Multiple infection
bonjour a tous ! j'ai fait un scan avec spyware nuker XT et j'ai été etonnée de voir tout ce qu'il ma trouvé , pouvez vous m'aidez a m'en débarrassez !!
merci infiniment
Spyware Nuker XT Detection Report
Scan Started:
12/31/2006 11:23
Software Version:
4.8.77.1815
Database Version:
12/11/2006 09:41:36 AM
Operating System:
Windows XP 5.1.2600 [Service Pack 1]
Web Browser(s):
IE:6.0.2800.1106;FF:1.5.0.9 (fr);
24/7 RealMedia
960-55877
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .247realmedia.com/ | 548595 | 20
Cookie
Mozilla Firefox | .247realmedia.com/ | itcanban | 1
Cookie
Mozilla Firefox | .247realmedia.com/ | RMFD | 011H0lmaO1...
Cookie
Mozilla Firefox | .247realmedia.com/ | RMID | 56cac73145...
Cookie
Mozilla Firefox | .247realmedia.com/ | wub1206 | 4
Cookie
Mozilla Firefox | .247realmedia.com/ | wumb1206 | 4
2o7
669-33236
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .msnportal.112.2o7.net/ | s_vi | [CS]v1|459...
Cookie
Mozilla Firefox | .sfr.122.2o7.net/ | s_vi | [CS]v1|459...
Advertising.com
679-1710
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .advertising.com/ | ACID | cc50001167...
Cookie
Mozilla Firefox | .advertising.com/ | BASE | 66gkFfd9ym...
Cookie
Mozilla Firefox | .advertising.com/ | F1 | B88zWWEBAA...
Cookie
Mozilla Firefox | .advertising.com/ | ROLL | Z+vdvb/ua7...
Adware.MediaTickets
646-22651
Silently connects to its controlling servers where it downloads files. May display pop-up advertisements.
Registry Key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.1/MediaTicketsInstaller.ocx
Registry Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.1/MediaTicketsInstaller.ocx:.Owner
Registry Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.1/MediaTicketsInstaller.ocx:{9EB320CE-BE1D-4304-A081-4B4665414BEF}
File
C:\WINDOWS\System32\oi-uninstaller.ico
Bluestreak
819-49880
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .bluestreak.com/ | id | 4373208768...
CashEngines
968-55887
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | click.cashengines.com/ | Click | 7e69bf63-f...
CoolWebSearch
539-53077
Hijacks browser settings and redirects traffic to a search portal site.
File
C:\tmp.txt
DoubleClick
446-2378
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .doubleclick.net/ | id | 800000b3f9...
EyeBlaster
979-55898
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .serving-sys.com/ | A1 | 1gNk2bPO03...
Cookie
Mozilla Firefox | .serving-sys.com/ | B1 | 0FWV08885Q
Cookie
Mozilla Firefox | .serving-sys.com/ | C1 | 07Rh8885Q%...
Cookie
Mozilla Firefox | .serving-sys.com/ | D1 | 07Rh018y88...
Cookie
Mozilla Firefox | .serving-sys.com/ | E1 | 03c08885Q
Fast Click
438-2102
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .fastclick.net/ | m1 | d101289:1:...
Cookie
Mozilla Firefox | .fastclick.net/ | m3 | d101291:1:...
Cookie
Mozilla Firefox | .fastclick.net/ | m6 | 66745:1:13...
Cookie
Mozilla Firefox | .fastclick.net/ | pluto | 22020772-e...
HitBox
447-2382
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .hitbox.com/ | CTG | 1167511160
Cookie
Mozilla Firefox | .ehg-logantod.hitbox.com/ | DM56031688NVV6 | V1eB(#X"rz...
Cookie
Mozilla Firefox | .hitbox.com/ | WSS_GW | V1z%%e@Q%%...
Keylogger.Msconfg
1168-62254
Logs all keystrokes and sends them to its server. Silently attempts to infect other computers on the network.
