKU\S-1-5-18\Software\Effective-i\TheSearchAccelerator\IE5 -> Adware.EffectiveBrandToolbar : No action taken.
HKU\S-1-5-21-1547161642-1957994488-854245398-1003\Software\Effective-i -> Adware.EffectiveBrandToolbar : No action taken.
HKU\S-1-5-21-1547161642-1957994488-854245398-1003\Software\Effective-i\TheSearchAccelerator -> Adware.EffectiveBrandToolbar : No action taken.
HKU\S-1-5-21-1547161642-1957994488-854245398-1003\Software\Effective-i\TheSearchAccelerator\IE5 -> Adware.EffectiveBrandToolbar : No action taken.
C:\WINDOWS\SYSTEM32\ezStubi.dll -> Adware.EZula : No action taken.
C:\WINDOWS\SYSTEM32\topsys.exe -> Adware.EZula : No action taken.
HKLM\SOFTWARE\Classes\CLSID\{3E4563A4-2A9B-4912-BE38-906A0CB702CC} -> Adware.FastFind : No action taken.
HKLM\SOFTWARE\Classes\CLSID\{EEBA788A-C268-492A-B7FE-42C2B6C553D4} -> Adware.FastFind : No action taken.
C:\Program Files\Fichiers communs\nputulrl\lnannamn\sdrobauu.exe -> Adware.Gator : No action taken.
C:\Program Files\Fichiers communs\nputulrl\nofnlnctqc\fbrmbboqt.exe -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Classes\CLSID\{5345A7A9-805A-4923-B505-86B2FEBA3FE0} -> Adware.Generic : No action taken.
C:\WINDOWS\SYSTEM32\NLNP!3.exe -> Adware.IGetNet : No action taken.
C:\WINDOWS\SYSTEM32\NLNP13.dll -> Adware.IGetNet : No action taken.
C:\WINDOWS\SYSTEM32\msnimk.gif -> Adware.Ipend : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0004071.DLL -> Adware.LinkOptimizer : No action taken.
C:\Installer3.exe -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\Iy50_32.dll -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CPIVWJIZ\Installer[1].exe -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\hr0q05d5e.dll -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\hr2805fue.dll -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\hr6m05j1e.dll -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\irn0l55m1.dll -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\k0nola531d.dll -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\kndest.dll -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\l68mlgl116q.dll -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\mjcpxl32.dLL -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\mlnsspc.dll -> Adware.Look2Me : No action taken.
C:\WINDOWS\SYSTEM32\r66ulgj916o.dll -> Adware.Look2Me : No action taken.
C:\warebundlenewer.exe -> Adware.Look2Me : No action taken.
C:\WINDOWS\Downloaded Program Files\mp3_plugin.exe -> Adware.Lop : No action taken.
C:\Documents and Settings\All Users\Application Data\Bin\bin.dll -> Adware.MediaBack : No action taken.
C:\Documents and Settings\All Users\Application Data\Tools\tools.dll -> Adware.MediaBack : No action taken.
C:\Documents and Settings\All Users\Application Data\Tools\tools.exe -> Adware.MediaBack : No action taken.
HKLM\SOFTWARE\Classes\NaviPromo.EGNaviScoring -> Adware.NaviPromo : No action taken.
HKLM\SOFTWARE\Classes\NaviPromo.EGNaviScoring.1 -> Adware.NaviPromo : No action taken.
HKLM\SOFTWARE\Classes\NaviPromo.EGNaviScoring\CLSID -> Adware.NaviPromo : No action taken.
C:\WINDOWS\NDNuninstall4_34.exe -> Adware.NewDotNet : No action taken.
D:\iMesh\iMesh\Client\imesh_336.exe -> Adware.NewDotNet : No action taken.
HKU\.DEFAULT\Software\New.net -> Adware.NewDotNet : No action taken.
HKU\S-1-5-18\Software\New.net -> Adware.NewDotNet : No action taken.
D:\Adaware\Hjt-aware\backups\backup-20050209-193920-811.dll -> Adware.Relevance : No action taken.
C:\WINDOWS\SYSTEM32\70tovmto.ini -> Adware.Sahat : No action taken.
C:\WINDOWS\SYSTEM32\ctbv2.dll -> Adware.Sahat : No action taken.
