Virus??
Bonjour,
J'ai une petite question: Je pensais avoir le virus qui circule sur MSN possédant déjà plusieurs noms (Album.zip, etc.). Les incidents ont été les suivants: Windows MSN Messenger m'informe que je me suis connectée depuis un autre ordinateur et qu'il faut que je me reconnecte, le même lien sur lequel j'ai cliqué (oui je suis une idiote) est envoyé à mes contacts. J'ai suivi toutes les instructions que j'ai trouvé sur internet (MsnFix). Le scanner m'a dit qu'il n'y avait rien de suspect sur mon ordinateur. Je pensais m'en être débarrassé, mais malheureusement, les mêmes incidents qu'au début sont réapparus.
Que dois -je faire et quel est le virus attrapé? J'espère que quelqu'un pourra m'aider, je viens d'acheter mon portable il y a trois semaines...
Merci d'avance!
Sabine
J'ai une petite question: Je pensais avoir le virus qui circule sur MSN possédant déjà plusieurs noms (Album.zip, etc.). Les incidents ont été les suivants: Windows MSN Messenger m'informe que je me suis connectée depuis un autre ordinateur et qu'il faut que je me reconnecte, le même lien sur lequel j'ai cliqué (oui je suis une idiote) est envoyé à mes contacts. J'ai suivi toutes les instructions que j'ai trouvé sur internet (MsnFix). Le scanner m'a dit qu'il n'y avait rien de suspect sur mon ordinateur. Je pensais m'en être débarrassé, mais malheureusement, les mêmes incidents qu'au début sont réapparus.
Que dois -je faire et quel est le virus attrapé? J'espère que quelqu'un pourra m'aider, je viens d'acheter mon portable il y a trois semaines...
Merci d'avance!
Sabine
Configuration: Windows Vista Firefox 2.0.0.13
10 réponses
-
Ok Sabine ...
Je te prépare une manip pour demain matin.
@+.
-
blabla ..., je connais, je suis déjà sortie avec ce genre d'abruti ... blabla
blabla ... j'ai déjà fait ça ... blabla
Je t'avais prévenu ... Tu "crois" avoir fait les choses ... mais effectuées dans le désordre, chacune de tes actions mène à une "non-résolution" ....
Tu es intelligente, mais tu ne fais confiance à personne ...
Dans la mesure où je ne suis "personne", sinon "quelqu'un" ...
Je te suggère de REposer ton problème ... I give you my word I'll never answer a question again, from You !
Bye !-
-
Voilà j'ai refait l'analyse et je n'ai pas fait le nettoyage puisqu'aucun problème n'a été trouvé. Je sais pas si j'ai bien fait? Mais voici le rapport si tu acceptes tjs de m'aider!
MSNFix 1.686
C:\Users\Sabine\Desktop\MSNFix\MSNFix
Fix exécuté le 28.03.2008 - 0:18:51.85 By Sabine
mode sans échec
************************ Recherche les fichiers présents
Aucun Fichier trouvé
************************ Recherche les dossiers présents
Aucun dossier trouvé
************************ Fichiers suspects
Aucun Fichier trouvé
************************ HKLM\...\Winlogon\Userinit
Userinit = C:\Windows\system32\userinit.exe,
------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------
--------------------------------------------- END ---------------------------------------------
-
-
Sorry ! I'm working on my next interference in a metting .... and I can't tell you about it ;-( ... sorry Baby !
So, what about you ...
/!\pour que MSNfix fonctionne, tu dois désactiver l'UAC de Vista/!\
Sous Vista , l’UAC doit être désactivée lors de l'utilisation du fix (*)
Télécharger MSNFix : http://sosvirus.changelog.fr/MSNFix.exe
Enregistre le fichier sur votre bureau.
Double-cliquer sur le fichier, le but étant de récupérer un dossier MSNFix .
Double-clique sur le dossier MSNFix afin de l'ouvrir
Tu trouves dedans un nouveau dossier ainsi qu'un fichier MSNFix.bat.
Double-clique sur MSNFix.bat
Une fenêtre sur fond bleu va s'ouvrir avec un menu.
Tape sur la touche R du clavier puis la touche Entrée pour valider
Si une infection est détectée, le message Infection Présente s'affichera.
Pour lancer le nettoyage, il suffit d'appuyer sur n'importe quelle lettre du clavier puis valider par Entrée.
Le nettoyage peut prendre quelques minutes...
Une fois le nettoyage terminé, le rapport de nettoyage s'ouve sur le Bloc-Note.