Registry Value
HKEY_CURRENT_USER\Software\Microsoft\OLE:Microsoft Update 32
Registry Value
HKEY_USERS\.DEFAULT\Software\Microsoft\OLE:Microsoft Update 32
Registry Value
HKEY_USERS\S-1-5-18\Software\Microsoft\OLE:Microsoft Update 32
Malware.win32ssr
1210-62631
Lowers system security settings. Makes connections to the internet and downloads other bad files. Attempts to infect other computers on a local network by scanning local IP addresses.
File
C:\WINDOWS\System32\SVKP.sys
MediaPlex
448-2383
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .mediaplex.com/ | svid | 5259884295
SpyAnytime
1107
Spy software which silently logs keystrokes and monitors computer activity.
File
C:\Program Files\Fichiers communs\Logitech\QCDriver\ijl11.dll
TradeDoubler
1009-56791
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .tradedoubler.com/ | TD_PIC | 988046*5Z1...
Cookie
Mozilla Firefox | .tradedoubler.com/ | TD_UNIQUE_IMP | 463a368121...
Trojan.Lsass
1156-61522
Silently connects to a remote location where it downloads other files. Opens certain ports and attempts to disable certain security features on an infected computer. May cause your system to shutdown.
Registry Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks:{00DBDAC8-4691-4797-8E6A-7C6AB89BC441}
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:Description
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:DisplayName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:ErrorControl
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:FailureActions
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:ObjectName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:Start
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:Type
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass\Security
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass\Security:Security
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:Description
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:DisplayName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:ErrorControl
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:FailureActions
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:ObjectName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:Start
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:Type
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Enum
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Enum:0
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Enum:Count
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Enum:NextInstance
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Security
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Security:Security
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv:DisplayName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv:ErrorControl
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv:Start
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv:Type
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv\Security
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv\Security:Security
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv:DisplayName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv:ErrorControl
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv:Start
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv:Type
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv\Security
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv\Security:Security
Trojan.msmsgs
1123-60562
Silently connects to it's controlling server where it transmits information, recieves instructions, and downloads other files. Hijacks IE's homepage as well as Windows desktop and changes IE's Security and ZoneMap settings.
Registry Value
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range10::Range:85.255.117.243
aQuantive
978-2354
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .atdmt.com/ | AA002 | 1167420813...
merci infiniment
Spyware Nuker XT Detection Report
Scan Started:
12/31/2006 11:23
Software Version:
4.8.77.1815
Database Version:
12/11/2006 09:41:36 AM
Operating System:
Windows XP 5.1.2600 [Service Pack 1]
Web Browser(s):
IE:6.0.2800.1106;FF:1.5.0.9 (fr);
24/7 RealMedia
960-55877
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .247realmedia.com/ | 548595 | 20
Cookie
Mozilla Firefox | .247realmedia.com/ | itcanban | 1
Cookie
Mozilla Firefox | .247realmedia.com/ | RMFD | 011H0lmaO1...
Cookie
Mozilla Firefox | .247realmedia.com/ | RMID | 56cac73145...
Cookie
Mozilla Firefox | .247realmedia.com/ | wub1206 | 4
Cookie
Mozilla Firefox | .247realmedia.com/ | wumb1206 | 4
2o7
669-33236
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .msnportal.112.2o7.net/ | s_vi | [CS]v1|459...
Cookie
Mozilla Firefox | .sfr.122.2o7.net/ | s_vi | [CS]v1|459...
Advertising.com
679-1710
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .advertising.com/ | ACID | cc50001167...
Cookie
Mozilla Firefox | .advertising.com/ | BASE | 66gkFfd9ym...
Cookie
Mozilla Firefox | .advertising.com/ | F1 | B88zWWEBAA...
Cookie
Mozilla Firefox | .advertising.com/ | ROLL | Z+vdvb/ua7...