HKLM\SOFTWARE\SearchRelevancy -> Adware.SearchRelevancy : No action taken.
HKLM\SOFTWARE\SearchRelevancy\Update -> Adware.SearchRelevancy : No action taken.
HKLM\SOFTWARE\Classes\SWRT01.RT -> Adware.SecondThought : No action taken.
HKLM\SOFTWARE\Classes\SWRT01.RT\Clsid -> Adware.SecondThought : No action taken.
C:\FOUND.008\FILE0003.CHK -> Adware.Softomate : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0000008.dll -> Adware.Softomate : No action taken.
C:\Program Files\SurfSideKick 3 -> Adware.SurfSide : No action taken.
C:\Program Files\SurfSideKick 3\Ssk.exe -> Adware.SurfSide : No action taken.
C:\Program Files\SurfSideKick 3\SskBho.dll -> Adware.SurfSide : No action taken.
C:\Program Files\SurfSideKick 3\SskCore.dll -> Adware.SurfSide : No action taken.
C:\WINDOWS\SYSTEM32\repairs303169590.dll -> Adware.SurfSide : No action taken.
C:\WINDOWS\TEMP\iB.tmp -> Adware.SurfSide : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Surf SideKick -> Adware.SurfSide : No action taken.
HKLM\SOFTWARE\SurfSideKick3 -> Adware.SurfSide : No action taken.
HKLM\SOFTWARE\SurfSideKick3\Internet Explorer -> Adware.SurfSide : No action taken.
HKU\.DEFAULT\Software\SurfSideKick3 -> Adware.SurfSide : No action taken.
HKU\.DEFAULT\Software\SurfSideKick3\Internet Explorer -> Adware.SurfSide : No action taken.
HKU\S-1-5-18\Software\SurfSideKick3 -> Adware.SurfSide : No action taken.
HKU\S-1-5-18\Software\SurfSideKick3\Internet Explorer -> Adware.SurfSide : No action taken.
HKU\S-1-5-21-1547161642-1957994488-854245398-1003\Software\SurfSideKick3 -> Adware.SurfSide : No action taken.
HKU\S-1-5-21-1547161642-1957994488-854245398-1003\Software\SurfSideKick3\Internet Explorer -> Adware.SurfSide : No action taken.
C:\Program Files\Fichiers communs\zwoo\zwood\zwooc.dll -> Adware.TargetServer : No action taken.
C:\Program Files\ToolBar888 -> Adware.ToolBar888 : No action taken.
C:\Program Files\ToolBar888\Activate.exe -> Adware.ToolBar888 : No action taken.
C:\Program Files\ToolBar888\MyToolBar.dll.bak -> Adware.ToolBar888 : No action taken.
C:\Program Files\ToolBar888\Uninst.exe -> Adware.ToolBar888 : No action taken.
C:\Program Files\TheSearchAccelerator -> Adware.UCmore : No action taken.
C:\Program Files\TheSearchAccelerator\INSTALL.LOG -> Adware.UCmore : No action taken.
C:\Program Files\TheSearchAccelerator\IUCmore.dll -> Adware.UCmore : No action taken.
C:\Program Files\TheSearchAccelerator\TBlogin.users.ucmore.com.4.5.40.0 -> Adware.UCmore : No action taken.
C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll -> Adware.UCmore : No action taken.
C:\Program Files\TheSearchAccelerator\UNWISE.EXE -> Adware.UCmore : No action taken.
C:\Program Files\TheSearchAccelerator\logo.ico -> Adware.UCmore : No action taken.
C:\Program Files\TheSearchAccelerator\toolbar.cfg -> Adware.UCmore : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CPIVWJIZ\ucmoreiex[1].exe/IUCMORE.DLL -> Adware.Ucmore : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CPIVWJIZ\ucmoreiex[1].exe/UCMTSAIE.DLL -> Adware.Ucmore : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CPIVWJIZ\ucmoreiex[1].exe/empty_00000001 -> Adware.Ucmore : No action taken.
C:\ucmoreiex.exe/IUCMORE.DLL -> Adware.Ucmore : No action taken.
C:\ucmoreiex.exe/UCMTSAIE.DLL -> Adware.Ucmore : No action taken.
C:\ucmoreiex.exe/empty_00000001 -> Adware.Ucmore : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UCmore - The Search Accelerator -> Adware.UCmore : No action taken.