Deux scénarios possibles :
Soit MSNFix parvient à supprimer l'infection, le rapport s'ouvre.
Soit MSNFix ne parvient pas à supprimer l'infection et tu obtiens la fenêtre sous fond rouge.
Dans ce cas, tu dois redémarrer l'ordinateur ( Démarrer / Arreter / Redémarrer l'ordinateur).
MSNFix va alors se relancer au démarrage AVANT le bureau .
MSNFix va nettoyer l'ordinateur, le rapport va s'ouvrir avec le Bureau.
Une fois le nettoyage terminé, le rapport de nettoyage s'ouve sur le Bloc-Note.
Sous Vista, réactiver l'UAC (*)
(*)
Pour désactiver/activer l'UAC.
Panneau de configuration / Comptes d'utilisateurs
Dans Comptes d'utilisateurs, clique sur l'option "Activer ou désactiver le contrôle des comptes d'utilisateurs"
Décoche l'option "Utiliser le contrôle des comptes d'utilisateurs pour vous aider à protéger le système"
Une popup s'ouvre alors pour te demander de redémarrer l'ordinateur, clique sur "Redémarrer maintenant"
Pour réactiver l'UAC, il suffit de recochez l'option "Utiliser le contrôle des comptes ..."
Acabi, Acaba .... -
Là je suis un peu coincé, mais je regarde en début d'aprème ... et je te dirai !
Sinon, c'est exactement ce dont j'avais besoin ;-) !!!
@+. -
Hi !
My mistake ! Je ne t'avais pas donné le lien de téléchargement de HiJackThis (HJT) ...
En fait, je pensais que tu l'avais déjà ...
Le voici :
HijackThis : https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html
@+.-
Je l'ai fait en mode normal, j'espère que ça joue...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:17, on 27.03.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\apvxdwin.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/de-ch?cobrand=hp.msn.com&ocid=HPDHP&pc=HPDTDF&checklang=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/de-ch?cobrand=hp.msn.com&ocid=HPDHP&pc=HPDTDF&checklang=1
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrvx86.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
O23 - Service: Panda PSK service (PskSvcRetail) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PskSvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
-
-
Hello !
J'ai dû me déconnecter hier soir ... désolé !
Quand tu lances HJT, tu dois choisir "scan and save a log file".
Une fois fini, le log s'ouvre et tu peux faire un copier/coller ...
@+. -
J'ai suivi toutes les instructions mais le problème c'est que je n'ai pas trouvé où est le rapport HJT...
-
Ok !
@+.
PS : je vouvoyais mes parents, mais sur un forum, il est de bon ton de se tutoyer ... Sois mignonne ;-) !!!-
-
AH NON C'EST BON J'AI TROUVE!! Désolée..
--- Spybot - Search & Destroy version: 1.5.2 (build: 20080128) ---
2008-01-28 blindman.exe (1.0.0.7)
2008-01-28 SDDelFile.exe (1.0.2.4)
2008-01-28 SDMain.exe (1.0.0.5)
2007-10-07 SDShred.exe (1.0.1.2)
2008-01-28 SDUpdate.exe (1.0.8.8)
2008-01-28 SDWinSec.exe (1.0.0.11)
2008-01-28 SpybotSD.exe (1.5.2.20)
2008-01-28 TeaTimer.exe (1.5.2.16)
2008-03-26 unins000.exe (51.49.0.0)
2008-01-28 Update.exe (1.4.0.6)
2008-01-28 advcheck.dll (1.5.4.5)
2007-04-02 aports.dll (2.1.0.0)
2007-11-17 DelZip179.dll (1.79.7.4)
2008-01-28 SDFiles.dll (1.5.1.19)
2008-01-28 SDHelper.dll (1.5.0.11)
2008-01-28 Tools.dll (2.1.3.3)
2008-03-26 Includes\Cookies.sbi
2007-12-26 Includes\Dialer.sbi
2008-03-26 Includes\DialerC.sbi
2008-03-26 Includes\HeavyDuty.sbi
2008-03-19 Includes\Hijackers.sbi
2008-03-26 Includes\HijackersC.sbi
2008-02-27 Includes\Keyloggers.sbi
2008-03-26 Includes\KeyloggersC.sbi
2004-11-29 Includes\LSP.sbi
2008-03-26 Includes\Malware.sbi
2008-03-26 Includes\MalwareC.sbi
2008-03-26 Includes\PUPS.sbi
2008-03-26 Includes\PUPSC.sbi
2008-03-26 Includes\Revision.sbi
2008-01-09 Includes\Security.sbi
2008-03-26 Includes\SecurityC.sbi
2008-03-19 Includes\Spybots.sbi
2008-03-26 Includes\SpybotsC.sbi
2007-11-06 Includes\Tracks.uti
2008-03-19 Includes\Trojans.sbi
2008-03-26 Includes\TrojansC.sbi
2007-12-24 Plugins\TCPIPAddress.dll
--- System information ---
Windows Vista (Build: 6000) (6.0.6000)
--- Startup entries list ---
Located: HK_LM:Run, Adobe Reader Speed Launcher
command: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
file: C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
size: 39792
MD5: 8B9145D229D4E89D15ACB820D4A3A90F
Located: HK_LM:Run, APVXDWIN
command: "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
