Log

Résolu
bonjour j orai voulu savoir si quelqu un aurai pu analyser mon log
merci de me repondre
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:54:34, on 12/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Wireless 802.11g Monitor\XPFix.exe
C:\WINDOWS\sm56hlpr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\Sanchez\LOCALS~1\Temp\Répertoire temporaire 1 pour HiJackThis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: rightonadz browser optimizer - {36A91CEC-6C71-4758-B492-397BFC8E96A2} - C:\WINDOWS\system32\gzmrotate.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: H - {5E66C4A5-70BE-48a1-A1FB-6D430A539969} - mioed.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: adssite - {F31B3634-12AA-41ca-B021-0685C3B3E4CA} - C:\WINDOWS\system32\nspA.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [XPFix] C:\Program Files\Wireless 802.11g Monitor\XPFix.exe
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [hid_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O21 - SSODL: DCOM Server 25319 - {2C1CD3D7-86AC-4068-93BC-A02304B25319} - (no file)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\mssrv32.exe
O23 - Service: Windows Management Service - Unknown owner - C:\WINDOWS\system32\dmyrw.exe (file missing)

--
End of file - 7393 bytes
Configuration: Windows XP
Internet Explorer 7.0

32 réponses

Résumé de la discussion

Une demande porte sur l'analyse d'un log HijackThis afin d'identifier des éléments indésirables et les lenteurs éventuelles d'un PC sous Windows XP. Plusieurs réponses évoquent les résultats d'outils comme BitDefender Online Scanner et Avast, des tentatives de désinfection et la suppression de fichiers potentiellement infectés. On retrouve des éléments suspects, extensions et modules douteux, cookies et fichiers temporaires, des paramètres modifiés et des services actifs indésirables. D'autres soulignent l'utilité de sauvegarder les backups du log HijackThis pour pouvoir revenir en arrière en cas d'erreur et d'évaluer les résultats des nettoyages.

Bobot (l’IA à votre service)
  1. sa va beaucoup mieu merci bocoup marie c gentil de t avoir occuper de mon cas ya juste quan mon ordi est allumer depui un ti moment que la il commence a etre lent mai sa c peu etre normal pi sa me derange pas tro je l etein et le rallume 1h apres et c reparti merci encor
    1. e voila avg
      AVG Anti-Spyware - Rapport d'analyse
      ---------------------------------------------------------

      + Créé à: 21:44:22 14/09/2007

      + Résultat de l'analyse:

      C:\Documents and Settings\Sanchez\Cookies\sanchez@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.

      Fin du rapport
      1. alors voila c cleanner
        ANALYSE COMPLETE - (23,700 secs)
        ------------------------------------------------------------------------------------------
        39,9MB ont été supprimés. (Taille approximative)
        ------------------------------------------------------------------------------------------