[796] C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll -> Adware.Ucmore : No action taken.
C:\WINDOWS\SYSTEM32\SWRT01.dll -> Adware.VirtualBouncer : No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : No action taken.
C:\Program Files\Windows AdStatus\WinStatComm.dll -> Adware.WinAD : No action taken.
C:\WINDOWS\TEMP\VPeM.exe -> Adware.WinFetcher : No action taken.
C:\WINDOWS\TEMP\gJL9.exe -> Adware.WinFetcher : No action taken.
HKLM\SOFTWARE\Classes\WinStatX.Installer -> Adware.WinTaskAd : No action taken.
HKLM\SOFTWARE\Classes\WinStatX.Installer\CLSID -> Adware.WinTaskAd : No action taken.
C:\WINDOWS\Downloaded Program Files\Asiatrique.exe -> Dialer.Generic : No action taken.
C:\WINDOWS\Downloaded Program Files\vidosphotoswebcams.exe -> Dialer.Generic : No action taken.
C:\WINDOWS\Downloaded Program Files\webcam.exe -> Dialer.Generic : No action taken.
C:\WINDOWS\NsUpdate.exe -> Dialer.Generic : No action taken.
C:\WINDOWS\SYSTEM32\EGDHTML_1030.dll -> Dialer.InstantAccess : No action taken.
C:\Documents and Settings\CLEMENTINE\dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\Documents and Settings\CLEMENTINE\woa32.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\Documents and Settings\Cool-T\dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\Documents and Settings\Cool-T\woa32.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0000001.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0000009.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0001014.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0001039.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0002039.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0002046.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0002064.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0003064.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0004065.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004117.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004135.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004151.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004177.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004192.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0005193.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0005210.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP3\A0005239.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0005288.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0005315.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0006315.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0006328.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0006361.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0006379.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\WINDOWS\SYSTEM32\dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\WINDOWS\SYSTEM32\woa32.exe/dotdr.exe -> Downloader.Adload.ch : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\85Y78H2N\drsmartload45a[1].exe -> Downloader.Adload.ee : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\85Y78H2N\drsmartload849a[1].exe -> Downloader.Adload.ee : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CPIVWJIZ\drsmartload46a[1].exe -> Downloader.Adload.ee : No action taken.
C:\drsmartload45a2002a.exe -> Downloader.Adload.ee : No action taken.
C:\drsmartload46a2002a.exe -> Downloader.Adload.ee : No action taken.
C:\drsmartload849a2002a.exe -> Downloader.Adload.ee : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0002048.exe -> Downloader.Adload.ef : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0004088.exe -> Downloader.Adload.ef : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP3\A0005230.exe -> Downloader.Adload.ef : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\85Y78H2N\drsmartload[1].exe -> Downloader.Adload.ef : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\C52F0DEZ\loader[1].exe -> Downloader.Adload.ef : No action taken.
C:\WINDOWS\SYSTEM32\netpals.dll -> Downloader.BHO.d : No action taken.
C:\Documents and Settings\CLEMENTINE\dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\Documents and Settings\CLEMENTINE\woa32.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\Documents and Settings\Cool-T\Local Settings\Temp\tmp0003d9de -> Downloader.ConHook.ad : No action taken.
C:\Documents and Settings\Cool-T\dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\Documents and Settings\Cool-T\woa32.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0000001.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0001014.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0001039.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0002039.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0002045.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0002064.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0003064.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0004065.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004117.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004135.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004151.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004177.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004192.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0005193.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0005210.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP3\A0005239.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0005288.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0005315.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0006315.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0006328.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0006361.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0006379.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\WINDOWS\SYSTEM32\ddcya.dll -> Downloader.ConHook.ad : No action taken.
C:\WINDOWS\SYSTEM32\ljhec.dll -> Downloader.ConHook.ad : No action taken.
C:\WINDOWS\SYSTEM32\mlllk.dll -> Downloader.ConHook.ad : No action taken.
C:\WINDOWS\SYSTEM32\woa32.exe/dotrm.dll -> Downloader.ConHook.ad : No action taken.
C:\WINDOWS\SYSTEM32\wvwwv.dll -> Downloader.ConHook.ad : No action taken.