Adware.MediaTickets
646-22651
Silently connects to its controlling servers where it downloads files. May display pop-up advertisements.
Registry Key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.1/MediaTicketsInstaller.ocx
Registry Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.1/MediaTicketsInstaller.ocx:.Owner
Registry Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/CONFLICT.1/MediaTicketsInstaller.ocx:{9EB320CE-BE1D-4304-A081-4B4665414BEF}
File
C:\WINDOWS\System32\oi-uninstaller.ico
Bluestreak
819-49880
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .bluestreak.com/ | id | 4373208768...
CashEngines
968-55887
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | click.cashengines.com/ | Click | 7e69bf63-f...
CoolWebSearch
539-53077
Hijacks browser settings and redirects traffic to a search portal site.
File
C:\tmp.txt
DoubleClick
446-2378
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .doubleclick.net/ | id | 800000b3f9...
EyeBlaster
979-55898
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .serving-sys.com/ | A1 | 1gNk2bPO03...
Cookie
Mozilla Firefox | .serving-sys.com/ | B1 | 0FWV08885Q
Cookie
Mozilla Firefox | .serving-sys.com/ | C1 | 07Rh8885Q%...
Cookie
Mozilla Firefox | .serving-sys.com/ | D1 | 07Rh018y88...
Cookie
Mozilla Firefox | .serving-sys.com/ | E1 | 03c08885Q
Fast Click
438-2102
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .fastclick.net/ | m1 | d101289:1:...
Cookie
Mozilla Firefox | .fastclick.net/ | m3 | d101291:1:...
Cookie
Mozilla Firefox | .fastclick.net/ | m6 | 66745:1:13...
Cookie
Mozilla Firefox | .fastclick.net/ | pluto | 22020772-e...
HitBox
447-2382
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .hitbox.com/ | CTG | 1167511160
Cookie
Mozilla Firefox | .ehg-logantod.hitbox.com/ | DM56031688NVV6 | V1eB(#X"rz...
Cookie
Mozilla Firefox | .hitbox.com/ | WSS_GW | V1z%%e@Q%%...
Keylogger.Msconfg
1168-62254
Logs all keystrokes and sends them to its server. Silently attempts to infect other computers on the network.
Registry Value
HKEY_CURRENT_USER\Software\Microsoft\OLE:Microsoft Update 32
Registry Value
HKEY_USERS\.DEFAULT\Software\Microsoft\OLE:Microsoft Update 32
Registry Value
HKEY_USERS\S-1-5-18\Software\Microsoft\OLE:Microsoft Update 32
Malware.win32ssr
1210-62631
Lowers system security settings. Makes connections to the internet and downloads other bad files. Attempts to infect other computers on a local network by scanning local IP addresses.
File
C:\WINDOWS\System32\SVKP.sys
MediaPlex
448-2383
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .mediaplex.com/ | svid | 5259884295
SpyAnytime
1107
Spy software which silently logs keystrokes and monitors computer activity.
File
C:\Program Files\Fichiers communs\Logitech\QCDriver\ijl11.dll
TradeDoubler
1009-56791
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .tradedoubler.com/ | TD_PIC | 988046*5Z1...
Cookie
Mozilla Firefox | .tradedoubler.com/ | TD_UNIQUE_IMP | 463a368121...
Trojan.Lsass
1156-61522
Silently connects to a remote location where it downloads other files. Opens certain ports and attempts to disable certain security features on an infected computer. May cause your system to shutdown.
