Rapport hijackthis et autres problemes Résolu

Question

Bonjour,
Depuis 2 jours, ma connexions internet est lente, j'ai des pubs qui n'arettent pas de s'afficher, j'ai des fenetres qui s'ouvrent avec des analyses antivirus alors que je ne l'est jamais demandé, et de plus, choses incompréhensible, je ne peut plus utilier google. Quand je tape une recherche, google cherche dans le vide et rien ne se passe, je n'est pas de réponses, idem pour mes pages en flux. Par contre mes favoris et quand je tape une adresse en http, tout fonctionne. (c'est lent mais ca fonxtionne). 
J'ai éffectué une analyse avec le programme hijackthis, si quelqu'un peut m'aider, car je suis en pleine recherche de travail.
A oui, derniere chose, j'ai pas mal de déconexion intempestive.
je suis sous xp et j'utilise mozilla et ma femme, ie.
Merci.
Maxime

Rapport: 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:01:04, on 29/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\adchkr.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Fichiers communs\DriveCleaner Free\udcsdr.exe
C:\Program Files\Fichiers communs\DriveCleaner Free\udcwap.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\BITTOR~1\BitP.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TBONBin	bon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = https://internetsearchservice.com/
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = https://internetsearchservice.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://internetsearchservice.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://internetsearchservice.com/ie6.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://internetsearchservice.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.restorebookmark.com/?cm=941771&lt=1&it=2008-05-20%2006%3A44%3A57&dt=2008-05-28%2011%3A31%3A54&q=http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://internetsearchservice.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://internetsearchservice.com/ie6.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://internetsearchservice.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://internetsearchservice.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://internetsearchservice.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=28808
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [WA6PV_Check] "C:\Program Files\Fichiers communs\DriveCleaner Free\udcwap.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [mobiswing] C:\PROGRA~1\BITTOR~1\BitP.exe
O4 - HKLM\..\Run: [Proc Deaf Delete Peak] C:\Documents and Settings\All Users\Application Data\file joy proc deaf\bird test.exe
O4 - HKLM\..\Run: [634aad1c] rundll32.exe "C:\WINDOWS\system32\pergulqq.dll",b
O4 - HKLM\..\Run: [BM60799e80] Rundll32.exe "C:\WINDOWS\system32
grxnspv.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin	bon.exe /r
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Noun pop] C:\DOCUME~1\Max\APPLIC~1\ACEMOR~1	rans proxy.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.getietool.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.getietool.com/redirect.php (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - https://www.afternic.com/domains/drivecleaner.com
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - https://www.afternic.com/domains/errorsafe.com
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - https://www.afternic.com/domains/errorsafe.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{3164EA05-EF54-4B86-B965-A436DBFF520A}: NameServer = 85.255.116.104,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{394F69CF-12E3-4D0C-976F-678ADCBE4245}: NameServer = 85.255.116.104,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{5E66A89F-5091-4DDA-BB97-8B42F16AECB4}: NameServer = 85.255.116.104,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{8329368C-721C-4E28-BC0E-45D1688E9FEC}: NameServer = 85.255.116.104,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{A5660891-BCAF-48EE-B41D-C7EB7BFB6153}: NameServer = 85.255.116.104,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{B2CED30D-0BD6-4B94-A4F4-79C4B641B1BE}: NameServer = 85.255.116.104,85.255.112.152
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.104 85.255.112.152
O17 - HKLM\System\CS1\Services\Tcpip\..\{3164EA05-EF54-4B86-B965-A436DBFF520A}: NameServer = 85.255.116.104,85.255.112.152
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.104 85.255.112.152
O17 - HKLM\System\CS2\Services\Tcpip\..\{3164EA05-EF54-4B86-B965-A436DBFF520A}: NameServer = 85.255.116.104,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.104 85.255.112.152
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O22 - SharedTaskScheduler: delayingly - {e89fa8e9-5c0b-45f6-a70e-f7b177bcd193} - C:\WINDOWS\system32tmipr.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ladchkr - Unknown owner - C:\WINDOWS\system32\ladchkr.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

carlos59139 · Answer

quand tu dit que tu as des pubs est ce que ce sont des pub avec pour nom CID

Utilisateur anonyme · Answer

salut maxime,

ok y a pas mal  de soucis 

on auras plusieures choses a faires :

réouvre hijackthis 
fais scan only 
coche ces lignes :


R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://internetsearchservice.com 
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://internetsearchservice.com 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://internetsearchservice.com 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://internetsearchservice.com/ie6.html 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://internetsearchservice.com/ 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.restorebookmark.com/ 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://internetsearchservice.com 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://internetsearchservice.com/ie6.html 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://internetsearchservice.com/ 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp 
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://internetsearchservice.com/ 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://internetsearchservice.com/ 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=28808 

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 

O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO 

O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.getietool.com/redirect.php (file missing) 
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.getietool.com/redirect.php (file missing) 

O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com 
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - https://www.afternic.com/domains/drivecleaner.com 
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - https://www.afternic.com/domains/errorsafe.com 
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - https://www.afternic.com/domains/errorsafe.com 


tu les coches toutes et tu clic sur fix checked 


ensuite :


Telecharge malwarebytes 

-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Tu l´instale; le programme va se mettre automatiquement a jour. 

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression". 

Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet". 

Puis click sur "rechercher". 

Laisse le scanner le pc... 

Si des elements on ete trouvés > click sur supprimer la selection. 

si il t´es demandé de redemarrer > click sur "yes". 

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum. 

Copie et colle le rapport stp.

Utilisateur anonyme · Answer

j ai une question aussi :

mechnikova odessa ça te dis quelque chose ???

t habites pas non plus au states ?? usa

Utilisateur anonyme · Answer

y a une ENORME chose qui m a échapé tu n as pas d antivirus 


telecharge et instal D URGENCE antivir (gratuit en anglais mais simple )


https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/13198.html

goos01 · Answer

Merci, oui, il y a des pubs CID et non, je ne suis pas des states! 

voila le rapport d'analyse de Malwarebytes.

Malwarebytes' Anti-Malware 1.12
Version de la base de données: 797

Type de recherche: Examen complet (C:\|)
Eléments examinés: 152870
Temps écoulé: 1 hour(s), 2 minute(s), 48 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 21
Valeur(s) du Registre infectée(s): 10
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 79

Processus mémoire infecté(s):
C:\Program Files\Fichiers communs\DriveCleaner Free\udcwap.exe (Rogue.DriveCleaner) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\pergulqq.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\xxyVpqQG.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\iifdayaa.dll (Trojan.Vundo) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{80a4492d-290a-4ac7-bd6d-3a006f537a4c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{80a4492d-290a-4ac7-bd6d-3a006f537a4c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\e405.e405mgr (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\e405.e405mgr.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c6d09ec9-ddb2-4ec4-9d6f-b680a7a849cf} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c6d09ec9-ddb2-4ec4-9d6f-b680a7a849cf} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{87db48a8-c284-4661-a0e9-e055e08fed49} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87db48a8-c284-4661-a0e9-e055e08fed49} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\iifdayaa (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\e405.e405mgr (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\e405.e405mgr.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\e405.e405mgr (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WNetPws (Trojan.Zlob) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\634aad1c (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{87db48a8-c284-4661-a0e9-e055e08fed49} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WA6PV_Check (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuAdminTools (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuFavorites (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM60799e80 (Trojan.Agent) -> Delete on reboot.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\w\ (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\w\ (Trojan.Zlob) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\xxyvpqqg -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger) -> Data: kdbfk.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\xxyvpqqg  -> Delete on reboot.