file: C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE
size: 406832
MD5: 37053D331B235EFCB6288D50D5C68F7E
Located: HK_LM:Run, HP Health Check Scheduler
command: [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
file:
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: HK_LM:Run, HP Software Update
command: C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
file: C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
size: 49152
MD5: 821F73B833C4DAEBC33C1A9A4B16BB5A
Located: HK_LM:Run, hpWirelessAssistant
command: C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
file: C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
size: 480560
MD5: CB4EE42EE2D33A58EFD48C276B683663
Located: HK_LM:Run, iTunesHelper
command: "C:\Program Files\iTunes\iTunesHelper.exe"
file: C:\Program Files\iTunes\iTunesHelper.exe
size: 267048
MD5: 6F6493A929BC9B5762035940E825B840
Located: HK_LM:Run, NvCplDaemon
command: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
file:
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: HK_LM:Run, NvMediaCenter
command: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
file:
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: HK_LM:Run, NvSvc
command: RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
file:
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: HK_LM:Run, OnScreenDisplay
command: C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
file: C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
size: 554320
MD5: 2CF59B201A59D0FF5534089F76297559
Located: HK_LM:Run, QlbCtrl
command: %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
file: C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
size: 202032
MD5: AEF50C71530B415AFA40E1D478BEFCCC
Located: HK_LM:Run, QPService
command: "C:\Program Files\HP\QuickPlay\QPService.exe"
file: C:\Program Files\HP\QuickPlay\QPService.exe
size: 181544
MD5: CF41C54529021D0E393BD149FEE4F03E
Located: HK_LM:Run, QuickTime Task
command: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
file: C:\Program Files\QuickTime\QTTask.exe
size: 385024
MD5: BAFCF6CF19CE4882039C52DFA17BE35F
Located: HK_LM:Run, SCANINICIO
command: "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
file: C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe
size: 27952
MD5: A2F512BF50F8F24A20D70DB728DDD4EB
Located: HK_LM:Run, SunJavaUpdateSched
command: "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
file: C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
size: 132496
MD5: 896E712A34D654A337C8CBB9DEB07200
Located: HK_LM:Run, SynTPStart
command: C:\Program Files\Synaptics\SynTP\SynTPStart.exe
file: C:\Program Files\Synaptics\SynTP\SynTPStart.exe
size: 102400
MD5: A3418E4D4A5EE636D44922DC2567FA18
Located: HK_LM:Run, UCam_Menu
command: "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
file: C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
size: 218408
MD5: D2A93F854393C7D3BA09893F1EA264CD
Located: HK_LM:Run, WAWifiMessage
command: C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
file: C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
size: 311296
MD5: B8AF02700299CD308046BB9339165813
Located: HK_CU:Run, ehTray.exe
where: S-1-5-21-1015096557-424188607-327308600-1000...
command: C:\Windows\ehome\ehTray.exe
file: C:\Windows\ehome\ehTray.exe
size: 125440
MD5: 2E0953919779A44BF9DFB7B07C58535A
Located: HK_CU:Run, LightScribe Control Panel
where: S-1-5-21-1015096557-424188607-327308600-1000...
command: C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
file: C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
size: 455968
MD5: 3C62EAE05B76BA809FA1DE327922E846
Located: HK_CU:Run, MsnMsgr
where: S-1-5-21-1015096557-424188607-327308600-1000...
command: "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
file: C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
size: 5724184
MD5: 97384875B6D03831B2D1820AB8952F67
Located: HK_CU:Run, Sidebar
where: S-1-5-21-1015096557-424188607-327308600-1000...
command: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
file: C:\Program Files\Windows Sidebar\sidebar.exe
size: 1232896
MD5: 582F3A0BA61D8F0D50C66B592808B6D6
Located: HK_CU:Run, SpybotSD TeaTimer
where: S-1-5-21-1015096557-424188607-327308600-1000...
