Hijackthis

Résolu
alaincamara -  
Bonjour,
j'ai le même problème je N'arrive pas a supprimer les cochonneries de mon pc pouvez vous m'aider dans le processus avec hijackthis ci-joint mon rapport
Configuration: Windows XP
Firefox 2.0.0.13

22 réponses

Résumé de la discussion

Problème de suppression de logiciels indésirables sur un PC Windows XP, examiné à partir d’un rapport HijackThis pour identifier les éléments potentiellement malveillants et les entrées système à corriger. Des solutions essentielles émergent, notamment la suppression/quarantaine de composants suspects, puis le nettoyage des entrées de démarrage et des extensions malveillantes, afin d’éviter les redémarrages et les réinfections. En parallèle, une vérification avec un autre outil antimalware a permis de mettre en quarantaine et supprimer plusieurs menaces détectées dans le registre et les dossiers sensibles. Pour compléter le processus, il peut être utile de vérifier les services non signés et les programmes de démarrage après le nettoyage, puis de sauvegarder le rapport et de planifier une nouvelle analyse.

Bobot (l’IA à votre service)
  2. cedric241
    ok si tu es satisfait de mon intervention et que tu n as plus de question change le statut du sujet en résolu stp
    0
    1. alaincamara Auteur
      merci infiniment cedric241, tout est ok
      0
  3. alaincamara Auteur
    je reviens dans quelques minutes
    0
    1. cedric241
      Maintenant , nous allons supprimer les logiciels de désinfection que je t'ai fait téléchargé.
      En effet , s'en servir est dangereux pour le pc si l'on ne s'y connais pas.
      De plus ils sont mis régulièrement à jours.

      ? Ferme toutes les applications en cours, puis télécharge ToolsCleaner2 sur ton Bureau.

      http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

      ? Double clique sur ToolsCleaner2.exe >
      ? Clique sur .Recherche
      ? puis sur Suppression quand la liste est trouvée.
      ? Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

      (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

      Note : ton bureau RISQUE de disparaître, c'est normal. S'il n'apparaît pas à la fin du scan, fais la manip suivante :

      CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
      Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

      Tape explorer.exe et valide. Cela fera re-apparaître le Bureau

      Tuto : https://www.commentcamarche.net/list 8341 toolscleaner suppression des fix de force brute ( merci espion3004 )
      0
      1. alaincamara Auteur
        -->- Recherche:

        C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
        C:\Documents and Settings\Owner\Bureau\HijackThis.lnk: trouvé !
        C:\Documents and Settings\Owner\Bureau\Clean.zip: trouvé !
        C:\Documents and Settings\Owner\Bureau\BtFix.zip: trouvé !
        C:\Documents and Settings\Owner\Bureau\Navilog1.exe: trouvé !
        C:\Documents and Settings\Owner\Bureau\HJTInstall.exe: trouvé !
        C:\Documents and Settings\Owner\Bureau\Btfix: trouvé !
        C:\Documents and Settings\Owner\Recent\HijackThis.lnk: trouvé !
        C:\Program Files\Navilog1: trouvé !
        C:\Program Files\Navilog1\Navilog1.bat: trouvé !
        C:\Program Files\Trend Micro\HijackThis: trouvé !
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

        ---------------------------------
        -->- Suppression:

        C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
        C:\Documents and Settings\Owner\Bureau\HijackThis.lnk: supprimé !
        C:\Documents and Settings\Owner\Bureau\Clean.zip: supprimé !
        C:\Documents and Settings\Owner\Bureau\BtFix.zip: supprimé !
        C:\Documents and Settings\Owner\Bureau\Navilog1.exe: supprimé !
        C:\Documents and Settings\Owner\Bureau\HJTInstall.exe: supprimé !
        C:\Documents and Settings\Owner\Recent\HijackThis.lnk: supprimé !
        C:\Program Files\Navilog1\Navilog1.bat: supprimé !
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
        C:\Documents and Settings\Owner\Bureau\Btfix: supprimé !
        C:\Program Files\Navilog1: supprimé !
        C:\Program Files\Trend Micro\HijackThis: supprimé !
        0
    3. cedric241
      fais ce qui est expliqué au post 33 stp
      0
      1. alaincamara Auteur
        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 17:27:28, on 2008-04-08
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Unable to get Internet Explorer version!
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
        C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
        C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
        C:\WINDOWS\eHome\ehRecvr.exe
        C:\WINDOWS\eHome\ehSched.exe
        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\dllhost.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\ehome\ehtray.exe
        C:\WINDOWS\SOUNDMAN.EXE
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\eHome\ehmsas.exe
        C:\WINDOWS\system32\RUNDLL32.EXE
        C:\Program Files\Digital Media Reader\readericon45G.exe
        C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
        C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
        C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
        C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
        C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
        c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\DAEMON Tools\daemon.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
        C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
        C:\Program Files\Skype\Phone\Skype.exe
        C:\Program Files\eMule\emule.exe
        C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
        C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
        C:\Program Files\BigFix\BigFix.exe
        C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
        C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
        C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\Google\Google Updater\GoogleUpdater.exe
        C:\Program Files\Skype\Plugin Manager\skypePM.exe
        C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
        C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
        C:\WINDOWS\system32\taskmgr.exe

        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
        O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
        O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
        O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
        O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
        O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
        O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
        O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
        O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
        O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
        O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
        O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
        O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [FreeCall] "C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe" -nosplash -minimized
        O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
        O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
        O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
        O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
        O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
        O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
        O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
        O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
        O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
        O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
        O9 - Extra button: Antivirus de la Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O18 - Protocol: intu-ir2007 - {52BAEC6B-9405-46F9-A131-6D50720A3CC4} - C:\Program Files\ImpotRapide 2007\ic2007pp.dll
        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
        O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
        O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
        O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
        O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
        O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
        O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
        O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
        O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
        O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
        O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe (file missing)
        0
    5. cedric241
      supprime ces lignes :

      O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - (no file)

      O4 - HKCU\..\Run: [WinButler] C:\Documents and Settings\Owner\Application Data\WinButler\WinButler.exe

      O4 - HKLM\..\Policies\Explorer\Run: [rare] C:\Program Files\Video Access ActiveX Object\pmsnrr.exe
      O4 - HKLM\..\Run: [gvmhivqb] rundll32.exe "C:\Program Files\gvmhivqb\cfcbmbep.dll",Init