C:\WINDOWS\SYSTEM32\yabbx.dll.bak -> Downloader.ConHook.ad : No action taken.
C:\WINDOWS\TEMP\tmp0009a34c -> Downloader.ConHook.ad : No action taken.
C:\WINDOWS\SYSTEM32\actskn45.ocx -> Downloader.IstBar : No action taken.
C:\file10.zip/crack.exe -> Downloader.IstBar.is : No action taken.
C:\ied_s7.cab/ied_s7_c_7.exe -> Downloader.Mediket.j : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\85Y78H2N\ac3_0010[1].exe -> Downloader.Small : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CTIJOTE3\al3[1].txt -> Downloader.Small : No action taken.
C:\WINDOWS\SYSTEM32\w009e8a7.dll -> Downloader.Small : No action taken.
C:\ac3_0010.exe -> Downloader.Small : No action taken.
[1896] C:\WINDOWS\System32\w009e8a7.dll -> Downloader.Small : No action taken.
C:\MTE3NDI6ODoxNgnew.exe -> Downloader.Small.buy : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004105.exe -> Downloader.Small.buy : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\85Y78H2N\MTE3NDI6ODoxNg[1].exe -> Downloader.Small.buy : No action taken.
C:\WINDOWS\SYSTEM32\testtestt.exe -> Downloader.Small.cyb : No action taken.
C:\WINDOWS\istinstall_si.exe -> Downloader.Small.gl : No action taken.
C:\WINDOWS\Downloaded Program Files\Searchmp3s.exe -> Downloader.Swizzor.i : No action taken.
C:\WINDOWS\Downloaded Program Files\full_albums.exe -> Downloader.Swizzor.i : No action taken.
C:\WINDOWS\SYSTEM32\slx.exe] -> Downloader.Tibs.hh : No action taken.
C:\Program Files\Fichiers communs\zwoo\zwoop.exe -> Downloader.TSUpdate.f : No action taken.
C:\Program Files\Fichiers communs\zwoo\zwooa.exe -> Downloader.TSUpdate.l : No action taken.
C:\Program Files\Fichiers communs\zwoo\zwoom.exe -> Downloader.TSUpdate.n : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CPIVWJIZ\stub_113_4_0_4_0[1].exe -> Downloader.TSUpdate.o : No action taken.
C:\stub_113_4_0_4_0newer.exe -> Downloader.TSUpdate.o : No action taken.
C:\Program Files\Fichiers communs\zwoo\zwool.exe -> Downloader.TSUpdate.r : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CTIJOTE3\nwnmff_11[1].exe -> Downloader.VB.aiy : No action taken.
C:\nwnmff_11.exe -> Downloader.VB.aiy : No action taken.
D:\Adaware\Hjt-aware\backups\backup-20040908-222535-844.dll -> Downloader.Wintrim.by : No action taken.
C:\WINDOWS\SYSTEM32\Mservice.dll -> Downloader.Wintrim.cj : No action taken.
C:\SS1001newer.exe -> Dropper.Small.qn : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\85Y78H2N\SS1001[1].exe -> Dropper.Small.qn : No action taken.
C:\Documents and Settings\All Users\Application Data\Tools\2002.exe -> Hijacker.Small : No action taken.
HKLM\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE083} -> Logger.Agent.io : No action taken.
C:\WINDOWS\SYSTEM\ctldlg32.dll -> Logger.Agent.mn : No action taken.
C:\WINDOWS\SYSTEM32\mseggo.gif -> Logger.Delf.dx : No action taken.
C:\dload.exe -> Not-A-Virus.Downloader.Win32.Comb : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004103.EXE -> Not-A-Virus.Monitor.Win32.NetMon.a : No action taken.
C:\WINDOWS\SYSTEM32\zeid.dll -> Proxy.Agent.df : No action taken.
[1152] C:\WINDOWS\System32\zeid.dll -> Proxy.Agent.df : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0001012.dll -> Proxy.Agent.ji : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0001037.DLL -> Proxy.Agent.ji : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0002036.dll -> Proxy.Agent.ji : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0002061.DLL -> Proxy.Agent.ji : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0003060.dll -> Proxy.Agent.ji : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0004062.dll -> Proxy.Agent.ji : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0004080.dll -> Proxy.Agent.ji : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0004098.DLL -> Proxy.Agent.ji : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004104.exe -> Proxy.Agent.ji : No action taken.