Registry Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks:{00DBDAC8-4691-4797-8E6A-7C6AB89BC441}
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:Description
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:DisplayName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:ErrorControl
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:FailureActions
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:ObjectName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:Start
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass:Type
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass\Security
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lsass\Security:Security
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:Description
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:DisplayName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:ErrorControl
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:FailureActions
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:ObjectName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:Start
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass:Type
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Enum
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Enum:0
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Enum:Count
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Enum:NextInstance
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Security
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lsass\Security:Security
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv:DisplayName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv:ErrorControl
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv:Start
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv:Type
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv\Security
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdriv\Security:Security
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv:DisplayName
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv:ErrorControl
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv:Start
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv:Type
Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv\Security
Registry Value
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdriv\Security:Security
Trojan.msmsgs
1123-60562
Silently connects to it's controlling server where it transmits information, recieves instructions, and downloads other files. Hijacks IE's homepage as well as Windows desktop and changes IE's Security and ZoneMap settings.
Registry Value
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range10::Range:85.255.117.243
aQuantive
978-2354
A cookie that is shared among websites to track your web surfing habits.
Cookie
Mozilla Firefox | .atdmt.com/ | AA002 | 1167420813...
Configuration: Windows XP Firefox 1.5.0.9
49 réponses
Résumé de la discussion
Détection massive de menaces après un balayage avec Spyware Nuker XT, révélant cookies douteux, modules malveillants et extensions qui pourraient compromettre le navigateur et le système. Plusieurs éléments de réponse préconisent d’abord une sauvegarde de la base de registre puis la désinstallation d’outils indésirables, et de désactiver les démarrages suspects avant un nouveau nettoyage. Des outils complémentaires comme HijackThis et SpyCatcher sont cités, ainsi que l’analyse de journaux et de services Windows pour identifier les programmes qui s’exécutent en arrière-plan. En cas d’échec partiel, des éléments évoquent aussi la nécessité de vérifier les mises à jour Windows et les dépendances logicielles, afin d’éviter des retours du logiciel malveillant.
-
ok reçu 5 sur 5 !!
Philo2100 est mon pseudo...^^LOL^^
http://www.webphilo.com/accueil/index.php?gclid=CJnP3PGLyYkCFQ8RXgod4UZ_RQ
Bonne journée à toi.
----------------------------------
Si vous ne pouvez être des saints de la connaissance, soyez en au moins
les guerriers ."
Friedrich Nietzsche
-
wech philo2100 !
ok reçu 5 sur 5 !!
PS : est-ce que ton pseudo a-t-il un lien avec le fait que tu t'y connaisse en philo car je suis en terminale et j'ai besoin d'aide en philo ???
merci infiniment -
toi en plus t'en as un avec f-secure mais par contre moi je devrais pas en avoir un ???
---------------------------------------------------------------------------------
(on peut, bien sûr)
s'il ne fait pas partie intègre de ton fire wall/anti-virus ça risque de ralentir ton PC.
Il est évident qu'en temps normal (hors désinfection, tu fais comme il te semble bon )
La seule chose....JAMAIS deux anti-virus, ni deux anti-malwares résidents ( à ne pas confondre avec installer dans ton PC )
Note:
Seulement faut attention AVG par exemple colle trés vite la protection/temps réel à l'install ! (les autres aussi)
Mais dans le cas d'une désinfection en cours je ne préconise pas l'ajout/ni l'utilisation d'un anti-malware.
----------------------------------------------------------------
Perso je suggère EWIDO, actuellement AVG (français) mais ne pas installer la protection résidente.
On peut la remettre en cas de PC "clean" et si celui-ci est assez performant. -
toi en plus t'en as un avec f-secure mais par contre moi je devrais pas en avoir un ???
-
slt philo2100,
au contraire j'ai bcp d'avis com koi il faut en avoir un, tu me conseillerais quoi ? -
On ne met pas d'anti-spy en tache de fond en général !
(on peut, bien sûr)
Perso j'ai F-secure Internet security qui fait tout.
Ceci dit dans Spyboot il existe la fonction de vaccination.
Mais les résidents antimalware peuvent ralentir ta machine.