      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

      pour les supprimer tu les coches ensuite tu clic sur fix checked

      apres refais un scan et poste le nouveau rapport
      0
      1. cedric241
        maintenant refais un scan hijackthis et poste moi le rapport
        0
        1. alaincamara Auteur
          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 17:10:10, on 2008-04-08
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Unable to get Internet Explorer version!
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
          C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
          C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
          C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
          C:\Program Files\Bonjour\mDNSResponder.exe
          C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
          C:\WINDOWS\eHome\ehRecvr.exe
          C:\WINDOWS\eHome\ehSched.exe
          C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
          C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\dllhost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\ehome\ehtray.exe
          C:\WINDOWS\SOUNDMAN.EXE
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\eHome\ehmsas.exe
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\Program Files\Digital Media Reader\readericon45G.exe
          C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
          C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
          C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
          C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
          C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
          C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
          c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
          C:\WINDOWS\system32\wuauclt.exe
          C:\Program Files\DAEMON Tools\daemon.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
          C:\Program Files\Skype\Phone\Skype.exe
          C:\Program Files\eMule\emule.exe
          C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
          C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
          C:\Program Files\BigFix\BigFix.exe
          C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
          C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
          C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
          C:\Program Files\iPod\bin\iPodService.exe
          C:\Program Files\Google\Google Updater\GoogleUpdater.exe
          C:\Program Files\Skype\Plugin Manager\skypePM.exe
          C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
          C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
          C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
          C:\PROGRA~1\Mozilla Firefox\firefox.exe
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - (no file)
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
          O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
          O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
          O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
          O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
          O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
          O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
          O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
          O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
          O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
          O4 - HKLM\..\Run: [gvmhivqb] rundll32.exe "C:\Program Files\gvmhivqb\cfcbmbep.dll",Init
          O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
          O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [FreeCall] "C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe" -nosplash -minimized
          O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
          O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
          O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
          O4 - HKCU\..\Run: [WinButler] C:\Documents and Settings\Owner\Application Data\WinButler\WinButler.exe
          O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
          O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
          O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
          O4 - HKLM\..\Policies\Explorer\Run: [rare] C:\Program Files\Video Access ActiveX Object\pmsnrr.exe
          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
          O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
          O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
          O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
          O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O9 - Extra button: Antivirus de la Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O18 - Protocol: intu-ir2007 - {52BAEC6B-9405-46F9-A131-6D50720A3CC4} - C:\Program Files\ImpotRapide 2007\ic2007pp.dll
          O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
          O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
          O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
          O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
          O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
          O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
          O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
          O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
          O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
          O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
          O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
          O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
          O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
          O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
          O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
          O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
          O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
          O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
          O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
          O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
          O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
          O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe (file missing)
          0
      2. cedric241
        ok réouvre navilog et passe l option 2
        0
        1. alaincamara Auteur
          Clean Navipromo version 3.5.2 commencé le 2008-04-08 à 16:42:19,18

          Outil exécuté depuis C:\Program Files\navilog1
          Session actuelle : "Owner"

          Mise à jour le 29.03.2008 à 22h00 par IL-MAFIOSO

          Microsoft Windows XP [version 5.1.2600]
          Internet Explorer : 6.0.2900.2180
          Système de fichiers : NTFS

          Mode suppression automatique
          avec prise en charge résultats Catchme et GNS

          *** fsbl1.txt non trouvé ***
          (Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)

          *** Suppression avec sauvegardes résultats GenericNaviSearch ***

          * Suppression dans C:\WINDOWS\System32 *

          * Suppression dans "C:\Documents and Settings\Owner\locals~1\applic~1" *

          * Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

          * Suppression dans "C:\DOCUME~1\famille\locals~1\applic~1" *

          *** Suppression dossiers dans C:\WINDOWS ***

          *** Suppression dossiers dans C:\Program Files ***

          *** Suppression dossiers dans C:\DOCUME~1\ALLUSE~1\APPLIC~1 ***

          *** Suppression dossiers dans "C:\Documents and Settings\Owner\applic~1" ***

          *** Suppression dossiers dans "C:\Documents and Settings\Owner\locals~1\applic~1" ***

          *** Suppression dossiers dans "C:\Documents and Settings\Owner\menudm~1\progra~1" ***

          *** Suppression dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***

          *** Suppression fichiers ***

          *** Suppression fichiers temporaires ***

          Nettoyage contenu C:\WINDOWS\Temp effectué !
          Nettoyage contenu C:\Documents and Settings\Owner\locals~1\Temp effectué !

          *** Traitement Recherche complémentaire ***
          (Recherche fichiers spécifiques)

          1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

          2)Recherche, création sauvegardes et suppression Heuristique :

          * Dans C:\WINDOWS\system32 *

          * Dans "C:\Documents and Settings\Owner\locals~1\applic~1" *

          * Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

          * Dans "C:\DOCUME~1\famille\locals~1\applic~1" *

          gppjrrlttn.dat trouvé !
          Copie gppjrrlttn.dat réalisée avec succès !
          gppjrrlttn.dat supprimé !

          gppjrrlttn_nav.dat trouvé !
          Copie gppjrrlttn_nav.dat réalisée avec succès !
          gppjrrlttn_nav.dat supprimé !

          gppjrrlttn_navps.dat trouvé !
          Copie gppjrrlttn_navps.dat réalisée avec succès !
          gppjrrlttn_navps.dat supprimé !