C:\WINDOWS\TEMP\art1D14.tmp -> Proxy.Agent.ji : No action taken.
C:\WINDOWS\comdlj32.dll -> Proxy.Agent.ji : No action taken.
C:\WINDOWS\SYSTEM32\stonedrv.exe -> Proxy.Small.bo : No action taken.
C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll -> Proxy.Xorpix.v : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@247realmedia[1].txt -> TrackingCookie.247realmedia : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@247realmedia[2].txt -> TrackingCookie.247realmedia : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@nbcuniversal.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@adbrite[1].txt -> TrackingCookie.Adbrite : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@z1.adserver[1].txt -> TrackingCookie.Adserver : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@adtech[2].txt -> TrackingCookie.Adtech : No action taken.
C:\Documents and Settings\fwistay boys\Cookies\fwistay boys@www.adtrak[1].txt -> TrackingCookie.Adtrak : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@advertising[1].txt -> TrackingCookie.Advertising : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@bluestreak[1].txt -> TrackingCookie.Bluestreak : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@bluestreak[1].txt -> TrackingCookie.Bluestreak : No action taken.
C:\Documents and Settings\fwistay boys\Cookies\fwistay boys@ads18.bpath[2].txt -> TrackingCookie.Bpath : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@burstnet[1].txt -> TrackingCookie.Burstnet : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@www.burstnet[2].txt -> TrackingCookie.Burstnet : No action taken.
C:\Documents and Settings\fwistay boys\Cookies\fwistay boys@burstnet[2].txt -> TrackingCookie.Burstnet : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@casalemedia[1].txt -> TrackingCookie.Casalemedia : No action taken.
C:\Documents and Settings\fwistay boys\Cookies\fwistay boys@as.casalemedia[1].txt -> TrackingCookie.Casalemedia : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@com[2].txt -> TrackingCookie.Com : No action taken.
C:\Documents and Settings\fwistay boys\Cookies\fwistay boys@com[2].txt -> TrackingCookie.Com : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@c.enhance[1].txt -> TrackingCookie.Enhance : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@estat[1].txt -> TrackingCookie.Estat : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@as-eu.falkag[1].txt -> TrackingCookie.Falkag : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@findwhat[1].txt -> TrackingCookie.Findwhat : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@findwhat[1].txt -> TrackingCookie.Findwhat : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@kmpads[2].txt -> TrackingCookie.Kmpads : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@kmpads[2].txt -> TrackingCookie.Kmpads : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@overture[2].txt -> TrackingCookie.Overture : No action taken.
C:\Documents and Settings\fwistay boys\Cookies\fwistay boys@www.realcastmedia[2].txt -> TrackingCookie.Realcastmedia : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@revenue[2].txt -> TrackingCookie.Revenue : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@ads01.revenue[1].txt -> TrackingCookie.Revenue : No action taken.
C:\Documents and Settings\fwistay boys\Cookies\fwistay boys@ads1.revenue[1].txt -> TrackingCookie.Revenue : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : No action taken.
C:\Documents and Settings\fwistay boys\Cookies\fwistay boys@starware[2].txt -> TrackingCookie.Starware : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@tacoda[2].txt -> TrackingCookie.Tacoda : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\system@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@webstat[1].txt -> TrackingCookie.Web-stat : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@weborama[2].txt -> TrackingCookie.Weborama : No action taken.
C:\Documents and Settings\CLEMENTINE\Cookies\clementine@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken.
C:\Documents and Settings\Cool-T\Cookies\cool-t@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : No action taken.
C:\Documents and Settings\fwistay boys\Cookies\fwistay boys@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken.
C:\Documents and Settings\fwistay boys\Cookies\fwistay boys@ad.yieldmanager[3].txt -> TrackingCookie.Yieldmanager : No action taken.
C:\Documents and Settings\fwistay boys\Cookies\fwistay boys@ad.yieldmanager[4].txt -> TrackingCookie.Yieldmanager : No action taken.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\system@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : No action taken.
C:\eied_s7.cab/eied_s7_c_7.exe -> Trojan.Agent.nv : No action taken.
C:\Documents and Settings\All Users\Documents\Settings\2006.dll -> Trojan.Agent.oh : No action taken.