C'est la raison de mon install de F-secure, afin d'éviter de mutilplier les processus....pitié pour nos PC ! -
re philo2100,
je mets quoi maintenant comme antispyware? pour remplacer spycatcher-
Salut
Pour avancer Philo
Pare-Feu gratos
télécharger la version gratuite de Kerio (avec Avast => moins de conflits)
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
Tuto =>
https://www.vulgarisation-informatique.com/kerio.php
Site de Kerio
https://kerio.probb.fr/
A++ -
@^^Marie^^Salut ^^Marie^^...
suis-je mal éveillé dis-moi ?
Pourquoi ta proposition ?
je vois :
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
Kerio Personal Firewall Service
----------------------------------------------------------------------------------- -
@Utilisateur anonymeLOL
Vé me recoucher......... -
@^^Marie^^Aah...d'un coté ça me rassure ! LOL
De l'autre, je crois que tu as raison...."Vé me recoucher......... "
Bonne nuit ^^Marie^^....et bon réveil !!
biz
Errare humanum est...LOL
-
-
voila le hijack :
Logfile of HijackThis v1.99.1
Scan saved at 21:05:53, on 03/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\sabrina\Bureau\Nouveau dossier (2)\metin !!.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\karim\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A8FAC4D-E9F0-408B-90AE-476BD8306011}: NameServer = 80.10.246.1 80.10.246.132
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Unknown owner - (no file)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - rundll32.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: SystemSuite Task Manager - Ontrack Data International - C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe -
bonjour !
SmitFraudFix v2.132
Rapport fait à 12:00:55,37, 03/01/2007
Executé à partir de C:\Documents and Settings\sabrina\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\sabrina
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\sabrina\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\sabrina\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~4\\GOEC62~1.DLL"
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin -
Salut ^^Marie^^
----------------------------------------------------------------------------
Bon, cathar6 ,,
Fait une sauvegarde de ta BDR:
https://leblogdeclaude.blogspot.com/2006/10/informatique-sauvegarde-de-la-base-de.html
-------------------------------------------------------------------------
Normalement, je ne vois pas l'utilité de ça pour xp: CTsvcCDA.exe
"It assists Windows manage the CD-ROM on Windows 9x and Me systems, however it has no use on faster CD-ROM drives."
http://www.liutilities.com/products/wintaskspro/processlibrary/ctsvccda/
A moins que ton lecteur de cdrom soit une antiquité !
ça précharge en fait quelques secondes en lecture, je ne vois pas ce que ça vient faire ici....
fermer le service voir ligne 023
-------------------------------------------------------------------------
C:\WINDOWS\System32\CTsvcCDA.exe
regarde si tu vois ça dans Msconfig/onglet démarrage/à décocher
----------------------------------------------------------------------------
scan seul de Hijackthis+cocher + fixer
--------------------------------------------------------------------------
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {70F76008-A8D9-4d5f-ABB7-3395612738F8} - (no file)
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} -
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
---------------------------------------------------------------------------
un bug de HJT ?
msgrapp.dll (often incorrectly listed by HijackThis as missing)
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
-----------------------------------------------------------------------------
Je suppose que tu es ches Wanadoo ?
si oui ne pas cocher ^^
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A8FAC4D-E9F0-408B-90AE-476BD8306011}: NameServer = 80.10.246.1 80.10.246.132
----------------------------------------------------------------------------
Clique sur "démarrer" -> "Exécuter" -> tape sans les guillemets "services.msc" (+OK),
mettre ces services en manuel
O23 - Service: ewido anti-spyware 4.0 guard - Unknown owner - (no file)
fermer ce service:
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - rundll32.exe (file missing)
-------------------------------------------------------------------------
Ensuite:
- Télécharge le logiciel SmitfraudFix
http://siri.urz.free.fr/Fix/SmitfraudFix.zip et décompresse le.
En image ici----------------->>
http://siri.urz.free.fr/Fix/SmitfraudFix.php
Tu décompresses et tu double clic sur smitfraudfix.cmd et choisis option 1
ça va générer un rapport.
