Pages Pub et autre dans ie7
Résolu
Bonjour,
Depuis quelques jours des pages de pub s'ouvrent dans ie7 malgrés le blocage prévu.
Je colle un log hijackthis en espérant votre aide.
Merci.
Logfile of HijackThis v1.99.1
Scan saved at 17:09:40, on 12/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E78714D-2D26-4965-AECE-501024825423} - C:\WINDOWS\system32\urqnool.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\kvfysaoy.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {F2839E21-3952-4CAB-B25D-5070CF4FC994} - C:\WINDOWS\system32\gebya.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
celeron 2.6ghz 2 dd 1graveur+1lecteur cd
mem ddr 2700 512 m xp pro sp2
Depuis quelques jours des pages de pub s'ouvrent dans ie7 malgrés le blocage prévu.
Je colle un log hijackthis en espérant votre aide.
Merci.
Logfile of HijackThis v1.99.1
Scan saved at 17:09:40, on 12/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E78714D-2D26-4965-AECE-501024825423} - C:\WINDOWS\system32\urqnool.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\kvfysaoy.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {F2839E21-3952-4CAB-B25D-5070CF4FC994} - C:\WINDOWS\system32\gebya.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
celeron 2.6ghz 2 dd 1graveur+1lecteur cd
mem ddr 2700 512 m xp pro sp2
Configuration: Windows XP Internet Explorer 7.0
22 réponses
-
by,
a plus -
Contributeur sécuritéje crois que tu as raison :)
plus de problème donc ?
on peut terminer
* Tu peux supprimer tous les logiciels que nous avons utilisés (Type: SmitFraufix, Blacklight, SDFix, ect.....)
* démarrer-----------panneau de configuration------------système----------
onglet Restauration système-----------coche la case (Désactiver la restauration système)--------------
redémarre l'ordinateur
réactive la ensuite
* Pour améliorer la sécurité de ton PC prend quelques instants pour lire
CECI
* Dénonce ton infection pour faire condamner les auteurs.
Crée un message pour faire avancer les choses sur Malware-Complaints, nous devons être les plus nombreux possibles, alors rends compte de ton infection :
- Voir les règles du forum : https://malwarecomplaints.info/
- Après t'être enregistré à l'aide du bouton en haut se nommant "Register"
Si tu as plus de 13 ans, choisir : "I Agree to these terms and am over or exactly 13 years of age"
Si tu as moins, clique sur : "I Agree to these terms and am under 13 years of age"
Tu as alors sous forme de liste un sujet par type d'infection (Look2Me, Smitfraud, SpywareQuake etc..).
La tienne = ******
---> https://malwarecomplaints.info/
Si le malware que tu as eu n'apparaît pas dans la liste, ou si tu ne sais pas par quoi tu étais infecté(e), crée un message dans le sujet Autres infections
conforme au règle du forum (age, ville, département etc..)
Indique aussi le nom du Forum qui t'a aidé, CommentCaMarche
bonne continuation -
Merci encore pour ta patience, je viens de comprendre (un peu tard) que les nombreuses heures à réparer et reconfigurer mon pc sont dues en grande partie aux nombreux "cracks" installés sur ce poste, n'en étant pas le seul utilisateur mais le seul responsable envers tous, il me semble nécessaire de réagir au plus vite ...! Merci encore .
-
Contributeur sécuritére
avec des "cracks" normal qu'il y ai infection .....
* lance hijackthis puis coche ces lignes :
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe (file missing)
* toutes applications fermées et HORS CONNEXION, clique sur "fixer objet"
* fait la mise à jour de JAVA
as tu encore des problèmes particuliers ?