Dossier(s) infecté(s):
C:\Program Files\Fichiers communs\DriveCleaner Free (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\443059 (Trojan.BHO) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\pergulqq.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\qqlugrep.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxyVpqQG.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\GQqpVyxx.ini (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\GQqpVyxx.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iifdayaa.dll (Trojan.Vundo) -> Delete on reboot.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138351.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138352.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138353.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138380.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138381.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138382.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138394.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138395.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138396.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0138555.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0138556.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0138557.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139553.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139554.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139555.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139578.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139579.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139583.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139615.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139616.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139617.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139632.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139633.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139634.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140632.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140633.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140635.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140657.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140658.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140659.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140675.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140676.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140677.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140731.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140732.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140733.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140805.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140806.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140807.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140821.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140822.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140823.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140853.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140854.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140855.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140868.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140869.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140870.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140905.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140906.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140910.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140934.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140935.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140936.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0140974.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0140975.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0140976.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0141116.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0141117.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0141118.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0141119.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0141120.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0141121.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP621\A0155061.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP623\A0155590.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP631\A0159501.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\usihdbdn.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\443059\443059.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Program Files\Fichiers communs\DriveCleaner Free\udcsdr.exe (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
C:\Program Files\Fichiers communs\DriveCleaner Free\udcwap.exe (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
grxnspv.dll (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Max\Favoris\Online Security Test.url (Rogue.Link) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

ok redémarre le pc si ça n a pas été fais 

puis réouvre malewarebyte
va sur quarantaine 
supprime tout 


ensuite instal ANTIVIR (voir post 4)

répond a ma question post 3

et refais un scan hijackthis et poste moi le rapport stp

goos01 · Answer

mechnikova o dessa, ca ne me dit rien du tout. pourquoi??

l'antivirus est installé, merci.

Et voici le rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:26:17, on 29/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TBONBin	bon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\update.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avnotify.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0E150220-858B-4060-ADBD-BD17EA4B145B} - C:\WINDOWS\system32\ptpusb32.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Proc Deaf Delete Peak] C:\Documents and Settings\All Users\Application Data\file joy proc deaf\bird test.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin	bon.exe /r
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Noun pop] C:\DOCUME~1\Max\APPLIC~1\ACEMOR~1	rans proxy.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ladchkr - Unknown owner - C:\WINDOWS\system32\ladchkr.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Utilisateur anonyme · Answer

ok 

je t ai demandé ça car tu as un détournement de DNS d ou tes soucis de connexion 

met antivir a jours si ça n a pas été fais si il detecte des intrus met les en quarantaine 

nous allons utiliser SMITHFRAUD attention antivir peux le juger comme nefaste si c est le cas désactive antivir le temps de son utilisation 

pour cela fais un clic droit sur l icone antivir (le parapluie) en bas a droite de l ecran a coté de l heure 

et decoche ANTIVIR GUARD ENABLE 


Télécharge sur le bureau http://siri.urz.free.fr/Fix/SmitfraudFix.exe 
=> Double clic sur SmitfraudFix

=> Choisir Option 1 
=> poste le rapport

goos01 · Answer

voila le rapport.
Par contre, visiblement tout refonctionne correctement, si ce n'est que j'ai toujours quelques pub CID qui apparaissent.

rapport:

SmitFraudFix v2.323

Rapport fait à 17:39:30,93, 29/05/2008
Executé à partir de C:\Documents and Settings\Max\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TBONBin	bon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Documents and Settings\Max\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\hp????.tmp PRESENT !
C:\WINDOWS\system32\1024\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Max


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Max\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Max\Favoris

C:\DOCUME~1\Max\Favoris\Antivirus Test Online.url PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 2200BG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5E66A89F-5091-4DDA-BB97-8B42F16AECB4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5E66A89F-5091-4DDA-BB97-8B42F16AECB4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5E66A89F-5091-4DDA-BB97-8B42F16AECB4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

* Redémarre l'ordinateur en mode sans échec 
(tapoter F8 ou F5 au boot pour obtenir le menu de démarrage ou http://service1.symantec.com/ 

* Double clique sur smitfraudfix.cmd 

* Sélectionne 2 pour supprimer les fichiers responsables de l'infection. 

A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection. 

A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu. 

* Redémarre en mode normal et poste le rapport ici 

N.B.: Cette étape élimine les fichiers infectieux détectés à l'étape #1

goos01 · Answer

Voila le rapport



SmitFraudFix v2.323

Rapport fait à 17:57:43,31, 29/05/2008
Executé à partir de C:\Documents and Settings\Max\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost
127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 www.drivecleaner.com ## added by CiD
127.0.0.1 www.errorprotector.com ## added by CiD
127.0.0.1 www.errorsafe.com ## added by CiD
127.0.0.1 www.systemdoctor.com ## added by CiD
127.0.0.1 www.utils.winfixer.com ## added by CiD
127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
127.0.0.1 www.win-virus-pro.com ## added by CiD
127.0.0.1 www.winantispam.com ## added by CiD
127.0.0.1 www.winantispy.com ## added by CiD
127.0.0.1 www.winantispyware.com ## added by CiD
127.0.0.1 www.winantivirus.com ## added by CiD
127.0.0.1 www.winantiviruspro.com ## added by CiD
127.0.0.1 www.windrivecleaner.com ## added by CiD
127.0.0.1 www.windrivesafe.com ## added by CiD
127.0.0.1 www.winfixer.com ## added by CiD
127.0.0.1 www.winfixer2006.com ## added by CiD
127.0.0.1 www.winsoftware.com ## added by CiD

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\hp????.tmp supprimé
C:\WINDOWS\system32\1024\ supprimé
C:\DOCUME~1\Max\Favoris\Antivirus Test Online.url supprimé

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5E66A89F-5091-4DDA-BB97-8B42F16AECB4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5E66A89F-5091-4DDA-BB97-8B42F16AECB4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5E66A89F-5091-4DDA-BB97-8B42F16AECB4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

ok 

refais un scan hijackthis et poste le rapport stp

goos01 · Answer

le voila :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:15:35, on 29/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TBONBin	bon.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0E150220-858B-4060-ADBD-BD17EA4B145B} - C:\WINDOWS\system32\ptpusb32.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Proc Deaf Delete Peak] C:\Documents and Settings\All Users\Application Data\file joy proc deaf\bird test.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin	bon.exe /r
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Noun pop] C:\DOCUME~1\Max\APPLIC~1\ACEMOR~1	rans proxy.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ladchkr - Unknown owner - C:\WINDOWS\system32\ladchkr.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Utilisateur anonyme · Answer

ok le detournement de DNS est réglé 

maintenant on va fermer les portes aux envahisseurs 

pour cela il te faut un parefeu :


pare-feu gratuits 


télécharger la version gratuite de Zone alarm 
https://www.pcastuces.com/logitheque/zonealarm.htm 
TUTO 
http://securite-facile.ovh.org/zonealarm.php 
http://forum.telecharger.01net.com/forum/ 
désactivé les parties filtrage web et antivirus de ZA ! C'est important 

ou 

télécharger la version gratuite de Kerio 
Kerio (parefeu) 
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html 
TUTO 
https://kerio.probb.fr/ 
SITE de Kerio 
https://kerio.probb.fr/ 

ou 

ComodoFirewallPro 2.4 téléchargement 
http://www.personalfirewall.comodo.com/ 
Tuto pour la 2.4 
https://infomars.fr/forum/index.php?s=908072e48ff7cf0359366440cb26c93f&showtopic=389 
Tuto pour la 2.4 
http://www.nordicnature.net/tutorials/comodo/cf24wiz.htm 
Attention la 3.0 est en anglais uniquement et est plus difficile a paramétrer 
Tuto pour la 3.0 
https://infomars.fr/forum/index.php?showtopic=1225 



ensuite fais ça :



Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 


-> Double clique combofix.exe. 
-> Tape sur la touche 1 (Yes) pour démarrer le scan. 
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt 

Avant d'utiliser ComboFix : 

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours. 

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil. 

Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. 

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. 