Copie/colle le rapport
ici
Redémarres le PC en mode sans échec :
- Ouvre le dossier -------->SmitfraudFix
et double clic sur ---------->Smitfraudfix.cmd
Tu choisis l’option 2 et tu réponds oui à tout.
Copies/colles le rapport ici.
------------------------------------------------------------------------------
Refais un hitjackthis -
voila
Logfile of HijackThis v1.99.1
Scan saved at 20:45:11, on 02/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\ClamWin\bin\ClamTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\sabrina\Bureau\Nouveau dossier (2)\metin !!.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\karim\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {70F76008-A8D9-4d5f-ABB7-3395612738F8} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} -
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A8FAC4D-E9F0-408B-90AE-476BD8306011}: NameServer = 80.10.246.1 80.10.246.132
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Unknown owner - (no file)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - rundll32.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: SystemSuite Task Manager - Ontrack Data International - C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe -
Salut
Tu peux refaire un Ht en mode normal
stp
merci
-
RE PHILO2100 !
C'EST FAIT.
QUELLE EST L'ETAPE SUIVANTE ,
MERCI POUR TOUT ! -
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\karim\Spybot - Search & Destroy\TeaTimer.exe
------------------------------------------------------------------------------
Désactive la protection résidente de ces programme pendant la désinfection.
Il doit te rester un anti-virus et 1 fire-wall.
Pourquoi ?
ça risque de stopper certain processus néfastes à ton pc, et on risque de passer au dessus...
avec le log HJT...
-------------------------------------------------------------------------
désisntalles ceci:
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe -
j'ai virer spycatcher,
j'ai remplacer la dll shfolder par l'ancienne dans system32
voici un nouvo hijack this
Logfile of HijackThis v1.99.1
Scan saved at 16:01:49, on 02/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\sabrina\Bureau\Nouveau dossier (2)\metin !!.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:3128
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\karim\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {70F76008-A8D9-4d5f-ABB7-3395612738F8} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\karim\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Unknown owner - (no file)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - rundll32.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: SystemSuite Task Manager - Ontrack Data International - C:\PROGRA~1\Ontrack\SYSTEM~1\mxtask.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe -
Sorry,
as-tu réussis à désinstallé ce foutu logiciel SpyCatcher.exe ?
Donc en 1 supprimer la clé avec Hijackthis
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Program Files\SpyCatcher 2006\SpyCatcher.exe" reminder
parceque s'il se lance au démarrage...impossible à supprimer évidment !
Reboot de l'ordi en mode sans échec.
----------------------------------------------------------------------------------1/ -Démarrez Windows, ou s’il s’exécute, fermez Windows puis éteignez l'ordinateur.
2/ -Redémarrez l’ordinateur. L'ordinateur commence le traitement d'instructions connues sous le nom Basic Input/Output System (BIOS). L'affichage dépend du fabricant du BIOS. Certains ordinateurs affichent une barre de progression faisant référence à BIOS, d'autres peuvent ne pas indiquer le processus en cours de réalisation.
3/ -A la fin du chargement du BIOS, commencez à appuyer sur la touche F8 de votre clavier. Procédez ainsi jusqu'à ce que le menu des options avancées de Windows apparaisse. Si vous commencez à appuyer sur la touche F8 trop tôt, il est possible que certains ordinateurs affichent le message "erreur clavier". Pour résoudre ce problème, redémarrez l'ordinateur et essayez de nouveau.
4/ -En utilisant les flèches de votre clavier, sélectionnez Mode sans échec dans le menu puis appuyez sur Entrée.
-----------------------------------------------------------------------------
Tu vas dans Ajout/suppression de programme et tu supprimes. -
quid de ce désinstall ?
je sais pas ce que sa veut dire !! -
Euh ? c'est le log de quoi ça ?
------------------------------------------------------------
Tu n'as pas répondu à la question...