-
Merci de ta patience philae,
BitDefender Online Scanner
Rapport d'analyse généré à: Mon, Oct 15, 2007 - 22:32:00
Voie d'analyse: C:\;
Statistiques
Temps
00:47:48
Fichiers
144010
Directoires
4424
Secteurs de boot
4
Archives
2138
Paquets programmes
5851
Résultats
Virus identifiés
4
Fichiers infectés
4
Fichiers suspects
0
Avertissements
0
Désinfectés
0
Fichiers effacés
4
Info sur les moteurs
Définition virus
826753
Version des moteurs
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Analyse des plugins
14
Archive des plugins
38
Unpack des plugins
7
E-mail plugins
6
Système plugins
1
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
*;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\Program Files\ESET\infected\XVHVE1DA.NQF=>(Quarantine-PE)=>(NSIS o)=>zlib_nsis0001
Infecté par: Trojan.Downloader.TR
C:\Program Files\ESET\infected\XVHVE1DA.NQF=>(Quarantine-PE)=>(NSIS o)=>zlib_nsis0001
Echec de la désinfection
C:\Program Files\ESET\infected\XVHVE1DA.NQF=>(Quarantine-PE)=>(NSIS o)=>zlib_nsis0001
Supprimé
C:\Program Files\ESET\infected\XVHVE1DA.NQF=>(Quarantine-PE)=>(NSIS o)
Echec de la mise à jour
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb064.msp
Nettoyé
C:\WINDOWS\Installer\fb064.msp=>(Embedded CAB)
Nettoyé
C:\WINDOWS\Installer\fb064.msp=>(Embedded CAB)=>msgren32.A337.D0DF3458_A845_11D3_8D0A_0050046416B9
Nettoyé
C:\WINDOWS\Installer\fb064.msp=>(Embedded CAB)=>msgrenle.D320.D0DF3458_A845_11D3_8D0A_0050046416B9
Nettoyé
C:\WINDOWS\Installer\fb065.msp
Nettoyé
C:\WINDOWS\Installer\fb065.msp=>(Embedded CAB)
Nettoyé
C:\WINDOWS\Installer\fb065.msp=>(Embedded CAB)=>msth3aml.34AE.D0DF3458_A845_11D3_8D0A_0050046416B9
Nettoyé
C:\WINDOWS\Installer\fb065.msp=>(Embedded CAB)=>msthes3d.E64B.D0DF3458_A845_11D3_8D0A_0050046416B9
Nettoyé
C:\WINDOWS\Installer\fb066.msp
Nettoyé
C:\WINDOWS\Installer\fb066.msp=>(Embedded CAB)
Nettoyé
C:\WINDOWS\Installer\fb066.msp=>(Embedded CAB)=>mso.acl_3082.D0DF3458_A845_11D3_8D0A_0050046416B9
Nettoyé
C:\WINDOWS\Installer\fb066.msp=>(Embedded CAB)=>mso.acl_1043.D0DF3458_A845_11D3_8D0A_0050046416B9
Nettoyé
C:\WINDOWS\Installer\fb066.msp=>(Embedded CAB)=>mssp3enl.34AE.D0DF3458_A845_11D3_8D0A_0050046416B9
Nettoyé
C:\WINDOWS\Installer\fb066.msp=>(Embedded CAB)=>msspell3.A337.D0DF3458_A845_11D3_8D0A_0050046416B9
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>CDOOFF.DLL
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>DLGSETP.DLL
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>DUMPSTER.DLL
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>ENVELOPE.DLL
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>EXSEC32.DLL_0001
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>IMPMAIL.DLL
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>MIMEDIR.DLL
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>MSOUTL.OLB
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLADD.FAE
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLAPPT.FAE
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLJRNL.FAE
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLMAIL.FAE
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLMAIL.FAE=>(zlib o)
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLTASK.FAE
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLCM.DLL
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLLIB.DLL
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLMIME.DLL
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLOOK.EXE
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLPH.DLL
Nettoyé
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLVBS.DLL_0001
Nettoyé
C:\WINDOWS\Installer\fb0b6.msp=>(Embedded CAB)=>MSPUB.EXE_1033
Nettoyé
C:\WINDOWS\Installer\fb0b6.msp=>(Embedded CAB)=>PRTF9.DLL_1033
Nettoyé
C:\WINDOWS\Installer\fb0b6.msp=>(Embedded CAB)=>PTXT9.DLL_1033
Nettoyé
C:\WINDOWS\Installer\fb0b6.msp=>(Embedded CAB)=>MSPUB.EXE_1049
Nettoyé
C:\WINDOWS\Installer\fb0cb.msp
Nettoyé
C:\WINDOWS\Installer\fb0cb.msp=>(Embedded CAB)
Nettoyé
C:\WINDOWS\Installer\fb0cb.msp=>(Embedded CAB)=>MSCONV97.DLL