-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

goos01 · Answer

Et voici: ComboFix 08-05-29.1 - Max 2008-05-29 18:52:39.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.504 [GMT 2:00] Endroit: C:\Documents and Settings\Max\Bureau\ComboFix.exe [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Max\err.log C:\Documents and Settings\Max\ResErrors.log . ---- Previous Run ------- . C:\WINDOWS\BM60799e80.xml C:\WINDOWS\pskt.ini C:\WINDOWS\smdat32a.sys C:\WINDOWS\system32\GQqpVyxx.ini C:\WINDOWS\system32\GQqpVyxx.ini2 C:\WINDOWS\system32\ocjifkbx.ini C:\WINDOWS\system32\xxyVpqQG.dll . ((((((((((((((((((((((((((((( Fichiers créés 2008-04-28 to 2008-05-29 )))))))))))))))))))))))))))))))))))) . 2008-05-29 18:49 . 2008-05-29 18:49 d-------- C:\WINDOWS\LastGood 2008-05-29 18:28 . 2008-05-29 18:28 d-------- C:\Program Files\Sunbelt Software 2008-05-29 17:39 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-05-29 17:39 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-05-29 17:39 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-05-29 17:39 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-05-29 17:39 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe 2008-05-29 17:39 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-05-29 17:39 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-05-29 17:39 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-05-29 17:39 . 2008-05-29 17:58 5,244 --a------ C:\WINDOWS\system32 mp.reg 2008-05-29 17:24 . 2008-05-29 17:24 d-------- C:\Program Files\Avira 2008-05-29 17:24 . 2008-05-29 17:24 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-05-29 16:01 . 2008-05-29 16:01 d-------- C:\Documents and Settings\Max\Application Data\Malwarebytes 2008-05-29 16:00 . 2008-05-29 16:01 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-29 16:00 . 2008-05-29 16:00 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-05-29 16:00 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-05-29 16:00 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-05-29 14:24 . 2008-05-29 14:24 d-------- C:\Program Files\Lavasoft 2008-05-29 14:24 . 2008-05-29 14:25 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-05-29 13:59 . 2008-05-29 13:59 d-------- C:\Program Files\Trend Micro 2008-05-29 13:46 . 2008-05-29 13:46 10,279,675 --a------ C:\upload_moi_MAXIME.tar.gz 2008-05-29 13:08 . 2008-05-29 13:16 d-------- C:\Lop SD 2008-05-29 12:57 . 2008-05-29 13:34 d-------- C:\Program Files\Navilog1 2008-05-27 18:56 . 2008-05-27 18:56 d-------- C:\Documents and Settings\Max\Application Data\Joost 2008-05-27 18:11 . 2008-05-27 18:11 d-------- C:\Program Files\Ace More User 2008-05-27 18:11 . 2008-05-27 18:11 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-19 14:50 . 2008-05-19 14:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-19 14:50 . 2008-05-19 14:50 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-17 01:17 . 2008-05-17 01:17 118 --a------ C:\WINDOWS\system32\MRT.INI 2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe 2008-04-29 11:20 . 2008-04-29 11:20 15,648 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys 2008-04-29 11:19 . 2008-04-29 11:19 15,648 --a------ C:\WINDOWS\system32\drivers\Awrtrd.sys 2008-04-29 11:19 . 2008-04-29 11:19 12,960 --a------ C:\WINDOWS\system32\drivers\Awrtpd.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-29 13:37 --------- d-----w C:\Program Files\TBONBin 2008-05-29 12:23 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-05-29 11:53 --------- d-----w C:\Program Files\BitDownload 2008-05-27 16:42 --------- d-----w C:\Program Files\BitTorrent Fastest Tool 2008-05-27 16:41 --------- d-----w C:\Program Files\ABC Amber Text2Image Converter 2008-05-27 16:09 --------- d-----w C:\Documents and Settings\Max\Application Data\Ace More User 2008-05-27 16:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\file joy proc deaf 2008-05-27 14:42 --------- d-----w C:\Program Files\eMule 2008-04-08 16:28 --------- d-----w C:\Program Files\Java 2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:51 621,344 ------w C:\WINDOWS\system32\dllcache\mswstr10.dll 2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-25 04:51 194,144 ------w C:\WINDOWS\system32\dllcache\msjint40.dll 2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-20 08:09 1,845,376 ------w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-01 16:28 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-02-29 08:57 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-02-29 08:56 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-12-23 12:58 62,344 -c--a-w C:\Documents and Settings\Max\Application Data\GDIPFONTCACHEV1.DAT 2007-08-22 17:56 560 ----a-w C:\Documents and Settings\Max\Application Data\ViewerApp.dat 2007-01-11 11:44 688 -c--a-w C:\Documents and Settings\Max\Application Data\wklnhst.dat 2006-01-15 12:48 278,528 -c--a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe 2006-11-21 10:48 61 -csh--w C:\WINDOWS\cnerolf.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0E150220-858B-4060-ADBD-BD17EA4B145B}] 2007-08-13 23:08 33140 --a------ C:\WINDOWS\system32\ptpusb32.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 10:00 15360] "tbon"="C:\Program Files\TBONBin bon.exe" [2006-01-12 23:59 82944] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe" [2006-12-17 14:23 165304] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208] "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2007-10-22 21:42 190024] "Noun pop"="C:\DOCUME~1\Max\APPLIC~1\ACEMOR~1 rans proxy.exe" [2008-05-27 11:21 433152] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-20 21:15 344064] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11 1388544] "AGRSMMSG"="AGRSMMSG.exe" [2005-04-13 12:12 88209 C:\WINDOWS\AGRSMMSG.exe] "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2005-02-08 18:38 159744] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-05-04 10:59 794624] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-10-13 16:04 278528] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 13:54 253952] "eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 13:24 290816] "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-03-29 14:45 233534] "ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184] "ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920] "PCLEPCI"="C:\PROGRA~1\Pinnacle\PPE\PPE.EXE" [2004-02-03 15:13 49152] "USBToolTip"="C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe" [2005-06-13 02:30 192512] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-05 10:00 110592 C:\WINDOWS\system32\bthprops.cpl] "AltnetPointsManager"="c:\program files\altnet\points manager\points manager.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792] "PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 01:26 406016] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2007-09-08 18:16 185632] "NWEReboot"="" [] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2007-10-22 21:42 190024] "Proc Deaf Delete Peak"="C:\Documents and Settings\All Users\Application Data\file joy proc deaf\bird test.exe" [2008-05-29 18:13 3525120] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ HP Digital Imaging Monitor.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624] Picture Package Menu.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2006-06-24 18:22:07 151552] Picture Package VCD Maker.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2006-06-24 18:21:59 106496] Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 15:40:46 118784] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MJPG"= Pvmjpg30.dll "VIDC.PIM1"= pclepim1.dll "VIDC.I420"= vdrcodec.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\Program Files\eMule\emule.exe"= "C:\Program Files\Pinnacle\Studio 10\programs\RM.exe"= "C:\Program Files\Pinnacle\Studio 10\programs\PMSRegisterFile.exe"= "C:\WINDOWS\system32\sessmgr.exe"= "C:\WINDOWS\system32\usmt\migwiz.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpfccopy.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpoews01.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpofxm08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hposfx08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hposid01.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqCopy.exe"= "C:\Program Files\Hp\Digital Imaging\Unload\HpqDIA.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqkygrp.exe"= "C:\Program Files\Hp\Digital Imaging\Unload\HpqPhUnl.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqscnvw.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqste08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpzwiz01.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\Program Files\Pinnacle\Studio 10\programs\Studio.exe"= "C:\Program Files\Joost\xulrunner\tvprunner.exe"= "C:\Program Files\Pinnacle\Studio 10\programs\umi.exe"= R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21] R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21] R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21] S2 ladchkr;ladchkr;C:\WINDOWS\system32\ladchkr.exe [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3197db24-6cf6-11dc-9167-00150023b77f}] \Shell\AutoRun\command - E:\LaunchU3.exe *Newly Created Service* - FWDRV *Newly Created Service* - KHIPS *Newly Created Service* - SPF4 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\assfxcs] C:\WINDOWS\system32\assfxcs.exe . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-05-29 15:00:03 C:\WINDOWS\Tasks\A8D88700918B0650.job" - c:\docume~1\max\applic~1\acemor~1\Aim Pile Great.exe "2008-05-29 10:15:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-05-29 14:00:01 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe "2008-05-16 23:13:44 C:\WINDOWS\Tasks\HubTask 0 {0E7C166E-2D2F-4269-9034-DE1898BF2B1A} 0~0.job" - C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Mediahub.exe;Sched HubTask 0 {0E7C166E-2D2F-4269-9034-DE1898BF2B1A} 0~0 "2008-05-29 16:41:18 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-29 18:57:23 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????0?1?0?9??????? ???B?????????????hLC? ?????? Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-05-29 18:59:36 ComboFix-quarantined-files.txt 2008-05-29 16:59:09 Pre-Run: 7,015,211,008 octets libres Post-Run: 7,006,396,416 octets libres 208 --- E O F --- 2008-05-20 11:41:05