--------------------------------------------------------------------------------
Bon,
et quid de ce désinstall ?
--------------------------------------------------------------
Lance Hijackthis scan seul.
coche et fixer dans Hijackthis
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Program Files\SpyCatcher 2006\SpyCatcher.exe" reminder
------------------------------------------------------------------------------
Reboot en mode sans échec.
Maintenant désinstalles-le.
-------------------------------------------------------------------------------- -
regarder donc ce que rootkitbuster de trend micro m'a trouvé :
+----------------------------------------------------
| Trend Micro RootkitBuster 1.6 Beta.
| Module version: 1.6.0.1049
+----------------------------------------------------
--== Dump Hidden File on C:\ ==--
[HIDDEN_FILE]:
FullPath : C:\WINDOWS\SYSTEM32\bde3d_refk7.dll
FullPathLength: 35
DesiredAccess : 0x0
Options : 0x0
Attributes : 0x80
ShareAccess : 0x0
Type : 0x0
[HIDDEN_FILE]:
FullPath : C:\WINDOWS\SYSTEM32\ACTSKN43.OCX
FullPathLength: 32
DesiredAccess : 0x0
Options : 0x0
Attributes : 0x20
ShareAccess : 0x0
Type : 0x0
[HIDDEN_FILE]:
FullPath : C:\WINDOWS\SYSTEM32\ndisapi.dll
FullPathLength: 31
DesiredAccess : 0x0
Options : 0x0
Attributes : 0x20
ShareAccess : 0x0
Type : 0x0
[HIDDEN_FILE]:
FullPath : C:\WINDOWS\SYSTEM32\GETCPU.dll
FullPathLength: 30
DesiredAccess : 0x0
Options : 0x0
Attributes : 0x20
ShareAccess : 0x0
Type : 0x0
[HIDDEN_FILE]:
FullPath : C:\WINDOWS\SYSTEM32\bde3dref3K7.dll
FullPathLength: 35
DesiredAccess : 0x0
Options : 0x0
Attributes : 0x20
ShareAccess : 0x0
Type : 0x0
[HIDDEN_FILE]:
FullPath : C:\WINDOWS\SYSTEM32\shfolder.dll
FullPathLength: 32
DesiredAccess : 0x0
Options : 0x0
Attributes : 0x20
ShareAccess : 0x0
Type : 0x0
[HIDDEN_FILE]:
FullPath : C:\karim\ewido anti-spyware 4.0\guard.exe
FullPathLength: 41
DesiredAccess : 0x0
Options : 0x0
Attributes : 0x20
ShareAccess : 0x0
Type : 0x0
[HIDDEN_FILE]:
FullPath : C:\Documents and Settings\All Users\Application Data\Tenebril\SpyCatcher\QuarantinedLibraries.txt
FullPathLength: 97
DesiredAccess : 0x0
Options : 0x0
Attributes : 0x20
ShareAccess : 0x0
Type : 0x0
[HIDDEN_FILE]:
FullPath : C:\Documents and Settings\All Users\Application Data\Tenebril\SpyCatcher\QuarantinedExecutables.txt
FullPathLength: 99
DesiredAccess : 0x0
Options : 0x0
Attributes : 0x20
ShareAccess : 0x0
Type : 0x0
[HIDDEN_FILE]:
FullPath : C:\Documents and Settings\All Users\Application Data\Tenebril\SpyCatcher\HiddenFiles.txt
FullPathLength: 88
DesiredAccess : 0x0
Options : 0x0
Attributes : 0x20
ShareAccess : 0x0
Type : 0x0
[HIDDEN_FILE]:
FullPath : C:\asdf.txt
FullPathLength: 11
DesiredAccess : 0x0
Options : 0x0
Attributes : 0x20
ShareAccess : 0x0
Type : 0x0
11 hidden files found.
--== Dump Hidden Registry Value on HKLM ==--
No hidden registry entries found.