Nettoyé
C:\WINDOWS\Installer\fb0cb.msp=>(Embedded CAB)=>WPFT532.CNV
Nettoyé
C:\WINDOWS\Installer\67df2.msi
Nettoyé
C:\WINDOWS\Installer\67df2.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\67df2.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\fb0df.msp
Nettoyé
C:\WINDOWS\Installer\fb0df.msp=>(Embedded CAB)
Nettoyé
C:\WINDOWS\Installer\fb0df.msp=>(Embedded CAB)=>MSROUTE.DLL
Nettoyé
C:\WINDOWS\Installer\fb0f4.msp
Nettoyé
C:\WINDOWS\Installer\fb0f4.msp=>(Embedded CAB)
Nettoyé
C:\WINDOWS\Installer\fb0f4.msp=>(Embedded CAB)=>EXCEL.EXE
Nettoyé
C:\WINDOWS\Installer\fb0f4.msp=>(Embedded CAB)=>EXCEL.EXE_1033
Nettoyé
C:\WINDOWS\Installer\fb0f4.msp=>(Embedded CAB)=>EXCEL.EXE_1049
Nettoyé
C:\WINDOWS\Installer\fb108.msp
Nettoyé
C:\WINDOWS\Installer\fb108.msp=>(Embedded CAB)
Nettoyé
C:\WINDOWS\Installer\fb108.msp=>(Embedded CAB)=>GIFIMP32.FLT
Nettoyé
C:\WINDOWS\Installer\fb108.msp=>(Embedded CAB)=>PNG32.FLT
Nettoyé
C:\WINDOWS\Installer\MSI8E.tmp
Nettoyé
C:\WINDOWS\Installer\MSI90.tmp
Nettoyé
C:\WINDOWS\Installer\MSI90.tmp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\d317f3.msi
Nettoyé
C:\WINDOWS\Installer\d317f3.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\d317f3.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\d317f3.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\d317f3.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\3b1488.msi
Nettoyé
C:\WINDOWS\Installer\17043eb.msi
Nettoyé
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\MSI99.tmp
Nettoyé
C:\WINDOWS\Installer\MSI9B.tmp
Nettoyé
C:\WINDOWS\Installer\MSI9B.tmp=>(Embedded EXE)
Nettoyé
C:\WINDOWS\Installer\MSN Messenger 8.1.0178\
Nettoyé
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>keygen.exe
Infecté par: Trojan.Virtumonde.IK
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>keygen.exe
Echec de la désinfection
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>keygen.exe
Supprimé
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar
Echec de la mise à jour
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>crack.exe
Infecté par: Trojan.Mezzia.XA
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>crack.exe
Echec de la désinfection
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>crack.exe
Supprimé
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar
Echec de la mise à jour
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>patch.exe
Infecté par: Trojan.Downloader.LoadAdv.XXA
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>patch.exe
Echec de la désinfection
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>patch.exe
Supprimé
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar
Echec de la mise à jour
-
Contributeur sécuritépas trop le choix, oui recommence stp
et sauvegarde le rapport en entier
voir ici
http://pageperso.aol.fr/loraline60/bitdefender_scan.htm -
Je recommence?
-
Et un log hijackthis en plus :
Logfile of HijackThis v1.99.1
Scan saved at 21:36:56, on 15/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\Scanner.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
-
Contributeur sécuritéc'est bien joli tout ça, mais je n'ai pas le rapport entier .....
je ne sais pas les actions entreprises ni l'endroit de l'infection....
-
He bé, durant le scan par bitdefender, nod 32 m'a prévenu plusieurs fois que Win32/HOAX.Renos.HZ application était placé en quarantaine: Fichier C:docume~1\Nous\Loabs~1\temp\tmp11 puis 12 puis 13 etc jusqu'a 16 ou 17.
Puis l'ordi c'est bloqué 2 fois pendant le scan de bitdefender et enfin en voila un résultat :
BitDefender Online Scanner - Rapport virus en temps réel
Généré à: Mon, Oct 15, 2007 - 21:26:09
--------------------------------------------------------------------------------
Info d'analyse
Fichiers scannés
161928
Infectés Fichiers
4
Virus Détectés
Trojan.Downloader.TR
1
Trojan.Virtumonde.IK
1
Trojan.Mezzia.XA
1
Trojan.Downloader.LoadAdv.XXA
1
--------------------------------------------------------------------------------
Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.