          *** Sauvegarde du Registre vers dossier Safebackup ***

          sauvegarde du Registre réalisée avec succès !

          *** Nettoyage Registre ***

          Nettoyage Registre Ok

          *** Certificats ***

          Certificat Egroup absent !
          Certificat Electronic-Group absent !
          Certificat OOO-Favorit absent !
          Certificat Sunny-Day-Design-Ltdt absent !

          *** Nettoyage terminé le 2008-04-08 à 16:56:56,51 ***
          0
      3. cedric241
        Pour clean as tu passsé l option 2 ??

        pour navilog réouvre le et passe a l option 2
        0
        1. cedric241
          pour clean réouvre le et passe l option 2

          ensuite fais ca qui est expliqué au post 23
          0
          1. alaincamara Auteur
            pport clean par Malekal_morte - http://www.malekal.com
            Script execute en mode sans echec 2008-04-08 a 16:29:10,34

            Microsoft Windows XP [version 5.1.2600]

            *** Suppression des fichiers dans C:

            *** Suppression des fichiers dans C:\WINDOWS\

            *** Suppression des fichiers dans C:\WINDOWS\system32
            tentative de suppression de C:\WINDOWS\system32\SpoonUninstall.exe
            tentative de suppression de "C:\Documents and Settings\Owner\Application Data\ezpinst.exe"

            *** Suppression des fichiers dans C:\Program Files

            *** Suppression des clefs du registre effectuee..
            *** Fin du rapport !
            0
        2. cedric241
          Préalable
          • Vider la corbeille
          • Fermer toutes les applications

          ================NAVILOG====================

          Télécharge ceci http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

          Ensuite suit ce tutorial : http://mickael.barroux.free.fr/securite/navilog.php

          Et enfin post le rapport du scan navilog
          0
          1. alaincamara Auteur
            Search Navipromo version 3.5.2 commencé le 2008-04-08 à 15:57:00,71

            !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
            !!! Postez ce rapport sur le forum pour le faire analyser !!!
            !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

            Outil exécuté depuis C:\Program Files\navilog1
            Session actuelle : "Owner"

            Mise à jour le 29.03.2008 à 22h00 par IL-MAFIOSO

            Microsoft Windows XP [version 5.1.2600]
            Internet Explorer : 6.0.2900.2180
            Système de fichiers : NTFS

            Executé en mode normal

            *** Recherche Programmes installés ***

            *** Recherche dossiers dans C:\WINDOWS ***

            *** Recherche dossiers dans C:\Program Files ***

            *** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\APPLIC~1 ***

            *** Recherche dossiers dans "C:\Documents and Settings\Owner\applic~1" ***

            *** Recherche dossiers dans "C:\Documents and Settings\Owner\locals~1\applic~1" ***

            *** Recherche dossiers dans "C:\Documents and Settings\Owner\menudm~1\progra~1" ***

            *** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***

            *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
            pour + d'infos : http://www.gmer.net

            Aucun Fichier trouvé

            *** Recherche avec GenericNaviSearch ***
            !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
            !!! A vérifier impérativement avant toute suppression manuelle !!!

            * Recherche dans C:\WINDOWS\system32 *

            * Recherche dans "C:\Documents and Settings\Owner\locals~1\applic~1" *

            * Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

            * Recherche dans "C:\DOCUME~1\famille\locals~1\applic~1" *

            *** Recherche fichiers ***

            *** Recherche clés spécifiques dans le Registre ***

            *** Module de Recherche complémentaire ***
            (Recherche fichiers spécifiques)

            1)Recherche nouveaux fichiers Instant Access :

            2)Recherche Heuristique :

            * Dans C:\WINDOWS\system32 :

            * Dans "C:\Documents and Settings\Owner\locals~1\applic~1" :

            * Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" :

            * Dans "C:\DOCUME~1\famille\locals~1\applic~1" :

            gppjrrlttn.dat trouvé !
            gppjrrlttn_nav.dat trouvé !
            gppjrrlttn_navps.dat trouvé !