C:\WINDOWS\SYSTEM32\2236_28.dll -> Trojan.Agent.pk : No action taken.
C:\WINDOWS\Downloaded Program Files\Q330995.exe -> Trojan.Dialer.hh : No action taken.
C:\WINDOWS\SYSTEM32\maxd641.exe -> Trojan.Dialer.pw : No action taken.
C:\WINDOWS\SYSTEM32\bikini.exe -> Trojan.LowZones.dt : No action taken.
C:\ane.exe -> Trojan.LowZones.dt : No action taken.
D:\Adaware\Hjt-aware\backups\backup-20040803-222327-858.dll -> Trojan.P2E.m : No action taken.
C:\Program Files\Fichiers communs\{156718F5-0321-2060-1211-001202190020}\Update.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0000004.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0001017.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0001041.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0002041.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0002066.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0003066.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0004066.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP1\A0004084.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004118.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004138.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004153.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0004194.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0005194.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP2\A0005212.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP3\A0005242.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0005291.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0005316.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0006330.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0006363.exe -> Trojan.Starter.65 : No action taken.
C:\System Volume Information\_restore{E5B767B3-F5B5-41D8-8DCB-70027EF34B04}\RP4\A0006380.exe -> Trojan.Starter.65 : No action taken.
[2772] C:\Program Files\Fichiers communs\{156718F5-0321-2060-1211-001202190020}\Update.exe -> Trojan.Starter.65 : No action taken.
C:\Documents and Settings.000\All Users.WINDOWS\Menu Démarrer\Programmes\Adobe\ActiveShare\KAV 5.0 -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings.000\All Users.WINDOWS\Menu Démarrer\Programmes\Adobe\ActiveShare\Kaspersky Antivirus 5.0 -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\ACDSee 9.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\Adobe Photoshop 9 full.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\Ahead Nero 7.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\KAV 5.0 -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\Kaspersky Antivirus 5.0 -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\Matrix 3 Revolution English Subtitles.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\Microsoft Office 2003 Crack, Working!.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\Microsoft Office XP working Crack, Keygen.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\Microsoft Windows XP, WinXP Crack, working Keygen.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\Opera 8 New!.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\Serials.txt.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\WinAmp 5 Pro Keygen Crack Update.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\WinAmp 6 New!.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\Windown Longhorn Beta Leak.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\Windows Sourcecode update.doc.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Diablo II Shareware\XXX hardcore images.exe -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\CLEMENTINE\Application Data\Symantec\Shared\KAV 5.0 -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\CLEMENTINE\Application Data\Symantec\Shared\Kaspersky Antivirus 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\Common files\Microsoft Shared\KAV 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\Common files\Microsoft Shared\Kaspersky Antivirus 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\Fichiers communs\MGI Shared\KAV 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\Fichiers communs\MGI Shared\Kaspersky Antivirus 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\Fichiers communs\Microsoft Shared\KAV 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\Fichiers communs\Microsoft Shared\Kaspersky Antivirus 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\Fichiers communs\Symantec Shared\KAV 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\Fichiers communs\Symantec Shared\Kaspersky Antivirus 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\Fichiers communs\xing shared\KAV 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\Fichiers communs\xing shared\Kaspersky Antivirus 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\McAfee\McAfee Shared Components\KAV 5.0 -> Worm.Bagle.aa : No action taken.
C:\Program Files\McAfee\McAfee Shared Components\Kaspersky Antivirus 5.0 -> Worm.Bagle.aa : No action taken.
C:\WINDOWS\ime\shared\KAV 5.0 -> Worm.Bagle.aa : No action taken.
C:\WINDOWS\ime\shared\Kaspersky Antivirus 5.0 -> Worm.Bagle.aa : No action taken.
C:\Documents and Settings\Cool-T\Local Settings\Temp\dmx3.tmp -> Worm.Locksky.ao : No action taken.