C'était long et c'est pas gagné!!!!
Garder le moral, encore un peu , je peu....
-
Contributeur sécuritére
ok merci
il semblerait que combo ait eu sa peau cette fois ci
* Fait un scan antivirus en ligne avec Internet Explorer
https://www.bitdefender.fr/
et copie colle le résultat ici
* En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
* Dans la nouvelle fenêtre, clique sur I agree
* La fenêtre change encore, clique sur Click here to scan
* Les signatures se chargent, etc.
tuto en image
http://pageperso.aol.fr/rginformatique/mapage/defender.htm
-
Salut philae, désolé pour ta grippe (mettre des chaussettes la nuit), je suis déja bien content de trouver autant d'aide sur le forum, voila mes derniers rapports:
--ComboFix 07-10-12.4 - NOUS 2007-10-15 12:50:57.2 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.240 [GMT 2:00]
Running from: C:\Documents and Settings\NOUS\Bureau\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\check_LSA7.txt
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\awvtr.dll
C:\WINDOWS\system32\bbslopsr.dll
C:\WINDOWS\system32\ckacbvso.dll
C:\WINDOWS\system32\oauqrtyx.dll
C:\WINDOWS\system32\osvbcakc.ini
C:\WINDOWS\system32\rnywlsta.dll
C:\WINDOWS\system32\rspolsbb.ini
C:\WINDOWS\system32\rtvwa.bak1
C:\WINDOWS\system32\rtvwa.bak1
C:\WINDOWS\system32\rtvwa.bak2
C:\WINDOWS\system32\rtvwa.bak2
C:\WINDOWS\system32\rtvwa.ini
C:\WINDOWS\system32\rtvwa.ini
.
((((((((((((((((((((((((((((( Fichiers créés 2007-09-15 to 2007-10-15 ))))))))))))))))))))))))))))))))))))
.
2007-10-14 11:46 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-10-14 11:21 <REP> d-------- C:\ADSerunt
2007-10-12 18:16 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-12 17:56 <REP> d-------- C:\VundoFix Backups
2007-10-11 13:10 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2007-10-11 12:18 <REP> d-------- C:\Documents and Settings\NOUS\Application Data\sysdepannage
2007-10-11 12:13 <REP> dr------- C:\Documents and Settings\All Users.WINDOWS\Application Data\sysdepannage
2007-10-10 10:37 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-09 21:31 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
2007-10-08 19:22 <REP> d-------- C:\Documents and Settings\NOUS\Application Data\Ahead
2007-10-08 19:17 <REP> d-------- C:\Program Files\Nero
2007-10-08 19:17 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero
2007-10-08 18:16 <REP> d-------- C:\Documents and Settings\NOUS\Application Data\Lavasoft
2007-10-08 18:16 <REP> d-------- C:\Documents and Settings\NOUS\Application Data\Jasc Software Inc
2007-09-28 20:01 <REP> d-------- C:\WINDOWS\system32\LogFiles
2007-09-25 19:12 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Messenger Plus!