            3)Recherche Certificats :

            Certificat Egroup absent !
            Certificat Electronic-Group absent !
            Certificat OOO-Favorit absent !
            Certificat Sunny-Day-Design-Ltd absent !

            4)Recherche fichiers connus :

            *** Analyse terminée le 2008-04-08 à 16:09:28,67 ***
            0
        3. cedric241
          ok fais ça :

          Télécharge Clean:

          -> http://www.malekal.com/download/clean.zip

          -> Dézippe tout le contenu dans un dossier que tu auras cré au préalable (sur ton bureau par exemple). Double clic sur clean ou clean.cmd choisie l'option 1.

          Un rapport va s'ouvrir, copie et colle le contenu sur le forum.

          -> pour ceux ou celles qui auraient un doute sur comment deziper un fichier :

          http://www.tutopat.com/viewtopic.php?t=933&sid=34215b238376bfb22ef9e8eca9995914
          0
          1. alaincamara Auteur
            resultat
            2008-04-08 a 15:43:45,21

            *** Recherche des fichiers dans C:

            *** Recherche des fichiers dans C:\WINDOWS\

            *** Recherche des fichiers dans C:\WINDOWS\system32
            C:\WINDOWS\system32\SpoonUninstall.exe FOUND
            "C:\Documents and Settings\Owner\Application Data\ezpinst.exe" FOUND

            *** Recherche des fichiers dans C:\Program Files
            *** Fin du rapport !
            0
        4. cedric241
          fais ce qui est expliqué au post 17 stp
          0
          1. alaincamara Auteur
            resultat
            BTFix 1.095 (par bibi26) - 08/04/2008 15:31:45 - Nettoyage - Mode normal
            Lancé depuis C:\Documents and Settings\Owner\Bureau\BTFix\BTFix.exe

            ---> Fichiers/dossiers supprimés (Première passe)

            - Fichiers temporaires effacés

            ---> Nettoyage terminé le 08/04/2008 15:36:54
            0
        5. cedric241
          Fais ça

          telecharge et instal btfix sur ce lien :

          https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/40698.html

          puis lance la recherche et supprime

          poste moi le rapport s il te plait
          0
          1. alaincamara Auteur
            c'est ok
            BTFix 1.095 (par bibi26) - 08/04/2008 15:28:41 - Analyse
            Lancé depuis C:\Documents and Settings\Owner\Bureau\BTFix\BTFix.exe

            ---> Fichiers/Dossiers trouvés

            ---> Analyse terminée le 08/04/2008 15:28:42
            0
        6. cedric241
          suit un peut la discussion stp

          fais ce qui est expliqué au post 13

          et met tes réponses les une en dessous des autres ne mélénge pas tout car on va pas s y retrouver apres
          0
          1. alaincamara Auteur
            j'ai fais tout ce qui eMalwarebytes' Anti-Malware 1.11
            Version de la base de données: 599

            Type de recherche: Examen complet (C:\|D:\|)
            Eléments examinés: 222082
            Temps écoulé: 1 hour(s), 58 minute(s), 27 second(s)

            Processus mémoire infecté(s): 0
            Module(s) mémoire infecté(s): 0
            Clé(s) du Registre infectée(s): 17
            Valeur(s) du Registre infectée(s): 7
            Elément(s) de données du Registre infecté(s): 0
            Dossier(s) infecté(s): 8
            Fichier(s) infecté(s): 54

            Processus mémoire infecté(s):
            (Aucun élément nuisible détecté)

            Module(s) mémoire infecté(s):
            (Aucun élément nuisible détecté)