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 2097488
MD5: A9A5DB6AC3721BE698B996913693D73F
Located: HK_CU:Run, swg
where: S-1-5-21-1015096557-424188607-327308600-1000...
command: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
file: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
size: 68856
MD5: E616A6A6E91B0A86F2F6217CDE835FFE
Located: HK_CU:Run, Veoh
where: S-1-5-21-1015096557-424188607-327308600-1000...
command: "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
file: C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
size: 3537968
MD5: E1EAF067647143B731C9E5BAB4844FCC
Located: Démarrage (tous utilisateurs), Outil de mise à jour Google.lnk
where: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup...
command: C:\Program Files\Google\Google Updater\GoogleUpdater.exe
file: C:\Program Files\Google\Google Updater\GoogleUpdater.exe
size: 125624
MD5: 785478C1E612CDC7D2117A14C2304EBF
Located: WinLogon, avldr
command: avldr.dll
file: avldr.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
--- Browser helper object list ---
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: Aide pour le lien d'Adobe PDF Reader
description: Adobe Acrobat reader
classification: Legitimate
known filename: AcroIEhelper.ocx<br>AcroIEhelper.dll
info link: https://get2.adobe.com/reader/otherversions/
info source: TonyKlein
Path: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\
Long name: AcroIEHelper.dll
Short name: ACROIE~1.DLL
Date (created): 22.10.2006 23:08:42
Date (last access): 02.03.2008 16:11:14
Date (last write): 22.10.2006 23:08:42
Filesize: 62080
Attributes: archive
MD5: C11F6A1F61481E24BE3FDC06EA6F7D2A
CRC32: E388508F
Version: 8.0.0.456
{53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: Spybot-S&D IE Protection
description: Spybot-S&D IE Browser plugin
classification: Legitimate
known filename: SDhelper.dll
info link: http://spybot.eon.net.au/
info source: Patrick M. Kolla
Path: C:\Program Files\Spybot - Search & Destroy\
Long name: SDHelper.dll
Short name:
Date (created): 26.03.2008 22:00:00
Date (last access): 26.03.2008 22:00:00
Date (last write): 28.01.2008 11:43:28
Filesize: 1554256
Attributes: archive
MD5: 5248E02EFBCB64D328647CD00E384B85
CRC32: C1B426A9
Version: 1.5.0.11
{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} (NCO 2.0 IE BHO)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name: NCO 2.0 IE BHO
CLSID name:
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: SSVHelper Class
Path: C:\Program Files\Java\jre1.6.0_02\bin\
Long name: ssv.dll
Short name:
Date (created): 21.11.2007 07:59:18
Date (last access): 21.12.2007 08:08:00
Date (last write): 12.07.2007 04:00:36
Filesize: 501136
Attributes: archive
MD5: D6137540BDF0F9F9B9055C60ADD8007A
CRC32: 29E910AF
Version: 6.0.20.6
{7E853D72-626A-48EC-A868-BA8D5E23E045} ()
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name:
{9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: Programme d'aide de l'Assistant de connexion Windows Live
Path: C:\Program Files\Common Files\Microsoft Shared\Windows Live\
Long name: WindowsLiveLogin.dll
Short name: WINDOW~1.DLL
Date (created): 20.09.2007 10:30:18
Date (last access): 02.03.2008 00:43:28
Date (last write): 20.09.2007 10:30:18
Filesize: 328752
Attributes: archive
MD5: 59CF5BF6684AFCF906CADAD39B4214DE
CRC32: C363813C
Version: 4.200.520.1
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: Google Toolbar Notifier BHO
Path: C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\
Long name: swg.dll
Short name:
Date (created): 02.03.2008 22:02:08
Date (last access): 02.03.2008 22:02:08
Date (last write): 02.03.2008 22:02:08
Filesize: 654320
Attributes: archive
MD5: 72D6804DC43CC0CF4F10E699D7738138
CRC32: ABF4BA3E
Version: 2.1.1119.1736
--- ActiveX list ---
{5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control)
DPF name:
CLSID name: Facebook Photo Uploader 4 Control