2007-09-20 19:14 <REP> d-------- C:\Documents and Settings\NOUS\Contacts
2007-09-20 19:13 <REP> d-------- C:\WINDOWS\system32\DRVSTORE
2007-09-20 17:24 <REP> d-------- C:\Documents and Settings\NOUS\Application Data\MSN6
2007-09-20 17:24 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\MSN6
2007-09-17 19:29 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2007-09-16 16:52 <REP> d--hs---- C:\FOUND.031
2007-09-16 10:18 <REP> d-------- C:\WINDOWS\Sun
2007-09-16 10:04 <REP> d-------- C:\WINDOWS\system32\fr-fr
2007-09-16 10:04 <REP> d--h----- C:\WINDOWS\msdownld.tmp
2007-09-16 09:59 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll
2007-09-15 10:31 <REP> d--hs---- C:\FOUND.030
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-14 09:53 167 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2007-10-09 19:31 --------- d-----w C:\Program Files\Hijackthis Version Française
2007-09-12 14:17 --------- d-----w C:\Program Files\ArcSoft
2007-09-08 16:42 --------- d-----w C:\Documents and Settings\NOUS\Application Data\Hewlett-Packard
2007-09-07 19:14 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-09-07 19:14 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2007-09-07 19:14 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-09-07 18:09 --------- d-----w C:\Program Files\Sunbelt Software
2007-09-06 17:29 --------- d-----w C:\Documents and Settings\NOUS\Application Data\vlc
2007-09-06 13:51 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Google Updater
2007-09-04 19:13 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:17 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-20 09:59 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-08-20 09:59 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-08-20 09:59 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
2007-08-20 09:59 6,058,496 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-08-20 09:59 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-08-20 09:59 477,696 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-20 09:59 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-08-20 09:59 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-08-20 09:59 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-08-20 09:59 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-08-20 09:59 3,584,512 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-20 09:59 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-20 09:59 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-08-20 09:59 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-08-20 09:59 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-08-20 09:59 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-20 09:59 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-08-20 09:59 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-08-20 09:59 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-20 09:59 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
2007-08-20 09:59 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
2007-08-20 09:59 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll
2007-08-20 09:59 1,152,000 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-17 10:22 63,488 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-08-17 10:22 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-08-17 10:22 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-08-17 07:34 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 17:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-07-30 17:18 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
2007-07-25 20:18 52,552 ----a-w C:\Documents and Settings\moi\Application Data\GDIPFONTCACHEV1.DAT
2003-06-10 10:04 435 ----a-w C:\Documents and Settings\ls300_mydsc_0610\layout.bin
2000-05-15 08:08 134,656 ----a-w C:\Documents and Settings\ls300_mydsc_0610\Setup.exe
.
((((((((((((((((((((((((((((( snapshot@2007-10-12_18.26.19.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 10:02:28 163,328 ----a-w C:\WINDOWS\erdnt\14-10-2007\ERDNT.EXE
+ 2007-10-14 09:23:50 3,747,840 ----a-w C:\WINDOWS\erdnt\14-10-2007\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2007-10-14 09:23:50 143,360 ----a-w C:\WINDOWS\erdnt\14-10-2007\Users\[u]0[/u]0000002\UsrClass.dat
+ 2007-03-13 08:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-07 21:14]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 12:08]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-26 17:36]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-04 19:20]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
.
**************************************************************************
catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-15 12:58:02
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-15 13:00:09 - machine was rebooted
C:\ComboFix2.txt ... 2007-10-12 18:27
.
--- E O F ---
Logfile of HijackThis v1.99.1
Scan saved at 13:05:10, on 15/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\Scanner.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Merci....
celeron 2.6ghz 2 dd 1graveur+1lecteur cd
mem ddr 2700 512 m xp pro sp2 -
Contributeur sécuritébonjour,
désolée, ce n'est pas parce que c'est dimanche, mais j'ai attrapé la grippe, et j'ai passé mon dimanche au lit :)
j'essaye de me concentrer sur ton problème....lol
récalcitrant celui ci
* renomme hijackthis en scanner.exe et
relance combofix
et poste le nouveau rapport
puis poste un nouveau rapport hiajckthis renommé
-
Je comprends , c'est dimanche, j'aurais plus de chance demain!!!
A plus. -
Bonjour, sacrée soirée.......et toujours infecté.
impossible de supprimer la valeur de c:\WINDOWS\system32\awvtr.dll ,ni avec Vundofix ni avec Hijackthis, si je supprime dans la base de registre une nouvelle valeur est recréée à chaque boot.
Merci de bien vouloir encoree m'aider.
VundoFix V6.5.8
Checking Java version...
Scan started at 22:51:25 04/09/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.8
Checking Java version...
Scan started at 13:18:43 06/09/2007
Listing files found while scanning....
VundoFix V6.5.9
Checking Java version...
Scan started at 17:56:49 12/10/2007
Listing files found while scanning....
C:\windows\system32\aybeg.bak1
C:\windows\system32\aybeg.bak2
C:\windows\system32\aybeg.ini
C:\windows\system32\gebya.dll
C:\WINDOWS\system32\kvfysaoy.dll
Beginning removal...
Attempting to delete C:\windows\system32\aybeg.bak1
C:\windows\system32\aybeg.bak1 Has been deleted!
Attempting to delete C:\windows\system32\aybeg.bak2
C:\windows\system32\aybeg.bak2 Has been deleted!