            Clé(s) du Registre infectée(s):
            HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> Quarantined and deleted successfully.
            HKEY_CLASSES_ROOT\Typelib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
            HKEY_CLASSES_ROOT\e404.e404mgr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            HKEY_CLASSES_ROOT\CLSID\{5c78e2db-5afc-4a3b-9b9f-6af136562e6f} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5c78e2db-5afc-4a3b-9b9f-6af136562e6f} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            HKEY_CLASSES_ROOT\e404.e404mgr.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\mwc (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DNIdent (Malware.Trace) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\NetProject (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Service (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Secure Browsing (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\wkey (Malware.Trace) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\Microsoft\MsSC2 (Trojan.Downloader) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR (Trojan.Downloader) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PSRV (Trojan.Agent) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Classes\multimediaControls.chl (Trojan.Zlob) -> Quarantined and deleted successfully.

            Valeur(s) du Registre infectée(s):
            HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\some (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\start (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\user32.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> Quarantined and deleted successfully.

            Elément(s) de données du Registre infecté(s):
            (Aucun élément nuisible détecté)

            Dossier(s) infecté(s):
            C:\Program Files\NetProject (Trojan.Zlob) -> Delete on reboot.
            C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
            C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
            C:\Program Files\MyWebSearch\SrchAstt (Adware.MyWebSearch) -> Quarantined and deleted successfully.
            C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
            C:\Program Files\MyWebSearch\SrchAstt\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\209789 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

            Fichier(s) infecté(s):
            C:\Program Files\NetProject\ot.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\sbsm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\sbun.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\scm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\scu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\ts.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\waun.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\209789\209789.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            C:\Documents and Settings\Owner\Local Settings\Temp\ide21201.vxd (Adware.Winad) -> Quarantined and deleted successfully.
            C:\Program Files\Fichiers communs\Yazzle1162OinUninstaller.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\bg1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\bgtop.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\bottom1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\essentials.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\icon1.ico (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\install1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\left1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\li.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\logo.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\main.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\mainframe.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\reinstall1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\right1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\s1.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\s2.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\s3.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\SMTop1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\SMTop2.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\SMTop3.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\SMTop4.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft1_off.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft1_off_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft1_on.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft1_on_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft2_off.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft2_off_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft2_on.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft2_on_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft3_off.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft3_off_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft3_on.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft3_on_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\softbottom_off.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\softbottom_on.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\softleft_off.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\softleft_on.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\top1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\top2.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\turnoff1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\turnon1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
            C:\Documents and Settings\Owner\Favoris\Online Security Test.url (Rogue.Link) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.url (Rogue.Link) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Menu Démarrer\Security Troubleshooting.url (Rogue.Link) -> Quarantined and deleted successfully.
            st au post 13
            0
        7. cedric241
          ok fais ça afin de désinfecter

          Fais un scan avec cet antispyware :

          Telecharge malwarebytes + tutoriel :

          -> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

          Tu l´instale; le programme va se mettre automatiquement a jour.

          Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

          Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

          Puis click sur "rechercher".

          Laisse le scanner le pc...

          Si des elements on ete trouvés > click sur supprimer la selection.

          si il t´es demandé de redemarrer > click sur "yes".

          A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

          Copie et colle le rapport stp.
          0
          1. alaincamara Auteur
            désolé du retard ci-joint le rapportMalwarebytes' Anti-Malware 1.11
            Version de la base de données: 599

            Type de recherche: Examen complet (C:\|D:\|)
            Eléments examinés: 222082
            Temps écoulé: 1 hour(s), 58 minute(s), 27 second(s)

            Processus mémoire infecté(s): 0
            Module(s) mémoire infecté(s): 0
            Clé(s) du Registre infectée(s): 17
            Valeur(s) du Registre infectée(s): 7
            Elément(s) de données du Registre infecté(s): 0
            Dossier(s) infecté(s): 8
            Fichier(s) infecté(s): 54

            Processus mémoire infecté(s):
            (Aucun élément nuisible détecté)