--== Dump Hidden Process ==--
No hidden processes found.
--== Dump Hidden Driver ==--
No hidden drivers found. -
7-Zip 4.42
Ad-Aware SE Personal
Adobe Reader 7.0.8 - Français
Alcatel SpeedTouch USB Software
Archiveur WinRAR
a-squared Free 2.0
avast! Antivirus
BeClean
Canon PhotoRecord
Canon PIXMA iP3000
Canon Utilities Easy-PhotoPrint
Canon Utilities Easy-PrintToolBox
CCleaner (remove only)
CD-LabelPrint
Correctif Windows XP - KB824146
Correctif Windows XP - KB828028
Correctif Windows XP - KB828035
Correctif Windows XP - KB828741
Correctif Windows XP - KB833987
Correctif Windows XP - KB835732
Correctif Windows XP - KB837001
Correctif Windows XP - KB839643
Correctif Windows XP - KB839645
Correctif Windows XP - KB840374
Correctif Windows XP - KB883357
Correctif Windows XP (SP2) Q329170
Correctif Windows XP (SP2) Q329441
Correctif Windows XP (SP2) Q810577
Correctif Windows XP (SP2) Q811493
Correctif Windows XP (SP2) Q815021
Correctif Windows XP (SP2) Q817606
Correctif Windows XP (SP2) Q819696
Cosmo Player 2.1 (38329)
DiskeeperWorkstation
DivX
DivX Converter
DivX Player
DivX Web Player
Dragon NaturallySpeaking 7.1
DVD Shrink 3.2
Easy-WebPrint
ewido anti-spyware 4.0
Free Internet Eraser 2.10
GalleryPlayer Images
GeForce2 GTS Experience
Google Desktop
Google Earth
Google Toolbar for Internet Explorer
Humour Toolbar
Internet Explorer Q867801
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment Standard Edition v1.3.1_03
jv16 PowerTools 1.3
Kaspersky Online Scanner
K-Lite Codec Pack 2.70 Full
Language pack for Ad-Aware SE
Lecteur Windows Media 10
Logiciel iTouch de Logitech
Macromedia Flash Player 8
Macromedia Shockwave Player
Mathcad 2000 Professionnel
MediaRing Talk 99 Release 7.0.0014
Microsoft Data Access Components KB870669
Microsoft Office 2000 Premium
Microsoft Office 2000 SR-1 Professional
Mozilla Firefox (1.5.0.9)
OLITEC PCI 56K V2 Modem
Ontrack SystemSuite 3.0
OpenOffice.org 2.1
Outil de mise à jour Google
Outlook Express Q823353
Package du correctif Windows XP [voir Q329048 pour plus de détails]
Package du correctif Windows XP [voir Q329390 pour plus de détails]
Package du correctif Windows XP [voir Q329834 pour plus de détails]
PCLink for GSM Ver.1.0
PC-Link VTech® (Masterpad®)
PestPatrolv5
Power Memory v.3.0
Project64 1.6
QuickTime
RealPlayer
Serveur AMS
Shareaza version 2.2.1.0
Shockwave
Skype 2.5
Sound Blaster AudioPCI
Sound Blaster Live!
Spybot - Search & Destroy 1.4
SpyCatcher Express 2006
StyleXP (remove only)
Sunbelt Kerio Personal Firewall
SUPERAntiSpyware Free Edition
TuneUp Utilities 2006
USB Monitor
VIAhm
VideoLAN VLC media player 0.8.4a
Viewpoint Media Player (Remove Only)
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format Runtime
WinFast Windows 95/98/ME Display Drivers
WinFox V1.0 Setup
WinZip
Woonoz SKY 3.11beta01
XingMPEG Player
Yahoo! Anti-Spy
Yahoo! Toolbar avec bloqueur de fenêtres pop-up
- 1
- 2
- 3
Suivant