Installer: C:\Windows\Downloaded Program Files\ImageUploader4.inf
Codebase: http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
Path: C:\Windows\Downloaded Program Files\
Long name: ImageUploader4.ocx
Short name: IMAGEU~1.OCX
Date (created): 31.01.2008 21:23:56
Date (last access): 31.01.2008 21:23:56
Date (last write): 31.01.2008 21:23:56
Filesize: 2666496
Attributes: archive
MD5: D73F4328A8AA5C480F5A6FB7E0D6DE55
CRC32: F2537A61
Version: 4.5.57.1
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control)
DPF name:
CLSID name: BDSCANONLINE Control
Installer: C:\Windows\Downloaded Program Files\oscan8.inf
Codebase: http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
Path: C:\Windows\DOWNLO~1\
Long name: oscan8.ocx
Short name:
Date (created): 25.10.2007 16:54:18
Date (last access): 25.10.2007 16:54:18
Date (last write): 25.10.2007 16:54:18
Filesize: 471040
Attributes: archive
MD5: BC4E154A06C9208EF36669B1B9E5FDAD
CRC32: DF08A08D
Version: 1.0.0.1
{74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control)
DPF name:
CLSID name: HouseCall Control
Installer: C:\Windows\Downloaded Program Files\xscan.inf
Codebase: https://www.trendmicro.com/en_us/forHome/products/housecall.html
description: Trend Micro Antivirus online scanner
classification: Legitimate
known filename: XSCAN53.OCX
info link:
info source: Patrick M. Kolla
Path: C:\Windows\DOWNLO~1\
Long name: xscan53.ocx
Short name:
Date (created): 02.11.2005 18:07:08
Date (last access): 02.11.2005 18:07:08
Date (last write): 02.11.2005 18:07:08
Filesize: 435712
Attributes: archive
MD5: BEC3AAB1D47A4DC26D7A7C4C5CAE3304
CRC32: D7C39B20
Version: 5.70.0.1090
{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_02
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
description: Sun Java
classification: Legitimate
known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll
info link:
info source: Patrick M. Kolla
Path: C:\Program Files\Java\jre1.6.0_02\bin\
Long name: npjpi160_02.dll
Short name: NPJPI1~1.DLL
Date (created): 12.07.2007 02:22:38
Date (last access): 21.12.2007 08:08:00
Date (last write): 12.07.2007 04:00:36
Filesize: 132496
Attributes: archive
MD5: E3811F1A1C5063C941EC0E2766C3EA39
CRC32: AEFD3747
Version: 6.0.20.6
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} ()
DPF name:
CLSID name:
Installer: C:\Windows\Downloaded Program Files\erma.inf
Codebase: http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_02
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
Path: C:\Program Files\Java\jre1.6.0_02\bin\
Long name: ssv.dll
Short name:
Date (created): 21.11.2007 07:59:18
Date (last access): 21.12.2007 08:08:00
Date (last write): 12.07.2007 04:00:36
Filesize: 501136
Attributes: archive
MD5: D6137540BDF0F9F9B9055C60ADD8007A
CRC32: 29E910AF
Version: 6.0.20.6
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_02
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
Path: C:\Program Files\Java\jre1.6.0_02\bin\
Long name: npjpi160_02.dll
Short name: NPJPI1~1.DLL
Date (created): 12.07.2007 02:22:38
Date (last access): 21.12.2007 08:08:00
Date (last write): 12.07.2007 04:00:36
Filesize: 132496
Attributes: archive
MD5: E3811F1A1C5063C941EC0E2766C3EA39
CRC32: AEFD3747
Version: 6.0.20.6
--- Process list ---
PID: 1484 (1544) C:\Windows\system32\Dwm.exe
size: 83456
MD5: E87B968F3D49117445893EB0503FE34F
PID: 360 ( 564) C:\Windows\Explorer.EXE
size: 2923520
MD5: 6D06CD98D954FE87FB2DB8108793B399
PID: 2208 ( 360) C:\Program Files\Synaptics\SynTP\SynTPStart.exe
size: 102400
MD5: A3418E4D4A5EE636D44922DC2567FA18
PID: 2316 ( 360) C:\Program Files\HP\QuickPlay\QPService.exe
size: 181544
MD5: CF41C54529021D0E393BD149FEE4F03E
PID: 3244 ( 360) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
size: 202032
MD5: AEF50C71530B415AFA40E1D478BEFCCC
PID: 3908 ( 360) C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
size: 554320