            Module(s) mémoire infecté(s):
            (Aucun élément nuisible détecté)

            Clé(s) du Registre infectée(s):
            HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> Quarantined and deleted successfully.
            HKEY_CLASSES_ROOT\Typelib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
            HKEY_CLASSES_ROOT\e404.e404mgr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            HKEY_CLASSES_ROOT\CLSID\{5c78e2db-5afc-4a3b-9b9f-6af136562e6f} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5c78e2db-5afc-4a3b-9b9f-6af136562e6f} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            HKEY_CLASSES_ROOT\e404.e404mgr.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\mwc (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DNIdent (Malware.Trace) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\NetProject (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Service (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Secure Browsing (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\wkey (Malware.Trace) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\Microsoft\MsSC2 (Trojan.Downloader) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR (Trojan.Downloader) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PSRV (Trojan.Agent) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Classes\multimediaControls.chl (Trojan.Zlob) -> Quarantined and deleted successfully.

            Valeur(s) du Registre infectée(s):
            HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\some (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\start (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\user32.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> Quarantined and deleted successfully.

            Elément(s) de données du Registre infecté(s):
            (Aucun élément nuisible détecté)

            Dossier(s) infecté(s):
            C:\Program Files\NetProject (Trojan.Zlob) -> Delete on reboot.
            C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
            C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
            C:\Program Files\MyWebSearch\SrchAstt (Adware.MyWebSearch) -> Quarantined and deleted successfully.
            C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
            C:\Program Files\MyWebSearch\SrchAstt\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\209789 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

            Fichier(s) infecté(s):
            C:\Program Files\NetProject\ot.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\sbsm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\sbun.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\scm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\scu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\ts.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\Program Files\NetProject\waun.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\209789\209789.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
            C:\Documents and Settings\Owner\Local Settings\Temp\ide21201.vxd (Adware.Winad) -> Quarantined and deleted successfully.
            C:\Program Files\Fichiers communs\Yazzle1162OinUninstaller.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\bg1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\bgtop.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\bottom1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\essentials.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\icon1.ico (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\install1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\left1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\li.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\logo.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\main.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\mainframe.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\reinstall1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\right1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\s1.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\s2.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\s3.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\SMTop1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\SMTop2.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\SMTop3.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\SMTop4.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft1_off.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft1_off_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft1_on.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft1_on_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft2_off.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft2_off_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft2_on.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft2_on_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft3_off.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft3_off_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft3_on.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\soft3_on_ext.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\softbottom_off.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\softbottom_on.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\softleft_off.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\softleft_on.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\top1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\top2.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\turnoff1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\wowrlegl\turnon1.gif (Rogue.Multiple) -> Quarantined and deleted successfully.
            C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
            C:\Documents and Settings\Owner\Favoris\Online Security Test.url (Rogue.Link) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.url (Rogue.Link) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Menu Démarrer\Security Troubleshooting.url (Rogue.Link) -> Quarantined and deleted successfully.
            que dis-je faire maintenant
            0
        8. cedric241
          fais ce qui est expliqué au post 8
          0
          1. alaincamara Auteur
            j'ai posté le nouveau rapport
            0
          2. alaincamara Auteur
            je fais quoi maintenant?
            0
        9. cedric241
          supprime ces lignes :

          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gatewaybiz.com
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
          R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gateway.com/

          R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

          O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - (no file)

          O3 - Toolbar: (no name) - {84938242-5C5B-4A55-B6B9-A1507543B418} - (no file)

          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')

          O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieservicegate.com/redirect.php (file missing)
          O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieservicegate.com/redirect.php (file missing)

          O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (file missing)
          O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe (file missing)

          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
          O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
          O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
          O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/sj/en/check/qdiagh.cab?326

          O20 - Winlogon Notify: winxoo32 - winxoo32.dll (file missing)
          O22 - SharedTaskScheduler: apathies - {aed6f6a3-183c-488d-9f90-23db99f56e7f} - (no file)