::Report end -
Contributeur sécuritéRe
installe et scan ton pc avec ewido
http://perso.orange.fr/entraide-hijackthis/Ewido/
Copie colle le rapport
a+ -
Voici le rapport Hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 17:22:45, on 21/08/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
D:\i-\iTunesHelper.exe
C:\WINDOWS\System32\bikini.exe
C:\WINDOWS\System32\9336407c.exe
C:\windows\system32\stonedrv.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\ipwins\ipwins.exe
C:\Program Files\Fichiers communs\{156718F5-0321-2060-1211-001202190020}\Update.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\NCLAUNCH.EXe
D:\WINZIP\WZQKPICK.EXE
C:\Program Files\iPod\bin\iPodService.exe
D:\Adaware\Hijackthis2\HijackThis.exe
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
O2 - BHO: Class - {E63B6BD3-B56D-6AEC-024D-054A5A69E748} - C:\WINDOWS\dkyav1.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr-be\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\i-\iTunesHelper.exe"
O4 - HKLM\..\Run: [bikini] bikini.exe
O4 - HKLM\..\Run: [uydv1.exe] C:\WINDOWS\TEMP\uydv1.exe
O4 - HKLM\..\Run: [9336407c.exe] C:\WINDOWS\System32\9336407c.exe
O4 - HKLM\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\Run: [wrmdrv] rundll32.exe C:\WINDOWS\System32\wrmdrv.dll,start
O4 - HKLM\..\Run: [fam2f8e2] RUNDLL32.EXE w009e8a7.dll,n 0032f8df0000000a009e8a7
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [9336407c.exe] C:\Documents and Settings\CLEMENTINE\Application Data\9336407c.exe
O4 - HKCU\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [Winsvr] C:\DOCUME~1\CLEMEN~1\LOCALS~1\Temp\41.tmp5120.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\WINZIP\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://m6video.m6.fr/1click/install/files/installer2.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/9.20.0002/OCI/setup.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AA760512-9BD8-4B1B-9E7A-DD9BBE3CF119} (PandoraBoxCtrl Class) - http://front.boonty.com/Prometheus/PandoraX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {D9CA5D65-52BE-4790-BEA3-F3E2F5A76B02} (WebRecomendada Class) - http://62.97.81.200/dll/clickweb.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/v3/InstallGoaIT/ChatAx/V4,0,5,4/npaxchat.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: SMDEn - C:\WINDOWS\system32\guard.tmp (file missing)
O21 - SSODL: dLPAbXqTmuwT - {156718F6-BFCD-B25C-22E8-65CC54498F4D} - C:\WINDOWS\System32\zeid.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\2236_28.dll
O23 - Service: AVSync Manager (AvSynMgr) - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogYjl - Unknown owner - \\?\C:\Program Files\Fichiers communs\System\lpt4.exe (file missing)
O23 - Service: McShield - Unknown owner - C:\Program Files\Fichiers communs\Network Associates\McShield\Mcshield.exe -
Contributeur sécuritésalut
remet un hijack this
a+ -
Contributeur sécuritére
atend 3/4 minutes le rapport devrait s afficher
a+-
Ooups, je n'avais pas bien saisi le message :
Voici le rapport :
STATUS: FINISHEDComplete scanning result of "2236_28.dll", received in VirusTotal at 08.20.2006, 23:53:52 (CET).
Antivirus Version Update Result
AntiVir 6.35.1.3 08.20.2006 TR/Agent.PK.13
Authentium 4.93.8 08.19.2006 W32/Agent.BKM
Avast 4.7.844.0 08.18.2006 no virus found
AVG 386 08.18.2006 Generic.YNV
BitDefender 7.2 08.20.2006 Trojan.Antiav.3.9
CAT-QuickHeal 8.00 0 8.18.2006 Trojan.Agent.pk
ClamAV devel-20060426 08.20.2006 no virus found
DrWeb 4.33 08.20.2006 BackDoor.Dsrv
eTrust-InoculateIT 23.72.102 08.20.2006 no virus found
eTrust-Vet 30.3.3026 08.18.2006 no virus found
Ewido 4.0 08.20.2006 Trojan.Agent.pk
Fortinet 2.77.0.0 08.20.2006 Spam_DComServ!tr
F-Prot 3.16f 08.18.2006 security risk named W32/Agent.BKM
F-Prot4 4.2.1.29 08.19.2006 W32/Agent.BKM
Ikarus 0.2.65.0 08.18.2006 no virus found
Kaspersky 4.0.2.24 08.20.2006 Trojan.Win32.Agent.pk
McAfee 4832 08.18.2006 Spam-DComServ
Microsoft 1.1560 08.17.2006 no virus found
NOD32v2 1.1716 08.20.2006 Win32/Agent.PK
Norman 5.90.23 08.18.2006 W32/Agent.AHFA
Panda 9.0.0.4 08.20.2006 Adware/SpySheriff
Sophos 4.08.0 08.20.2006 no virus found
Symantec 8.0 08.20.2006 no virus found
TheHacker 5.9.8.195 08.18.2006 no virus found
UNA 1.83 08.18.2006 Backdoor.Agent.DE2C
VBA32 3.11.0 08.20.2006 Trojan.Win32.Agent.pk
VirusBuster 4.3.7:9 08.20.2006 no virus found
-
-
Contributeur sécuritéSalut
Tu peux scanner les 4 fichiers?