Utilisateur anonyme · Answer

ok refais un scan hijackthis et poste le rapport stp 

c est pour suivre l évolution de la désinfection

goos01 · Answer

Voila:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:06:08, on 29/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TBONBin	bon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0E150220-858B-4060-ADBD-BD17EA4B145B} - C:\WINDOWS\system32\ptpusb32.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Proc Deaf Delete Peak] C:\Documents and Settings\All Users\Application Data\file joy proc deaf\bird test.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin	bon.exe /r
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Noun pop] C:\DOCUME~1\Max\APPLIC~1\ACEMOR~1	rans proxy.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ladchkr - Unknown owner - C:\WINDOWS\system32\ladchkr.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Utilisateur anonyme · Answer

ok je vois que tu as mis le parefeu c est bien 

on va s occuper des pubs cid maintenant :




télécharge ceci: (by Moe) : 
http://sosvirus.changelog.fr/Green_day/Lopxpsetup.exe 

Double clic sur Lopxpsetup.exe pour lancer l'installation 
Au menu, choisir l'option 1 
Patienter jusqu'à que l'on demande d'appuyer sur une touche, appuyer ! 
Une rapport sera alors crée, à copie/colle en entier sur le forum.

balltrap34 · Answer

salut
juste pour savoir ou tu as vu le detournement DNS

a++

goos01 · Answer

# Rapport Lopxp fait le 29/05/2008 à 19:11:40
# Exécuté dans : C:\Program Files\Lopxp
# Version 3.10 - Maj du 11/04/2008

  Killing 'MsgPlus.exe'
"C:\Program Files\MessengerPlus! 3\MsgPlus.exe"  (1568)
  Killing 'iexplore.exe'
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" (3292)

========== Listing des dossiers Application Data

+- C:\Documents and Settings\All Users\Application Data

 2008-03-17 à 20:20:06 - Adobe 
 2008-03-17 à 20:22:37 - Apple 
 2008-03-17 à 20:22:30 - Apple Computer
 2008-05-29 à 15:24:47 - Avira 
 2008-02-13 à 23:23:00 - BOONTY 
 2008-05-27 à 16:09:48 - file joy proc deaf
 2008-03-16 à 13:31:34 - Google 
 2006-01-10 à 20:46:43 - HP 
 2005-08-07 à 20:21:11 - hpqwmi 
 2005-08-07 à 20:02:47 - InstallShield 
 2008-05-29 à 12:25:52 - Lavasoft 
 2008-05-29 à 14:00:53 - Malwarebytes 
 2007-11-25 à 11:54:30 - Messenger Plus!
 2008-05-20 à 11:40:57 - Microsoft 
 2007-11-14 à 20:55:12 - PEERNET 
 2006-09-24 à 21:00:34 - Pinnacle 
 2006-09-25 à 20:20:27 - Pinnacle Studio
 2006-01-15 à 14:34:08 - QuickTime 
 2005-08-08 à 03:32:07 - SBSI 
 2007-08-26 à 10:34:44 - SmartSound Software Inc
 2006-01-10 à 20:43:27 - Sonic 
 2007-02-07 à 21:21:13 - Symantec 
 2008-05-27 à 16:11:31 - TEMP 
 2006-06-05 à 10:02:21 - Windows Genuine Advantage
 2007-04-29 à 20:14:06 - Windows Live Toolbar
 2007-08-26 à 10:29:27 - WindowsLiveInstaller 
 2008-03-17 à 20:48:34 - WLInstaller 

+- C:\Documents and Settings\Max\Application Data

 2008-05-27 à 16:09:48 - Ace More User
 2007-07-10 à 06:04:50 - Adobe 
 2007-08-24 à 18:02:33 - AdobeUM 
 2007-09-09 à 17:00:38 - Ahead 
 2007-03-22 à 07:17:26 - Apple Computer
 2007-11-14 à 21:13:13 - BitDownload 
 2006-12-29 à 22:59:13 - DivX 
 2008-03-18 à 11:36:10 - dvdcss 
 2006-12-17 à 12:31:11 - Google 
 2007-10-17 à 21:44:54 - GrabIt 
 2008-03-17 à 20:21:50 - gtk-2.0 
 2006-01-11 à 19:01:48 - Help 
 2006-01-10 à 20:48:58 - HP 
 2006-03-02 à 21:53:02 - Identities 
 2007-08-27 à 12:16:09 - InstallShield 
 2006-01-10 à 12:04:30 - InterVideo 
 2008-05-27 à 16:56:34 - Joost 
 2006-02-08 à 15:32:16 - Leadertech 
 2006-01-11 à 19:31:08 - Macromedia 
 2008-05-29 à 14:01:07 - Malwarebytes 
 2007-08-29 à 20:00:48 - Microsoft 
 2006-11-25 à 12:38:00 - Mozilla 
 2006-11-03 à 19:02:50 - MSNInstaller 
 2006-11-03 à 21:08:18 - Nvu 
 2007-11-14 à 20:56:36 - PEERNET 
 2008-03-18 à 20:34:29 - Real 
 2007-02-18 à 20:17:05 - SAMSUNG 
 2007-04-29 à 19:35:13 - SecondLife 
 2006-02-08 à 15:32:30 - Sonic 
 2006-10-07 à 10:25:54 - Steinberg 
 2006-01-16 à 08:30:23 - Sun 
 2006-01-12 à 20:21:29 - Symantec 
 2006-12-12 à 14:21:11 - Template 
 2007-09-27 à 12:43:25 - U3 
 2006-11-03 à 21:32:31 - Visicom Media
 2007-05-27 à 09:23:14 - vlc 
 2007-08-26 à 10:29:00 - vmntoolbar 
 2006-05-27 à 12:46:53 - Vso 
 2007-09-27 à 10:30:36 - Windows Desktop Search

+- C:\Documents and Settings\Max\Local Settings\Application Data

 2008-01-06 à 19:57:27 - Adobe 
 2007-10-01 à 16:40:45 - Ahead 
 2007-08-26 à 10:30:23 - Apple 
 2007-03-21 à 07:34:38 - Apple Computer
 2008-05-26 à 20:16:26 - ApplicationHistory 
 2006-12-17 à 12:28:14 - Google 
 2006-01-11 à 19:01:48 - Help 
 2006-01-10 à 20:46:52 - HP 
 2006-03-02 à 21:44:19 - Identities 
 2006-01-10 à 20:47:24 - IsolatedStorage 
 2008-05-27 à 16:56:40 - Joost 
 2007-12-28 à 21:10:57 - Microsoft 
 2006-08-12 à 09:38:12 - Mon Livre Photo by Cewe
 2006-11-25 à 12:38:00 - Mozilla 
 2007-07-31 à 06:13:32 - PCHealth 
 2006-01-22 à 16:22:52 - Shareaza 
 2007-09-28 à 09:07:29 - Windows Live Writer
 2006-05-03 à 18:17:18 - WMTools Downloaded Files
 2005-08-07 à 19:43:59 - {3248F0A6-6813-11D6-A77B-00B0D0150040} 