Attempting to delete C:\windows\system32\aybeg.ini
C:\windows\system32\aybeg.ini Has been deleted!
Attempting to delete C:\windows\system32\gebya.dll
C:\windows\system32\gebya.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\kvfysaoy.dll
C:\WINDOWS\system32\kvfysaoy.dll Could not be deleted.
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\windows\system32\aybeg.ini
C:\windows\system32\aybeg.ini Has been deleted!
Attempting to delete C:\windows\system32\gebya.dll
C:\windows\system32\gebya.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\kvfysaoy.dll
C:\WINDOWS\system32\kvfysaoy.dll Has been deleted!
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\WINDOWS\system32\awvtr.dll
C:\WINDOWS\system32\awvtr.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\awvtr.dll
C:\WINDOWS\system32\awvtr.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\urqnool.dll
C:\WINDOWS\system32\urqnool.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\urqnool.dll
C:\WINDOWS\system32\urqnool.dll Could not be deleted.
Performing Repairs to the registry.
Done!
Beginning removal...
Beginning removal...
Attempting to delete C:\WINDOWS\system32\awvtr.dll
C:\WINDOWS\system32\awvtr.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\urqnool.dll
C:\WINDOWS\system32\urqnool.dll Could not be deleted.
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\WINDOWS\system32\awvtr.dll
C:\WINDOWS\system32\awvtr.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\urqnool.dll
C:\WINDOWS\system32\urqnool.dll Has been deleted!
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\WINDOWS\system32\awvtr.dll
C:\WINDOWS\system32\awvtr.dll Could not be deleted.
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\WINDOWS\system32\awvtr.dll
C:\WINDOWS\system32\awvtr.dll Could not be deleted.
Performing Repairs to the registry.
Logfile of HijackThis v1.99.1
Scan saved at 11:57:15, on 14/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {F1A70968-24B6-452F-8499-60B3584FB09B} - C:\WINDOWS\system32\awvtr.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
-
Contributeur sécuritébonjour,
ca va peut être beaucoup mieux, mais tjs infecté
on continue
* Relance Vundofix
* Ne clique pas sur "Scan for a vundo"
* Clique droit au milieu de la fenêtre
* Clique sur Add more files ?
* Copie/colle les fichiers ci-dessous ( un par case) :
C:\WINDOWS\system32\urqnool.dll
C:\WINDOWS\system32\awvtr.dll
* Clique sur Add files
* Ensuite clique sur Close Windows
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
* Si l'outils demande un redémarrage, accepte
* Poste le rapport Vundofix
puis
* télécharge ERUNT pour protéger toutes mauvaises manip dan sla base de registre
https://www.zebulon.fr/telechargements/utilitaires/systeme-utilitaires/erunt.html
tuto
http://pageperso.aol.fr/loraline60/tuto_erunt.htm
puis
démarrer--------------exécuter---------------tu tapes regedit----ok
ensuite tu navigues jusqu'à ces clés et tu supprimes ce qui est en gras :
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{4E78714D-2D26-4965-AECE-501024825423}"= C:\WINDOWS\system32\urqnool.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E78714D-2D26-4965-AECE-501024825423}
C:\WINDOWS\system32\urqnool.dll
relance hijackthis puis coche ces lignes (si elles y sont encore)
O2 - BHO: (no name) - {4E78714D-2D26-4965-AECE-501024825423} - C:\WINDOWS\system32\urqnool.dll
O2 - BHO: (no name) - {50B81FC8-9B4C-452A-996A-8DE0E86EE910} - C:\WINDOWS\system32\awvtr.dll
et HORS CONNEXION, toutes applications fermées clique sur "fix checked"
reposte les rapports vundo et un nouveau rapport hijackthis
ps : je serais absente en début de soirée; Je pense pouvoir passer tard
-
Salut à tous , on continue..
--[10/13/2007, 15:03:29] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\NOUS\Bureau\VirtumundoBeGone.exe" )
[10/13/2007, 15:03:36] - Detected System Information:
[10/13/2007, 15:03:36] - Windows Version: 5.1.2600, Service Pack 2
[10/13/2007, 15:03:36] - Current Username: NOUS (Admin)
[10/13/2007, 15:03:36] - Windows is in NORMAL mode.