MD5: 2CF59B201A59D0FF5534089F76297559
PID: 2504 ( 360) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
size: 480560
MD5: CB4EE42EE2D33A58EFD48C276B683663
PID: 3116 ( 360) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
size: 311296
MD5: B8AF02700299CD308046BB9339165813
PID: 3664 ( 360) C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
size: 132496
MD5: 896E712A34D654A337C8CBB9DEB07200
PID: 2172 ( 360) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
size: 49152
MD5: 821F73B833C4DAEBC33C1A9A4B16BB5A
PID: 3808 ( 360) C:\Program Files\Panda Security\Panda Internet Security 2008\apvxdwin.exe
size: 406832
MD5: 37053D331B235EFCB6288D50D5C68F7E
PID: 3680 ( 360) C:\Program Files\iTunes\iTunesHelper.exe
size: 267048
MD5: 6F6493A929BC9B5762035940E825B840
PID: 3340 ( 360) C:\Windows\System32\rundll32.exe
size: 44544
MD5: 4B555106290BD117334E9A08761C035A
PID: 3924 (3768) C:\Windows\System32\rundll32.exe
size: 44544
MD5: 4B555106290BD117334E9A08761C035A
PID: 2952 ( 360) C:\Program Files\Windows Sidebar\sidebar.exe
size: 1232896
MD5: 582F3A0BA61D8F0D50C66B592808B6D6
PID: 848 ( 360) C:\Program Files\Windows Live\Messenger\msnmsgr.exe
size: 5724184
MD5: 97384875B6D03831B2D1820AB8952F67
PID: 2624 ( 360) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
size: 455968
MD5: 3C62EAE05B76BA809FA1DE327922E846
PID: 3372 ( 360) C:\Windows\ehome\ehtray.exe
size: 125440
MD5: 2E0953919779A44BF9DFB7B07C58535A
PID: 3416 ( 876) C:\Windows\ehome\ehmsas.exe
size: 37376
MD5: 693E4C15CEE5D6487D7913A2701B5E40
PID: 2268 ( 360) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 2097488
MD5: A9A5DB6AC3721BE698B996913693D73F
PID: 3564 ( 360) C:\Program Files\Google\Google Updater\GoogleUpdater.exe
size: 125624
MD5: 785478C1E612CDC7D2117A14C2304EBF
PID: 6084 (1984) C:\Windows\system32\taskeng.exe
size: 166400
MD5: 1226E9FAE5B8508801EC974E3C9D9C14
PID: 5056 ( 876) C:\Windows\System32\mobsync.exe
size: 95232
MD5: 9C632DC0F1B6D79B05F46A4A5349CEF4
PID: 2276 (3808) C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE
size: 91440
MD5: 9634F93772BDF6D35734B58200345462
PID: 4296 ( 876) C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
size: 677432
MD5: 3B161E0C1D8F3253640D57B45FAC96DA
PID: 5528 (3808) C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
size: 83504
MD5: BF9F2049499D3E2D2B5CC19086A1A627
PID: 4664 (5536) C:\Program Files\Internet Explorer\IEUser.exe
size: 301568
MD5: 7906D40BA8A6C8AC1586B1EF549319BA
PID: 5332 (3988) C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
size: 111920
MD5: 37F6CA78B4EC02DAC2E06A45E7A2DE77
PID: 2944 ( 876) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
size: 118336
MD5: 7FA0AA2F3DABA5BEB2C4AC1EEC054EFA
PID: 5228 (4664) C:\Program Files\Internet Explorer\iexplore.exe
size: 625664
MD5: 9143C721DD6482374EFB35BC35944324
PID: 3368 (2268) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
size: 5146448
MD5: 2ECA8CDEED7C82F879E766DA92A3561A
PID: 0 ( 0) [System Process]
PID: 4 ( 0) System
PID: 544 ( 4) smss.exe
size: 62976
PID: 620 ( 608) csrss.exe
size: 7680
PID: 672 ( 608) wininit.exe
size: 95744
PID: 680 ( 664) csrss.exe
size: 7680
PID: 720 ( 672) services.exe
size: 279552
PID: 732 ( 672) lsass.exe
size: 7680
PID: 740 ( 672) lsm.exe
size: 210944
PID: 876 ( 720) svchost.exe
size: 22016
PID: 932 ( 720) svchost.exe
size: 22016
PID: 964 ( 720) svchost.exe
size: 22016
PID: 1032 ( 664) winlogon.exe
size: 308224
PID: 1040 ( 720) svchost.exe
size: 22016
PID: 1092 ( 720) psksvc.exe
PID: 1136 ( 720) pavsrvx86.exe
PID: 1188 (1136) AVENGINE.EXE
PID: 1376 ( 720) TPSrv.exe
PID: 1408 ( 720) svchost.exe
size: 22016
PID: 1544 ( 720) svchost.exe
size: 22016
PID: 1984 ( 720) svchost.exe
size: 22016
PID: 1572 (1408) audiodg.exe
size: 88064
PID: 1968 ( 720) SLsvc.exe
size: 2605568
PID: 1764 ( 720) svchost.exe
size: 22016
PID: 1596 ( 720) spoolsv.exe
size: 124928
PID: 396 ( 720) svchost.exe
size: 22016