        Détails des fichiers à supprimer (Note: AUCUN fichier n'a pour l'instant été supprimé)
        ------------------------------------------------------------------------------------------
        Fichiers Temporaires d'Internet Explorer (fichiers 1387) 25,8MB
        C:\Documents and Settings\Sanchez\Cookies\sanchez@atdmt[1].txt 101 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@atdmt[3].txt 103 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@bitdefender[1].txt 134 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@bs.serving-sys[2].txt 125 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@bs.serving-sys[3].txt 125 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@caradisiac[1].txt 599 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@checksix-fr[2].txt 78 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@clubic[1].txt 255 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@cybermonitor[1].txt 93 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@earth.google[1].txt 349 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@em.pc-on-internet[1].txt 93 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@estat[1].txt 85 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@google[1].txt 130 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@google[2].txt 199 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@google[3].txt 131 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@h.msn[1].txt 68 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@h.msn[2].txt 67 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@hotmail.msn[1].txt 70 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@hotmail.msn[2].txt 71 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@infos-du-net.fr.intellitxt[1].txt 135 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@jeuxcherche[1].txt 387 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@jeuxvideopc.fr.intellitxt[1].txt 135 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@live[1].txt 351 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@live[2].txt 99 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@login.live[2].txt 174 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@login.live[3].txt 176 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@messenger.msn[1].txt 96 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@messenger.msn[2].txt 96 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@metaffiliation[2].txt 296 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@msn[1].txt 328 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@msn[3].txt 332 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@orange[2].txt 70 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@panoramio[1].txt 337 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@presence-pc.fr.intellitxt[1].txt 134 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@rad.msn[2].txt 680 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@rad.msn[3].txt 690 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@sdv[1].txt 83 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@sdv[2].txt 83 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@serving-sys[2].txt 514 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@serving-sys[3].txt 514 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@smartadserver[2].txt 399 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@ssl-hints.netflame[2].txt 163 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@store.ps-performance[1].txt 171 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@store.ps-performance[2].txt 104 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@store.ps-performance[4].txt 253 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@weborama[1].txt 91 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@weborama[3].txt 181 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@webrankinfo[1].txt 408 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@www.01net[1].txt 235 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@www.ciao[1].txt 69 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@www.clubic[2].txt 228 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@www.commentcamarche[1].txt 115 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@www.commentcamarche[2].txt 115 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@www.forum-auto[2].txt 263 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@www.googleadservices[1].txt 332 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@www.infos-du-net[1].txt 88 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@www.internetgamebox[1].txt 93 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@www.presence-pc[1].txt 85 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@www.webrankinfo[2].txt 199 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@xiti[1].txt 106 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@xiti[2].txt 105 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@yahoo[2].txt 152 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@yahoo[3].txt 156 bytes
        C:\Documents and Settings\Sanchez\Cookies\sanchez@yourmedia[1].txt 97 bytes
        Marqué pour l'effacement: C:\Documents and Settings\Sanchez\Local Settings\Temporary Internet Files\Content.IE5\index.dat
        Marqué pour l'effacement: C:\Documents and Settings\Sanchez\Cookies\index.dat
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\1imIMWpJR1eZNiZjlo6Cke0Li5Q= 10,07KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\2FYtyc32FFw2FnfkJr5PMaZNzVK0ac= 17,14KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\6+YCl+aRpACo3g9WVriOqeaC3ZI= 1,31KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\AujtjlfPiXJPb7pRa4w4zkv7XL8= 665 bytes
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\dtjWvHcnc2FduxTzRhlSvGrfNuHs= 2,26KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\DtRVimTqL02FJusOQMT6EUk9ETWU= 41,17KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\H6YQhRMtnhsM89MXgg2SjZswr3A= 27,14KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\JL+JRC6CK0ZjafGmSIilKa3HGOw= 1,38KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\KqM5je3IKsCZGkfgbxZP1EMNRwA= 801 bytes
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\l5wwjTfTinNzdzrklMKP8eP7GK0= 1,14KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\lSMOz45CpdxQjaRSHC1PYbyAIKU= 1,77KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\Lu1HH4UA1xz4I0Ljo0TNt0ibOJY= 6,73KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\MsZfNl+DkJ48v5tmEljV2FnZdqnA= 0,23MB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\qC7AEHtc9KvVZLHYTduiYSLHh7A= 12,45KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\V03nkldWIkgMm5Q8QOBZ5aayY2F0= 25,01KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\MessengerCache\ZEAfyuBwDDNrSJd7yDArARacX7g= 3,00KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\Set2C.tmp 0,11MB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\Set2F.tmp 0,11MB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\Set3C.tmp 0,11MB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\Set3F.tmp 0,11MB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\sxe1C.7z 12,7MB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\sxe1C.tmp 0 bytes
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\TFR3.tmp 0,16MB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\TFR4.tmp 68,72KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\TFR6.tmp 61,28KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\TFR8.tmp 9,99KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\TFRA.tmp 39,99KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\TFRD.tmp 100,45KB
        C:\DOCUME~1\Sanchez\LOCALS~1\Temp\TFRF.tmp 44,94KB
        C:\WINDOWS\system32\wbem\Logs\wbemess.log 24,80KB
        C:\WINDOWS\system32\wbem\Logs\wmiprov.log 466 bytes
        C:\WINDOWS\0.log 0 bytes
        C:\WINDOWS\setupact.log 60 bytes
        C:\WINDOWS\setupapi.log 2,51KB
        C:\WINDOWS\setuperr.log 0 bytes
        C:\WINDOWS\Debug\UserMode\userenv.log 2,95KB
        C:\Documents and Settings\Sanchez\Application Data\Macromedia\Flash Player\#SharedObjects\TXCQ5XCK\earth.google.com\datastore.swf\googleEarthSettings.sol 41 bytes
        C:\Documents and Settings\Sanchez\Application Data\Macromedia\Flash Player\#SharedObjects\TXCQ5XCK\www.youtube.com\soundData.sol 58 bytes
        C:\Documents and Settings\Sanchez\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.youtube.com\settings.sol 85 bytes
        C:\Documents and Settings\Sanchez\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 381 bytes
        ------------------------------------------------------------------------------------------
        1. Sur le lien que tu as au dessus
          Fais Ccleaner et AVG ==> poste le rapport
          1. BitDefender Online Scanner

            Rapport d'analyse généré à: Fri, Sep 14, 2007 - 00:44:07

            Voie d'analyse: C:\;D:\;E:\;

            Statistiques

            Temps
            02:05:27

            Fichiers
            126845

            Directoires
            2962

            Secteurs de boot
            3

            Archives
            941

            Paquets programmes
            3406

            Résultats

            Virus identifiés
            5

            Fichiers infectés
            5

            Fichiers suspects
            1

            Avertissements
            0

            Désinfectés
            0

            Fichiers effacés
            6

            Info sur les moteurs

            Définition virus
            803673

            Version des moteurs
            AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)

            Analyse des plugins
            14

            Archive des plugins
            38

            Unpack des plugins
            7

            E-mail plugins
            6

            Système plugins
            1

            Paramètres d'analyse

            Première action
            Désinfecté

            Seconde Action
            Supprimé

            Heuristique
            Oui

            Acceptez les avertissements
            Oui

            Extensions analysées
            *;