[10/13/2007, 15:03:36] - Searching for Browser Helper Objects:
[10/13/2007, 15:03:36] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/13/2007, 15:03:36] - BHO 2: {4E78714D-2D26-4965-AECE-501024825423} ()
[10/13/2007, 15:03:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/13/2007, 15:03:36] - Checking for HKLM\...\Winlogon\Notify\urqnool
[10/13/2007, 15:03:36] - Key not found: HKLM\...\Winlogon\Notify\urqnool, continuing.
[10/13/2007, 15:03:36] - BHO 3: {50B81FC8-9B4C-452A-996A-8DE0E86EE910} ()
[10/13/2007, 15:03:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/13/2007, 15:03:36] - Checking for HKLM\...\Winlogon\Notify\awvtr
[10/13/2007, 15:03:36] - Key not found: HKLM\...\Winlogon\Notify\awvtr, continuing.
[10/13/2007, 15:03:36] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/13/2007, 15:03:36] - BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/13/2007, 15:03:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/13/2007, 15:03:36] - No filename found. Continuing.
[10/13/2007, 15:03:36] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/13/2007, 15:03:36] - BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/13/2007, 15:03:36] - Finished Searching Browser Helper Objects
[10/13/2007, 15:03:36] - Finishing up...
[10/13/2007, 15:03:36] - Nothing found! Exiting...
Logfile of HijackThis v1.99.1
Scan saved at 15:05:16, on 13/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SynCor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E78714D-2D26-4965-AECE-501024825423} - C:\WINDOWS\system32\urqnool.dll
O2 - BHO: (no name) - {50B81FC8-9B4C-452A-996A-8DE0E86EE910} - C:\WINDOWS\system32\awvtr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
et voilà...ça va déja beaucoup mieu....
celeron 2.6ghz 2 dd 1graveur+1lecteur cd
mem ddr 2700 512 m xp pro sp2 -
Contributeur sécuritére bonsoir,
* Télécharge VirtumundoBeGone sur ton bureau .
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
* double-clic sur VirtumundoBeGone.exe
* Suis les instructions à l'écran
* Quand le scan est terminé, enregistre le rapport.
* Copie/Colle le ici
et reposte un nouveau rapport hijackthis
-
Et Hop:
ComboFix 07-10-12.4 - NOUS 2007-10-12 18:18:10.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.209 [GMT 2:00]
Running from: C:\Documents and Settings\NOUS\Bureau\ComboFix.exe
* Created a new restore point
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\check_LSA7.txt
C:\Documents and Settings\NOUS\Application Data\setup_fr[1].exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\aybeg.ini
C:\WINDOWS\system32\bkaidrat.ini
C:\WINDOWS\system32\djjektro.ini
C:\WINDOWS\system32\gebya.dll
C:\WINDOWS\system32\ortkejjd.dll
C:\WINDOWS\system32\pgqtxssc.dll
C:\WINDOWS\system32\tardiakb.dll
.
((((((((((((((((((((((((((((( Fichiers créés 2007-09-12 to 2007-10-12 ))))))))))))))))))))))))))))))))))))
.
2007-10-12 18:16 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-12 17:56 <REP> d-------- C:\VundoFix Backups
2007-10-11 13:10 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2007-10-11 12:18 <REP> d-------- C:\Documents and Settings\NOUS\Application Data\sysdepannage
2007-10-11 12:13 <REP> dr------- C:\Documents and Settings\All Users.WINDOWS\Application Data\sysdepannage
2007-10-10 10:37 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-09 21:31 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
2007-10-09 08:56 36,352 --a------ C:\WINDOWS\system32\urqnool.dll
2007-10-08 19:22 <REP> d-------- C:\Documents and Settings\NOUS\Application Data\Ahead
2007-10-08 19:17 <REP> d-------- C:\Program Files\Nero
2007-10-08 19:17 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero
2007-10-08 18:16 <REP> d-------- C:\Documents and Settings\NOUS\Application Data\Lavasoft
2007-10-08 18:16 <REP> d-------- C:\Documents and Settings\NOUS\Application Data\Jasc Software Inc
2007-09-28 20:01 <REP> d-------- C:\WINDOWS\system32\LogFiles
2007-09-25 19:12 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Messenger Plus!