========== Listing du dossier Program Files

+- C:\Program Files

 2008-05-27 à 16:41:40 - ABC Amber Text2Image Converter
 2008-05-27 à 16:11:32 - Ace More User
 2008-03-17 à 20:19:54 - Adobe 
 2006-06-12 à 10:29:58 - AdwarePunisher 
 2007-08-26 à 10:31:30 - AGEIA Technologies
 2007-02-03 à 12:45:55 - All Video to VCD SVCD DVD Converter
 2007-04-15 à 10:21:31 - ALO SOFT
 2005-08-07 à 19:41:46 - Analog Devices
 2008-02-05 à 20:13:24 - Ange softs
 2008-03-17 à 20:13:05 - Antipub 
 2008-02-16 à 18:36:56 - Anuman Interactive
 2005-08-07 à 19:43:48 - Apoint2K 
 2008-03-17 à 20:22:41 - Apple Software Update
 2007-04-14 à 23:05:06 - ArcSoft 
 2005-08-07 à 19:41:25 - ATI Technologies
 2007-04-29 à 19:39:08 - AVI DivX MPEG to DVD Converter & Burner
 2008-05-29 à 15:24:47 - Avira 
 2008-03-17 à 20:19:06 - B-Association(2) 
 2008-05-29 à 11:53:57 - BitDownload 
 2008-05-27 à 16:42:51 - BitTorrent Fastest Tool
 2006-08-09 à 17:54:29 - Bloodshed Software
 2006-06-12 à 10:24:21 - Boilsoft AVI Converter
 2008-03-17 à 20:17:48 - BoontyGames 
 2007-04-27 à 15:38:19 - BSplayer 
 2007-05-17 à 20:47:24 - CD to MP3 Ripper
 2007-02-08 à 21:38:34 - CoffeeCup Software
 2005-08-08 à 03:32:07 - ComPlus Applications
 2006-09-12 à 18:15:07 - Cool MP3 Converter
 2007-08-29 à 19:58:04 - d3 
 2008-03-17 à 20:21:41 - DivX 
 2007-04-29 à 19:38:55 - DSL Speed
 2006-08-16 à 07:48:12 - Easy Internet signup
 2008-05-27 à 14:42:01 - eMule 
 2008-05-29 à 15:06:24 - Fichiers communs
 2006-06-12 à 10:24:20 - GameSpy Arcade
 2007-11-29 à 19:45:42 - GIMP-2.0 
 2008-03-17 à 20:13:12 - Google 
 2005-08-07 à 20:06:47 - Hewlett-Packard 
 2006-01-10 à 20:38:01 - Hp 
 2006-01-10 à 17:29:04 - HPQ 
 2007-04-29 à 19:36:05 - HyperLobbyPro3 
 2008-03-17 à 20:17:56 - InstallShield Installation Information
 2005-08-07 à 19:40:52 - Intel 
 2008-04-10 à 08:52:21 - Internet Explorer
 2005-08-07 à 20:05:11 - InterVideo 
 2006-01-15 à 12:20:54 - Inventel 
 2007-04-29 à 19:41:47 - iPod 
 2007-04-29 à 19:41:46 - iPod(2) 
 2007-04-29 à 19:41:47 - iTunes 
 2007-04-29 à 19:41:47 - iTunes(2) 
 2008-04-08 à 16:28:42 - Java 
 2007-11-25 à 12:37:31 - Joost 
 2006-11-19 à 21:29:00 - Kazaa 
 2008-05-29 à 12:24:21 - Lavasoft 
 2008-05-29 à 17:11:53 - Lopxp 
 2008-05-29 à 14:01:00 - Malwarebytes' Anti-Malware
 2005-08-07 à 19:52:53 - Messenger 
 2007-10-22 à 19:42:45 - MessengerPlus! 3
 2006-01-16 à 21:17:59 - Microsoft ActiveSync
 2007-05-09 à 21:48:01 - Microsoft CAPICOM 2.1.0.2
 2005-08-08 à 03:32:08 - microsoft frontpage
 2007-08-26 à 10:32:20 - Microsoft Office
 2007-09-27 à 06:49:17 - Microsoft SQL Server Compact Edition
 2006-08-12 à 09:38:11 - Mon Livre Photo by Cewe
 2005-08-08 à 03:32:08 - Movie Maker
 2008-05-29 à 17:01:28 - Mozilla Firefox
 2007-04-29 à 19:35:14 - MP3 Workshop
 2007-04-29 à 19:39:08 - MPEGTOAVI 
 2006-04-29 à 12:30:32 - MSN 
 2005-08-08 à 03:32:08 - MSN Gaming Zone
 2007-08-26 à 10:29:39 - MSN Messenger
 2006-11-18 à 02:00:34 - MSXML 4.0
 2008-05-29 à 11:34:25 - Navilog1 
 2008-03-17 à 20:13:05 - Need2Find 
 2006-11-28 à 16:27:45 - Neoact 
 2007-09-09 à 16:56:47 - Nero 
 2006-11-19 à 21:22:28 - Netlor Studio
 2005-08-08 à 03:32:08 - NetMeeting 
 2006-11-19 à 21:23:16 - Nvu 
 2005-08-08 à 03:32:08 - Online Services
 2007-08-26 à 10:27:54 - Outlook Express
 2007-11-14 à 20:54:30 - PEERNET File Conversion Center 4.0
 2007-08-15 à 20:57:10 - Pinnacle 
 2007-04-29 à 19:38:38 - PIXELA 
 2007-04-29 à 19:39:28 - PMP DV
 2008-03-17 à 20:22:33 - QuickTime 
 2006-01-23 à 21:35:29 - Real 
 2008-03-17 à 20:14:49 - RealFlight G3 Demo
 2006-06-12 à 10:26:13 - RXToolBar(2) 
 2008-01-29 à 20:34:56 - Samsung 
 2005-08-07 à 20:08:05 - Services en ligne
 2008-02-11 à 22:47:49 - Shock Utility
 2006-02-10 à 21:54:49 - SmartSound Software
 2005-08-07 à 20:01:57 - Sonic 
 2007-04-29 à 19:37:56 - Sony Corporation
 2006-10-07 à 10:24:09 - Steinberg 
 2008-05-29 à 16:28:55 - Sunbelt Software
 2007-02-07 à 21:20:07 - Symantec 
 2008-05-29 à 13:37:24 - TBONBin 
 2008-05-29 à 11:59:08 - Trend Micro
 2006-03-23 à 21:12:15 - Trialtime 
 2008-03-17 à 20:18:03 - Téléchargeur de Architecte d intérieur 3D - Edition 2007
 2005-08-08 à 03:32:08 - Uninstall Information
 2007-05-27 à 09:21:46 - VideoLAN 
 2006-11-19 à 21:25:01 - Visicom Media
 2008-03-17 à 20:13:33 - Vsk3 
 2006-06-12 à 10:24:23 - vso 
 2007-08-26 à 10:36:58 - Wanadoo 
 2006-11-03 à 20:47:36 - Web Designers Toolkit with Calendar
 2006-11-03 à 20:44:29 - website 
 2008-03-17 à 20:19:09 - WebSite X5 Evolution
 2007-09-27 à 06:48:49 - Windows Desktop Search
 2008-03-18 à 07:57:30 - Windows Live
 2007-10-30 à 22:49:40 - Windows Live Toolbar
 2007-05-27 à 09:48:31 - Windows Media Connect 2
 2007-05-27 à 09:51:18 - Windows Media Player
 2005-08-08 à 03:32:08 - Windows NT
 2005-08-08 à 03:32:08 - WindowsUpdate 
 2007-04-29 à 19:36:03 - WinISO 
 2006-08-09 à 06:28:33 - WinISO53 
 2007-02-25 à 14:20:51 - WinRAR 
 2008-03-17 à 20:13:08 - Winsos 
 2007-04-29 à 19:36:04 - WinZip 
 2005-08-08 à 03:32:08 - xerox 
 2007-08-26 à 10:36:55 - Yahoo! 