Et aussi, tu peux faire ceci:
Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
Relance le programme Smitfraud,
Cette fois choisit l’option 2, répond oui a tous ;
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum
A+-
Bonjour,
Voila le rapport émanant du site smitfraudfix:
SmitFraudFix v2.81
Rapport fait à 20:54:30,62, dim. 20/08/2006
Executé à partir de D:\fix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Fix executé en mode sans echec
»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304BB2236}"="DCOM Server 2236"
[HKEY_CLASSES_ROOT\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304BB2236}\InProcServer32]
@="C:\WINDOWS\System32\2236_28.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304BB2236}\InProcServer32]
@="C:\WINDOWS\System32\2236_28.dll"
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
C:\drsmartload?.exe supprimé
C:\Documents and Settings\CLEMENTINE\Application Data\Install.dat supprimé
C:\DOCUME~1\CLEMEN~1\BUREAU\access supprimé
C:\DOCUME~1\CLEMEN~1\BUREAU\domains supprimé
C:\DOCUME~1\CLEMEN~1\BUREAU\map.txt supprimé
»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.
»»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304BB2236}"="DCOM Server 2236"
[HKEY_CLASSES_ROOT\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304BB2236}\InProcServer32]
@="C:\WINDOWS\System32\2236_28.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304BB2236}\InProcServer32]
@="C:\WINDOWS\System32\2236_28.dll"
»»»»»»»»»»»»»»»»»»»»»»»» Fin
Ici, j'ai analysé les 4 fichiers demandés via virus total. Mais je n'ai cependant pas trouvé le dkyav1 et le guard.tmp. Par contre le Zeid.ll ne m'a donné aucun rapport mais par contre le 2236_28 est le rapport se trouvant ci-dessous.
STATUS: QUEUED
Your file "2236_28.dll" is queued in position: 32. Estimated start time is between 3 and 4 minutes.
Antivirus Version Update Result
D'avance merci beaucoup pour votre aide.
-
-
Contributeur sécuritéSalut
Tu es super infecté.
C'est possible que tu m analyses ceci?
C:\WINDOWS\dkyav1.dll
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\System32\zeid.dll
C:\WINDOWS\System32\2236_28.dll
Rend toi sur ce site :
http://www.virustotal.com/xhtml/virustotal_en.html
Clik sur parcourir
Recherche les un a un
Clik send et colle les rapports stp
Puis,
Télécharge ceci: (merci a S!RI pour ce programme).
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.
A+-
Voici le deuxieme rapport demandé :
SmitFraudFix v2.81
Rapport fait à 10:13:01,28, dim. 20/08/2006
Executé à partir de D:\fix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» C:\
C:\drsmartload?.exe PRESENT !
C:\drsmartload??.exe PRESENT !
C:\drsmartload???.exe PRESENT !
C:\drsmartload????.exe PRESENT !
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\CLEMENTINE\Application Data
C:\Documents and Settings\CLEMENTINE\Application Data\Install.dat PRESENT !
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CLEMEN~1\FAVORIS
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
C:\DOCUME~1\CLEMEN~1\BUREAU\access PRESENT !
C:\DOCUME~1\CLEMEN~1\BUREAU\domains PRESENT !
C:\DOCUME~1\CLEMEN~1\BUREAU\map.txt PRESENT !
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304BB2236}"="DCOM Server 2236"
[HKEY_CLASSES_ROOT\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304BB2236}\InProcServer32]
@="C:\WINDOWS\System32\2236_28.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304BB2236}\InProcServer32]
@="C:\WINDOWS\System32\2236_28.dll"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
-