            Excludez les extensions

            Analyse d'emails
            Oui

            Analyse des Archives
            Oui

            Analyser paquets programmes
            Oui

            Analyse des fichiers
            Oui

            Analyse de boot
            Oui

            Fichier analysé
            Statut

            C:\WINDOWS\system32\adssite-remove.exe=>(NSIS o)=>lzma_solid_nsis0000
            Suspecté de: Adware.Fotomoto.H

            C:\WINDOWS\system32\adssite-remove.exe=>(NSIS o)=>lzma_solid_nsis0000
            Echec de la désinfection

            C:\WINDOWS\system32\adssite-remove.exe=>(NSIS o)=>lzma_solid_nsis0000
            Supprimé

            C:\WINDOWS\system32\adssite-remove.exe=>(NSIS o)
            Echec de la mise à jour

            C:\WINDOWS\system32\drivers\etc\hosts.20070717-192718.backup
            Infecté par: Generic.Qhost.FDA5AEEA

            C:\WINDOWS\system32\drivers\etc\hosts.20070717-192718.backup
            Echec de la désinfection

            C:\WINDOWS\system32\drivers\etc\hosts.20070717-192718.backup
            Supprimé

            C:\WINDOWS\system32\drivers\etc\hosts.20070717-192719.backup
            Infecté par: Generic.Qhost.C7E7D26D

            C:\WINDOWS\system32\drivers\etc\hosts.20070717-192719.backup
            Echec de la désinfection

            C:\WINDOWS\system32\drivers\etc\hosts.20070717-192719.backup
            Supprimé

            C:\WINDOWS\system32\drivers\etc\hosts.20070717-192720.backup
            Infecté par: Generic.Qhost.351F46CC

            C:\WINDOWS\system32\drivers\etc\hosts.20070717-192720.backup
            Echec de la désinfection

            C:\WINDOWS\system32\drivers\etc\hosts.20070717-192720.backup
            Supprimé

            C:\WINDOWS\system32\help.txt
            Infecté par: Trojan.Bho.Agent.G

            C:\WINDOWS\system32\help.txt
            Echec de la désinfection

            C:\WINDOWS\system32\help.txt
            Supprimé

            C:\WINDOWS\system32\KB82038842.exe
            Infecté par: Trojan.Proxy.Xorpix.AR

            C:\WINDOWS\system32\KB82038842.exe
            Echec de la désinfection

            C:\WINDOWS\system32\KB82038842.exe
            Supprimé
            1. il faut installer l'active x.. virus methode preliminaire de desinfection version fr
              1. tu devrais faire un scan en ligne avec bit defender, http://www.bitdefender.com/scan_fr/scan8/ie.html
                dis ce que ça donne
                1. des foi l ordinnateur est tres lent et il se deconnecte toute les 30 sec
                  1. ok jai fai comme tu ma di sa te va?

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\Ati2evxx.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    C:\WINDOWS\system32\Ati2evxx.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                    C:\WINDOWS\System32\FTRTSVC.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\SOUNDMAN.EXE
                    C:\Program Files\Wireless 802.11g Monitor\XPFix.exe
                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    C:\WINDOWS\sm56hlpr.exe
                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    C:\Program Files\Unlocker\UnlockerAssistant.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
                    C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
                    C:\Program Files\MSN Messenger\msnmsgr.exe
                    C:\Program Files\MSN Messenger\usnsvc.exe
                    C:\Program Files\Internet Explorer\iexplore.exe
                    C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                    C:\hitjachis\HijackThis.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                    R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O2 - BHO: H - {5E66C4A5-70BE-48a1-A1FB-6D430A539969} - mioed.dll (file missing)
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                    O4 - HKLM\..\Run: [XPFix] C:\Program Files\Wireless 802.11g Monitor\XPFix.exe
                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
                    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
                    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
                    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                    O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
                    O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
                    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                    O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\mssrv32.exe
                    1. Refais le correctement
                      Tu supprimes ceux au dessus

                      F - Hijackthis - Outil de diagnostic et réparation
                      télécharge HijackThis ici:
                      http://telechargement.zebulon.fr/138-hijackthis-1991.html
                      Dézippe le dans un dossier prévu à cet effet.
                      Par exemple C:\hijackthis < Enregistre le bien dans c : !
                      Démo : (Merci a Balltrap34 pour cette réalisation)
                      http://pageperso.aol.fr/balltrap34/Hijenr.gif
                      Lance le puis:
                      clique sur "do a system scan and save logfile" (cf démo)
                      faire un copier coller du log entier sur le forum
                      Démo : (Merci a Balltrap34 pour cette réalisation)
                      http://pageperso.aol.fr/balltrap34/demohijack.htm

                      http://www.tutoriaux-excalibur.com/hijackthis.htm

                      Bon courage

                      A+ -
                      • 1
                      • 2