PID: 1080 ( 720) AppleMobileDeviceService.exe
PID: 3688 ( 720) mDNSResponder.exe
PID: 2848 ( 720) GoogleUpdaterService.exe
PID: 2284 ( 720) LSSrvc.exe
PID: 3988 ( 720) PsCtrlS.exe
PID: 2992 ( 720) PAVFNSVR.EXE
PID: 3752 ( 720) PavPrSrv.exe
PID: 2800 ( 720) pskmssvc.exe
PID: 3384 ( 720) svchost.exe
size: 22016
PID: 1280 ( 720) PSHost.exe
PID: 3588 ( 720) PsImSvc.exe
PID: 3652 ( 720) QPCapSvc.exe
PID: 3764 ( 720) RichVideo.exe
PID: 2372 ( 720) svchost.exe
size: 22016
PID: 592 ( 720) svchost.exe
size: 22016
PID: 2352 ( 720) SearchIndexer.exe
size: 287744
PID: 2660 ( 720) XAudio.exe
PID: 564 ( 720) hpqWmiEx.exe
PID: 3500 ( 720) SDWinSec.exe
size: 810320
MD5: A0C00A6265949AC72AB51B711743CA6D
PID: 4536 ( 720) QPSched.exe
PID: 5728 ( 720) iPodService.exe
PID: 5920 (1984) taskeng.exe
size: 166400
PID: 4440 ( 876) WmiPrvSE.exe
PID: 5496 (2208) SynTPEnh.exe
PID: 4100 ( 720) usnsvc.exe
PID: 5860 ( 720) HPHC_Service.exe
PID: 2160 (1984) taskeng.exe
size: 166400
PID: 2844 (1984) taskeng.exe
size: 166400
PID: 4008 (5920) lpremove.exe
size: 23552
PID: 4380 (4008) lpksetup.exe
size: 166912
PID: 4104 ( 720) TrustedInstaller.exe
--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 26.03.2008 22:49:36
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\Windows\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
https://www.google.ch/?gws_rd=ssl
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
%SystemRoot%\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
https://www.msn.com/de-ch?cobrand=hp.msn.com&ocid=HPDHP&pc=HPDTDF&checklang=1
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
https://www.msn.com/de-ch?cobrand=hp.msn.com&ocid=HPDHP&pc=HPDTDF&checklang=1
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
--- Winsock Layered Service Provider list ---
Protocol 0: MSAFD Tcpip [TCP/IP]
GUID: {273EC4A3-AD56-42B8-946C-B1CA3CEAC5B4}
Filename: C:\Program Files\Panda Security\Panda Internet Security 2008\pavlsp.dll
Protocol 1: MSAFD Tcpip [UDP/IP]
GUID: {273EC4A3-AD56-42B8-946C-B1CA3CEAC5B4}
Filename: C:\Program Files\Panda Security\Panda Internet Security 2008\pavlsp.dll
Protocol 2: MSAFD Tcpip [RAW/IP]
GUID: {273EC4A3-AD56-42B8-946C-B1CA3CEAC5B4}
Filename: C:\Program Files\Panda Security\Panda Internet Security 2008\pavlsp.dll
Protocol 3: MSAFD Tcpip [TCP/IPv6]
GUID: {273EC4A3-AD56-42B8-946C-B1CA3CEAC5B4}
Filename: C:\Program Files\Panda Security\Panda Internet Security 2008\pavlsp.dll
Protocol 4: MSAFD Tcpip [UDP/IPv6]
GUID: {273EC4A3-AD56-42B8-946C-B1CA3CEAC5B4}
Filename: C:\Program Files\Panda Security\Panda Internet Security 2008\pavlsp.dll
Protocol 5: MSAFD Tcpip [RAW/IPv6]
GUID: {273EC4A3-AD56-42B8-946C-B1CA3CEAC5B4}
Filename: C:\Program Files\Panda Security\Panda Internet Security 2008\pavlsp.dll
Protocol 6: Fournisseur de services RSVP TCPv6
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 7: Fournisseur de services RSVP TCP
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 8: Fournisseur de services RSVP UDPv6
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 9: Fournisseur de services RSVP UDP
GUID: {F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IPv6 protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 10: @%SystemRoot%\System32\wship6.dll,-60101
GUID: {F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IPv6 protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 11: @%SystemRoot%\System32\wship6.dll,-60102
GUID: {F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IPv6 protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 12: @%SystemRoot%\System32\wshqos.dll,-100
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 13: @%SystemRoot%\System32\wshqos.dll,-101
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 14: @%SystemRoot%\System32\wshqos.dll,-102
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 15: @%SystemRoot%\System32\wshqos.dll,-103