          O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
          O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
          O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)

          O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)

          O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)

          O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
          O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe (file missing)

          pour les supprimer tu les coches toutes et tu clic sur fix checked

          ensuite refais un scan et poste le nouveau rapport
          0
          1. alaincamara Auteur
            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 10:35:40, on 2008-04-08
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Unable to get Internet Explorer version!
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
            C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
            C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
            C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
            C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
            C:\Program Files\Bonjour\mDNSResponder.exe
            C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
            C:\WINDOWS\eHome\ehRecvr.exe
            C:\WINDOWS\eHome\ehSched.exe
            C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            C:\WINDOWS\Explorer.EXE
            C:\WINDOWS\system32\nvsvc32.exe
            C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
            C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\dllhost.exe
            C:\WINDOWS\system32\wuauclt.exe
            C:\WINDOWS\ehome\ehtray.exe
            C:\WINDOWS\eHome\ehmsas.exe
            C:\WINDOWS\SOUNDMAN.EXE
            C:\WINDOWS\system32\RUNDLL32.EXE
            C:\Program Files\Digital Media Reader\readericon45G.exe
            C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
            C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
            C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
            C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
            C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
            C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
            c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
            C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
            C:\Program Files\iTunes\iTunesHelper.exe
            C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
            C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
            C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
            C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
            C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
            C:\Program Files\iPod\bin\iPodService.exe
            C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
            C:\Program Files\Google\Google Updater\GoogleUpdater.exe
            C:\WINDOWS\system32\wuauclt.exe
            C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
            C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
            C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
            O2 - BHO: 209789 helper - {5C78E2DB-5AFC-4A3B-9B9F-6AF136562E6F} - C:\WINDOWS\system32\209789\209789.dll
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
            O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - (no file)
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
            O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
            O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
            O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
            O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
            O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
            O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
            O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
            O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
            O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
            O4 - HKLM\..\Run: [gvmhivqb] rundll32.exe "C:\Program Files\gvmhivqb\cfcbmbep.dll",Init
            O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
            O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
            O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
            O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [FreeCall] "C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe" -nosplash -minimized
            O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
            O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
            O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
            O4 - HKCU\..\Run: [WinButler] C:\Documents and Settings\Owner\Application Data\WinButler\WinButler.exe
            O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
            O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
            O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
            O4 - HKLM\..\Policies\Explorer\Run: [rare] C:\Program Files\Video Access ActiveX Object\pmsnrr.exe
            O4 - HKLM\..\Policies\Explorer\Run: [user32.dll] C:\Program Files\Video Access ActiveX Object\isamntr.exe
            O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe
            O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Program Files\NetProject\sbmntr.exe
            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
            O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
            O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
            O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
            O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
            O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
            O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
            O9 - Extra button: Antivirus de la Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O18 - Protocol: intu-ir2007 - {52BAEC6B-9405-46F9-A131-6D50720A3CC4} - C:\Program Files\ImpotRapide 2007\ic2007pp.dll
            O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
            O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
            O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
            O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
            O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
            O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
            O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
            O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
            O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
            O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
            O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
            O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
            O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
            O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
            O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
            O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
            O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
            O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
            O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
            O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
            O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
            O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
            O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
            O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe (file missing)
            0
        10. cedric241
          sur le rapport fais un clic gauche parcour tout le rapport ça le met en surbrillance

          fais clic droit chosi copier

          ensuite sur ta prochaine réponse fais clic droit choisi coller
          0
          1. alaincamara Auteur
            je fais quoi maintenant
            0
        • 1
        • 2

        Discussions similaires

        Analyse des logs hijackthis
        philnoug

        35 réponses
        Hijackthis
        brioche95

        2 réponses
        Hijackthis
        The Dj

        4 réponses
        Log HIJACKTHIS
        Thi83

        13 réponses
        rapport Hijackthis
        kawito33

        87 réponses