========== Tâches planifiées

A8D88700918B0650.job: c:\docume~1\max\applic~1\acemor~1\Aim Pile Great.exe 
AppleSoftwareUpdate.job: C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task
HPpromotions journeysoftware.job: C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe /N "journeysoftware" -r
HubTask 0 {0E7C166E-2D2F-4269-9034-DE1898BF2B1A} 0~0.job: C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Mediahub.exe Sched HubTask 0 {0E7C166E-2D2F-4269-9034-DE1898BF2B1A} 0~0
Vérifier les mises à jour de Windows Live Toolbar.job: C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE 

========== Clés registre

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\amenslowwma] 
   DisplayName	REG_SZ         	CiD Help
   UninstallString	REG_SZ         	C:\DOCUME~1\Max\APPLIC~1\ACEMOR~1	rans proxy.exe -uninstall
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Proc Deaf Delete Peak"="C:\Documents and Settings\All Users\Application Data\file joy proc deaf\bird test.exe"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Noun pop"="C:\DOCUME~1\Max\APPLIC~1\ACEMOR~1	rans proxy.exe"


========== Bloqueur popups Internet Explorer


==========    Suggestion ( /!\ Nécessite une interprétation.)    ==========

C:\Documents and Settings\All Users\Application Data\file joy proc deaf
C:\Documents and Settings\Max\Application Data\Ace More User
C:\Program Files\Ace More User
C:\WINDOWS	asks\A8D88700918B0650.job
C:\Documents and Settings\All Users\MENUDM~1\Programmes\BitDownload
C:\Documents and Settings\Max\Application Data\BitDownload
C:\Program Files\BitDownload

+- Registre:

REGEDIT4

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\amenslowwma]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Proc Deaf Delete Peak"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Noun pop"=-




- Fin du rapport -

Utilisateur anonyme · Answer

ouvre le menu demarrer ensuite ouvre la commande executer (ou touche windows+R)

puis copier/coller : 

"%programfiles%\Lopxp\Lopxp.bat" /Fixme             ( avec les guillemets ) 

clic sur ok


Répond oui si on te demande la confirmation de la suppression d'un fichier. 

 Poste le rapport stp 


(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

goos01 · Answer

# Rapport Lopxp fait le 29/05/2008 à 19:18:53
# Exécuté dans : C:\Program Files\Lopxp
# Version 3.10 - Maj du 11/04/2008


========== FixLog ==========


+- C:\Documents and Settings\All Users\Application Data\file joy proc deaf
Choix utilisateur : Suppression acceptée.
Déplacé avec succès.

+- C:\Documents and Settings\Max\Application Data\Ace More User
Choix utilisateur : Suppression acceptée.
Déplacé avec succès.

+- C:\Program Files\Ace More User
Choix utilisateur : Suppression acceptée.
Déplacé avec succès.

+- C:\WINDOWS	asks\A8D88700918B0650.job
Choix utilisateur : Suppression acceptée.
Déplacé avec succès.

Supprimé: C:\Documents and Settings\All Users\MENUDM~1\Programmes\BitDownload
Supprimé: C:\Documents and Settings\Max\Application Data\BitDownload
Supprimé: C:\Program Files\BitDownload

+- Registre :
Nettoyage effectué.

+- Fichiers temporaires :
Nettoyage effectué.


========== Listing des dossiers Application Data

+- C:\Documents and Settings\All Users\Application Data

 2008-03-17 à 20:20:06 - Adobe 
 2008-03-17 à 20:22:37 - Apple 
 2008-03-17 à 20:22:30 - Apple Computer
 2008-05-29 à 15:24:47 - Avira 
 2008-02-13 à 23:23:00 - BOONTY 
 2008-03-16 à 13:31:34 - Google 
 2006-01-10 à 20:46:43 - HP 
 2005-08-07 à 20:21:11 - hpqwmi 
 2005-08-07 à 20:02:47 - InstallShield 
 2008-05-29 à 12:25:52 - Lavasoft 
 2008-05-29 à 14:00:53 - Malwarebytes 
 2007-11-25 à 11:54:30 - Messenger Plus!
 2008-05-20 à 11:40:57 - Microsoft 
 2007-11-14 à 20:55:12 - PEERNET 
 2006-09-24 à 21:00:34 - Pinnacle 
 2006-09-25 à 20:20:27 - Pinnacle Studio
 2006-01-15 à 14:34:08 - QuickTime 
 2005-08-08 à 03:32:07 - SBSI 
 2007-08-26 à 10:34:44 - SmartSound Software Inc
 2006-01-10 à 20:43:27 - Sonic 
 2007-02-07 à 21:21:13 - Symantec 
 2008-05-27 à 16:11:31 - TEMP 
 2006-06-05 à 10:02:21 - Windows Genuine Advantage
 2007-04-29 à 20:14:06 - Windows Live Toolbar
 2007-08-26 à 10:29:27 - WindowsLiveInstaller 
 2008-03-17 à 20:48:34 - WLInstaller 

+- C:\Documents and Settings\Max\Application Data

 2007-07-10 à 06:04:50 - Adobe 
 2007-08-24 à 18:02:33 - AdobeUM 
 2007-09-09 à 17:00:38 - Ahead 
 2007-03-22 à 07:17:26 - Apple Computer
 2006-12-29 à 22:59:13 - DivX 
 2008-03-18 à 11:36:10 - dvdcss 
 2006-12-17 à 12:31:11 - Google 
 2007-10-17 à 21:44:54 - GrabIt 
 2008-03-17 à 20:21:50 - gtk-2.0 
 2006-01-11 à 19:01:48 - Help 
 2006-01-10 à 20:48:58 - HP 
 2006-03-02 à 21:53:02 - Identities 
 2007-08-27 à 12:16:09 - InstallShield 
 2006-01-10 à 12:04:30 - InterVideo 
 2008-05-27 à 16:56:34 - Joost 
 2006-02-08 à 15:32:16 - Leadertech 
 2006-01-11 à 19:31:08 - Macromedia 
 2008-05-29 à 14:01:07 - Malwarebytes 
 2007-08-29 à 20:00:48 - Microsoft 
 2006-11-25 à 12:38:00 - Mozilla 
 2006-11-03 à 19:02:50 - MSNInstaller 
 2006-11-03 à 21:08:18 - Nvu 
 2007-11-14 à 20:56:36 - PEERNET 
 2008-03-18 à 20:34:29 - Real 
 2007-02-18 à 20:17:05 - SAMSUNG 
 2007-04-29 à 19:35:13 - SecondLife 
 2006-02-08 à 15:32:30 - Sonic 
 2006-10-07 à 10:25:54 - Steinberg 
 2006-01-16 à 08:30:23 - Sun 
 2006-01-12 à 20:21:29 - Symantec 
 2006-12-12 à 14:21:11 - Template 
 2007-09-27 à 12:43:25 - U3 
 2006-11-03 à 21:32:31 - Visicom Media
 2007-05-27 à 09:23:14 - vlc 
 2007-08-26 à 10:29:00 - vmntoolbar 
 2006-05-27 à 12:46:53 - Vso 
 2007-09-27 à 10:30:36 - Windows Desktop Search