2007-09-20 19:14 <REP> d-------- C:\Documents and Settings\NOUS\Contacts
2007-09-20 19:13 <REP> d-------- C:\WINDOWS\system32\DRVSTORE
2007-09-20 17:24 <REP> d-------- C:\Documents and Settings\NOUS\Application Data\MSN6
2007-09-20 17:24 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\MSN6
2007-09-17 19:29 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2007-09-16 16:52 <REP> d--hs---- C:\FOUND.031
2007-09-16 10:18 <REP> d-------- C:\WINDOWS\Sun
2007-09-16 10:04 <REP> d-------- C:\WINDOWS\system32\fr-fr
2007-09-16 10:04 <REP> d--h----- C:\WINDOWS\msdownld.tmp
2007-09-16 09:59 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll
2007-09-15 10:31 <REP> d--hs---- C:\FOUND.030
2007-09-12 16:17 77,312 --a------ C:\WINDOWS\system32\TWAIN_32.DLL
2007-09-12 16:16 <REP> d-------- C:\Program Files\ArcSoft
2007-09-12 16:13 96,768 --a------ C:\WINDOWS\SlantAdj.dll
2007-09-12 16:13 73,216 --a------ C:\WINDOWS\ADE.DLL
2007-09-12 16:13 3,136 --a------ C:\WINDOWS\Ade001.bin
2007-09-12 16:12 33,280 --a------ C:\WINDOWS\system32\esccm.dll
2007-09-12 16:12 32,256 --a------ C:\WINDOWS\system32\escwiab.dll
2007-09-12 16:12 27,648 --a------ C:\WINDOWS\system32\escimg.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-09 19:31 --------- d-----w C:\Program Files\Hijackthis Version Française
2007-09-08 16:42 --------- d-----w C:\Documents and Settings\NOUS\Application Data\Hewlett-Packard
2007-09-07 19:14 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-09-07 19:14 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2007-09-07 19:14 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-09-07 18:09 --------- d-----w C:\Program Files\Sunbelt Software
2007-09-06 17:29 --------- d-----w C:\Documents and Settings\NOUS\Application Data\vlc
2007-09-06 13:51 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Google Updater
2007-09-04 19:13 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:17 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-20 09:59 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-08-20 09:59 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-08-20 09:59 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
2007-08-20 09:59 6,058,496 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-08-20 09:59 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-08-20 09:59 477,696 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-20 09:59 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-08-20 09:59 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-08-20 09:59 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-08-20 09:59 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-08-20 09:59 3,584,512 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-20 09:59 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-20 09:59 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-08-20 09:59 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-08-20 09:59 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-08-20 09:59 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-20 09:59 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-08-20 09:59 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-08-20 09:59 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-20 09:59 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
2007-08-20 09:59 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
2007-08-20 09:59 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll
2007-08-20 09:59 1,152,000 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-17 10:22 63,488 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-08-17 10:22 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-08-17 10:22 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-08-17 07:34 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 17:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-07-30 17:18 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
2007-07-25 20:18 52,552 ----a-w C:\Documents and Settings\moi\Application Data\GDIPFONTCACHEV1.DAT
2007-07-12 23:30 765,952 ----a-w C:\WINDOWS\system32\dllcache\vgx.dll
2003-06-10 10:04 435 ----a-w C:\Documents and Settings\ls300_mydsc_0610\layout.bin
2000-05-15 08:08 134,656 ----a-w C:\Documents and Settings\ls300_mydsc_0610\Setup.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E78714D-2D26-4965-AECE-501024825423}]
2007-10-09 08:57 36352 --a------ C:\WINDOWS\system32\urqnool.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-07 21:14]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 12:08]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-26 17:36]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-04 19:20]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{4E78714D-2D26-4965-AECE-501024825423}"= C:\WINDOWS\system32\urqnool.dll [2007-10-09 08:57 36352]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
.
**************************************************************************
catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-12 18:25:16
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-12 18:27:21 - machine was rebooted
.
--- E O F --- -
Contributeur sécuritére
* Télécharge combofix.exe (par sUBs) sur ton Bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
* Double clique combofix.exe.
* Tape sur la touche Y (Yes) pour démarrer le scan.
* Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
ainsi qu'un nouveau rapport hijackthis
- 1
- 2
Suivant