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 16: MSAFD NetBIOS [\Device\NetBT_Tcpip_{9E08D156-7516-42D1-AB08-385BB9B41836}] SEQPACKET 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 17: MSAFD NetBIOS [\Device\NetBT_Tcpip_{9E08D156-7516-42D1-AB08-385BB9B41836}] DATAGRAM 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 18: MSAFD NetBIOS [\Device\NetBT_Tcpip_{705E4700-FE80-44B4-A09D-6E425F22DE52}] SEQPACKET 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 19: MSAFD NetBIOS [\Device\NetBT_Tcpip_{705E4700-FE80-44B4-A09D-6E425F22DE52}] DATAGRAM 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 20: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{9E08D156-7516-42D1-AB08-385BB9B41836}] SEQPACKET 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 21: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{9E08D156-7516-42D1-AB08-385BB9B41836}] DATAGRAM 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 22: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{705E4700-FE80-44B4-A09D-6E425F22DE52}] SEQPACKET 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 23: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{705E4700-FE80-44B4-A09D-6E425F22DE52}] DATAGRAM 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 24: PAV_LAYERED
GUID: {6B320271-E041-22D0-9A38-11BB1164A02D}
Filename: C:\Program Files\Panda Security\Panda Internet Security 2008\pavlsp.dll
Namespace Provider 0: Espace de noms NLAv1 (Network Location Awareness Legacy)
GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}
Filename:
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: NLA-Namespace
Namespace Provider 1: TCP/IP
GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B}
Filename:
Description: Microsoft Windows NT/2k/XP TCP/IP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: TCP/IP
Namespace Provider 2: NTDS
GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC}
Filename: %SystemRoot%\System32\winrnr.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\winrnr.dll
DB protocol: NTDS
Namespace Provider 3: Fournisseur Shim d'affectation de noms de messagerie
GUID: {964ACBA2-B2BC-40EB-8C6A-A6DB40161CAE}
Filename:
Namespace Provider 4: Fournisseur d'espace de noms du nuage PNRP
GUID: {03FE89CE-766D-4976-B9C1-BB9BC42C7B4D}
Filename:
Namespace Provider 5: Fournisseur d'espace de noms du nom PNRP
GUID: {03FE89CD-766D-4976-B9C1-BB9BC42C7B4D}
Filename:
Namespace Provider 6: mdnsNSP
GUID: {B600E6E9-553B-4A19-8696-335E5C896153}
Filename: C:\Program Files\Bonjour\mdnsNSP.dll
Description: Apple Rendezvous protocol
DB filename: %ProgramFiles%\Rendezvous\bin\mdnsNSP.dll
DB protocol: mdnsNSP
-
-
Ok Sabine ...
On commence lentement mais sûrement ...
TOUS les mots sont importants, les étapes à faire dans l'ordre ...
Si tu as la moindre question avant de faire un "truc", demande ! Sinon, c'est trop tard ...
En plus, tu apprendras plein de choses : c'est cool !
PRE-NETTOYAGE DU PC
1 Télécharge et installe
CCleaner : https://www.pcastuces.com/logitheque/ccleaner.htm
Clique sur Options / Avancé et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures".
Ne touche pas aux autres réglages.
SPYBOT Search & Destroy : https://www.safer-networking.org/download/
Tu l'installes.
Lance SPYBOT et clique sur le bouton Mise à jour.
Ne lance pas le scan maintenant. Ferme le programme.
2 Redémarre en mode sans échec.
Démarre l'ordinateur.
Une fois le chargement du BIOS terminé, il y a un écran noir.
Tapote sur la touche F8 jusqu'à l'affichage du menu des options avancées de Windows.
En utilisant les touches du curseur, sélectionne Mode sans échec et appuie sur Entrée.
3 Lance le nettoyage avec CCleaner.
4 Lance SPYBOT
Fais une Analyse complète.
5 Redémarre en mode normal dans ta cession.
6 Poste-moi le rapport HJT.
@+. -
Hi Sabine !
Tu vas rester, ou tu as déjà mis la même question sur 50 sites ? Et du coup, je vais perdre mon temps ?
Olivier.