+- C:\Documents and Settings\Max\Local Settings\Application Data

 2008-01-06 à 19:57:27 - Adobe 
 2007-10-01 à 16:40:45 - Ahead 
 2007-08-26 à 10:30:23 - Apple 
 2007-03-21 à 07:34:38 - Apple Computer
 2008-05-26 à 20:16:26 - ApplicationHistory 
 2006-12-17 à 12:28:14 - Google 
 2006-01-11 à 19:01:48 - Help 
 2006-01-10 à 20:46:52 - HP 
 2006-03-02 à 21:44:19 - Identities 
 2006-01-10 à 20:47:24 - IsolatedStorage 
 2008-05-27 à 16:56:40 - Joost 
 2007-12-28 à 21:10:57 - Microsoft 
 2006-08-12 à 09:38:12 - Mon Livre Photo by Cewe
 2006-11-25 à 12:38:00 - Mozilla 
 2007-07-31 à 06:13:32 - PCHealth 
 2006-01-22 à 16:22:52 - Shareaza 
 2007-09-28 à 09:07:29 - Windows Live Writer
 2006-05-03 à 18:17:18 - WMTools Downloaded Files
 2005-08-07 à 19:43:59 - {3248F0A6-6813-11D6-A77B-00B0D0150040} 

========== Listing du dossier Program Files

+- C:\Program Files

 2008-05-27 à 16:41:40 - ABC Amber Text2Image Converter
 2008-03-17 à 20:19:54 - Adobe 
 2006-06-12 à 10:29:58 - AdwarePunisher 
 2007-08-26 à 10:31:30 - AGEIA Technologies
 2007-02-03 à 12:45:55 - All Video to VCD SVCD DVD Converter
 2007-04-15 à 10:21:31 - ALO SOFT
 2005-08-07 à 19:41:46 - Analog Devices
 2008-02-05 à 20:13:24 - Ange softs
 2008-03-17 à 20:13:05 - Antipub 
 2008-02-16 à 18:36:56 - Anuman Interactive
 2005-08-07 à 19:43:48 - Apoint2K 
 2008-03-17 à 20:22:41 - Apple Software Update
 2007-04-14 à 23:05:06 - ArcSoft 
 2005-08-07 à 19:41:25 - ATI Technologies
 2007-04-29 à 19:39:08 - AVI DivX MPEG to DVD Converter & Burner
 2008-05-29 à 15:24:47 - Avira 
 2008-03-17 à 20:19:06 - B-Association(2) 
 2008-05-27 à 16:42:51 - BitTorrent Fastest Tool
 2006-08-09 à 17:54:29 - Bloodshed Software
 2006-06-12 à 10:24:21 - Boilsoft AVI Converter
 2008-03-17 à 20:17:48 - BoontyGames 
 2007-04-27 à 15:38:19 - BSplayer 
 2007-05-17 à 20:47:24 - CD to MP3 Ripper
 2007-02-08 à 21:38:34 - CoffeeCup Software
 2005-08-08 à 03:32:07 - ComPlus Applications
 2006-09-12 à 18:15:07 - Cool MP3 Converter
 2007-08-29 à 19:58:04 - d3 
 2008-03-17 à 20:21:41 - DivX 
 2007-04-29 à 19:38:55 - DSL Speed
 2006-08-16 à 07:48:12 - Easy Internet signup
 2008-05-27 à 14:42:01 - eMule 
 2008-05-29 à 15:06:24 - Fichiers communs
 2006-06-12 à 10:24:20 - GameSpy Arcade
 2007-11-29 à 19:45:42 - GIMP-2.0 
 2008-03-17 à 20:13:12 - Google 
 2005-08-07 à 20:06:47 - Hewlett-Packard 
 2006-01-10 à 20:38:01 - Hp 
 2006-01-10 à 17:29:04 - HPQ 
 2007-04-29 à 19:36:05 - HyperLobbyPro3 
 2008-03-17 à 20:17:56 - InstallShield Installation Information
 2005-08-07 à 19:40:52 - Intel 
 2008-04-10 à 08:52:21 - Internet Explorer
 2005-08-07 à 20:05:11 - InterVideo 
 2006-01-15 à 12:20:54 - Inventel 
 2007-04-29 à 19:41:47 - iPod 
 2007-04-29 à 19:41:46 - iPod(2) 
 2007-04-29 à 19:41:47 - iTunes 
 2007-04-29 à 19:41:47 - iTunes(2) 
 2008-04-08 à 16:28:42 - Java 
 2007-11-25 à 12:37:31 - Joost 
 2006-11-19 à 21:29:00 - Kazaa 
 2008-05-29 à 12:24:21 - Lavasoft 
 2008-05-29 à 17:20:12 - Lopxp 
 2008-05-29 à 14:01:00 - Malwarebytes' Anti-Malware
 2005-08-07 à 19:52:53 - Messenger 
 2007-10-22 à 19:42:45 - MessengerPlus! 3
 2006-01-16 à 21:17:59 - Microsoft ActiveSync
 2007-05-09 à 21:48:01 - Microsoft CAPICOM 2.1.0.2
 2005-08-08 à 03:32:08 - microsoft frontpage
 2007-08-26 à 10:32:20 - Microsoft Office
 2007-09-27 à 06:49:17 - Microsoft SQL Server Compact Edition
 2006-08-12 à 09:38:11 - Mon Livre Photo by Cewe
 2005-08-08 à 03:32:08 - Movie Maker
 2008-05-29 à 17:01:28 - Mozilla Firefox
 2007-04-29 à 19:35:14 - MP3 Workshop
 2007-04-29 à 19:39:08 - MPEGTOAVI 
 2006-04-29 à 12:30:32 - MSN 
 2005-08-08 à 03:32:08 - MSN Gaming Zone
 2007-08-26 à 10:29:39 - MSN Messenger
 2006-11-18 à 02:00:34 - MSXML 4.0
 2008-05-29 à 11:34:25 - Navilog1 
 2008-03-17 à 20:13:05 - Need2Find 
 2006-11-28 à 16:27:45 - Neoact 
 2007-09-09 à 16:56:47 - Nero 
 2006-11-19 à 21:22:28 - Netlor Studio
 2005-08-08 à 03:32:08 - NetMeeting 
 2006-11-19 à 21:23:16 - Nvu 
 2005-08-08 à 03:32:08 - Online Services
 2007-08-26 à 10:27:54 - Outlook Express
 2007-11-14 à 20:54:30 - PEERNET File Conversion Center 4.0
 2007-08-15 à 20:57:10 - Pinnacle 
 2007-04-29 à 19:38:38 - PIXELA 
 2007-04-29 à 19:39:28 - PMP DV
 2008-03-17 à 20:22:33 - QuickTime 
 2006-01-23 à 21:35:29 - Real 
 2008-03-17 à 20:14:49 - RealFlight G3 Demo
 2006-06-12 à 10:26:13 - RXToolBar(2) 
 2008-01-29 à 20:34:56 - Samsung 
 2005-08-07 à 20:08:05 - Services en ligne
 2008-02-11 à 22:47:49 - Shock Utility
 2006-02-10 à 21:54:49 - SmartSound Software
 2005-08-07 à 20:01:57 - Sonic 
 2007-04-29 à 19:37:56 - Sony Corporation
 2006-10-07 à 10:24:09 - Steinberg 
 2008-05-29 à 16:28:55 - Sunbelt Software
 2007-02-07 à 21:20:07 - Symantec 
 2008-05-29 à 13:37:24 - TBONBin 
 2008-05-29 à 11:59:08 - Trend Micro
 2006-03-23 à 21:12:15 - Trialtime 
 2008-03-17 à 20:18:03 - Téléchargeur de Architecte d intérieur 3D - Edition 2007
 2005-08-08 à 03:32:08 - Uninstall Information
 2007-05-27 à 09:21:46 - VideoLAN 
 2006-11-19 à 21:25:01 - Visicom Media
 2008-03-17 à 20:13:33 - Vsk3 
 2006-06-12 à 10:24:23 - vso 
 2007-08-26 à 10:36:58 - Wanadoo 
 2006-11-03 à 20:47:36 - Web Designers Toolkit with Calendar
 2006-11-03 à 20:44:29 - website 
 2008-03-17 à 20:19:09 - WebSite X5 Evolution
 2007-09-27 à 06:48:49 - Windows Desktop Search
 2008-03-18 à 07:57:30 - Windows Live
 2007-10-30 à 22:49:40 - Windows Live Toolbar
 2007-05-27 à 09:48:31 - Windows Media Connect 2
 2007-05-27 à 09:51:18 - Windows Media Player
 2005-08-08 à 03:32:08 - Windows NT
 2005-08-08 à 03:32:08 - WindowsUpdate 
 2007-04-29 à 19:36:03 - WinISO 
 2006-08-09 à 06:28:33 - WinISO53 
 2007-02-25 à 14:20:51 - WinRAR 
 2008-03-17 à 20:13:08 - Winsos 
 2007-04-29 à 19:36:04 - WinZip 
 2005-08-08 à 03:32:08 - xerox 
 2007-08-26 à 10:36:55 - Yahoo! 

========== Tâches planifiées

AppleSoftwareUpdate.job: C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task
HPpromotions journeysoftware.job: C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe /N "journeysoftware" -r
HubTask 0 {0E7C166E-2D2F-4269-9034-DE1898BF2B1A} 0~0.job: C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Mediahub.exe Sched HubTask 0 {0E7C166E-2D2F-4269-9034-DE1898BF2B1A} 0~0
Vérifier les mises à jour de Windows Live Toolbar.job: C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE 

========== Clés registre


========== Bloqueur popups Internet Explorer


==========    Suggestion ( /!\ Nécessite une interprétation.)    ==========


+- Registre : Aucune suggestion.


- Fin du rapport -

Utilisateur anonyme · Answer

on va faire une petite verif :

fais ceci :


Préalable 
• Vider la corbeille 
• Fermer toutes les applications 

================NAVILOG==================== 

Télécharge ceci http://il.mafioso.pagesperso-orange.fr/Navifix/download.htm

prend navilog1.exe

Choisir option 1 uniquement

Ensuite suit ce tutorial : http://mickael.barroux.free.fr/securite/navilog.php 

Et enfin post le rapport du scan navilog

goos01 · Answer

Et voila, désoler pour le temp passé.




Search Navipromo version 3.5.7 commencé le 29/05/2008 à 19:29:23,04

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Max" 

Mise à jour le 11.05.2008 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Max\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Max\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Max\menudm~1\progra~1" *** 

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Max\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Max\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 29/05/2008 à 19:37:34,68 ***

Utilisateur anonyme · Answer

pas grave 

refais un scan hijackthis et poste le rapport stp

goos01 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:49:05, on 29/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TBONBin	bon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0E150220-858B-4060-ADBD-BD17EA4B145B} - C:\WINDOWS\system32\ptpusb32.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin	bon.exe /r
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ladchkr - Unknown owner - C:\WINDOWS\system32\ladchkr.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Utilisateur anonyme · Answer

patience l analyse combofix et hijackthis prend du temps .....

goos01 · Answer

Ok...

Utilisateur anonyme · Answer

RE :

telecharge et instal AVG anti spyware :

http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware

met le a jours et lance le scan 

ensuite envoi le rapport sur le forum stp

goos01 · Answer

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	00:00:11 30/05/2008

 + Résultat de l'analyse:	



C:\Program Files\AdwarePunisher\database.dat -> Adware.AdwarePunisher : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP560\A0135793.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP560\A0135837.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP560\A0135882.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP561\A0135912.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP561\A0135954.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP561\A0135977.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP562\A0136064.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP562\A0136109.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP563\A0136152.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP564\A0136186.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP564\A0136221.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP564\A0136261.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP565\A0136299.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP565\A0136343.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136402.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136434.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136445.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136474.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136512.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136536.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136570.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136591.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136611.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136665.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136686.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136703.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP566\A0136738.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP567\A0136801.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP567\A0136827.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP568\A0136885.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP568\A0136901.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP568\A0136921.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP568\A0137925.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP568\A0137953.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP568\A0137996.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP568\A0138026.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP568\A0138043.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP568\A0138089.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP568\A0138119.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138138.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138160.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138184.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138223.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138247.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138300.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138321.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138332.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138358.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138383.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP569\A0138399.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0138562.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139556.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139580.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139619.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0139639.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140639.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140660.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140680.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP570\A0140734.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140787.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP572\A0140789.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0142897.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP576\A0142983.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP576\A0142996.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP577\A0143013.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP578\A0143160.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP578\A0143201.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP578\A0143294.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP579\A0143350.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP579\A0143366.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP579\A0143403.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP579\A0143421.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP579\A0143466.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP580\A0143503.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP580\A0143530.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP580\A0143549.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP580\A0143580.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP580\A0143603.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP580\A0143613.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP580\A0143634.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP580\A0143649.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP581\A0143679.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP581\A0143700.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP581\A0143732.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP582\A0143750.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP582\A0143778.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP582\A0143808.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP582\A0143836.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP582\A0143867.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP582\A0143894.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP582\A0144894.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP583\A0144970.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP584\A0145026.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP584\A0145071.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP584\A0145079.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP584\A0145131.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP584\A0145153.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP584\A0145171.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP584\A0145186.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP584\A0145233.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP584\A0145262.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP585\A0145292.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP585\A0145329.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP585\A0145358.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP585\A0145385.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP585\A0145393.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP585\A0145435.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP585\A0145447.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP585\A0145472.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP586\A0145508.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP586\A0145516.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP586\A0145545.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP586\A0145558.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP586\A0145614.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP586\A0145630.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP586\A0145680.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP587\A0145751.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP587\A0145786.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP587\A0146786.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP587\A0146819.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP587\A0146841.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP587\A0146874.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP587\A0146890.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP587\A0146913.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP587\A0146950.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP588\A0146988.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP588\A0147002.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP588\A0147037.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP588\A0147052.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP589\A0147099.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP589\A0147134.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP590\A0147154.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP590\A0147172.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP590\A0147213.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP590\A0147234.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP591\A0147411.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP591\A0147420.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP591\A0147435.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP591\A0147449.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP591\A0147477.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP591\A0147494.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP591\A0147516.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP591\A0147524.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP591\A0147557.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP591\A0148559.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP591\A0148574.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP592\A0148620.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP592\A0148637.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP592\A0149638.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP592\A0149672.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP592\A0149684.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP592\A0149703.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP592\A0149751.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP593\A0149807.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP593\A0149827.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP593\A0149869.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP593\A0149888.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP593\A0149929.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP594\A0149995.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP594\A0150024.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP595\A0150103.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP595\A0150138.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP595\A0150182.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP596\A0150245.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP596\A0150267.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP596\A0150322.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP596\A0150348.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP596\A0150376.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP597\A0150409.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP598\A0151409.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP598\A0151424.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP598\A0151477.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP598\A0151499.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP599\A0151540.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP600\A0152540.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP601\A0152588.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP602\A0152624.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP602\A0152660.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP602\A0152681.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP602\A0152698.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP602\A0152709.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP602\A0152726.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP602\A0152783.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP604\A0152818.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP604\A0152854.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP605\A0152902.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP605\A0152981.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP605\A0152996.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP606\A0153039.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP606\A0153073.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP606\A0153101.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP607\A0153156.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP607\A0153174.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP608\A0153207.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP608\A0153241.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP608\A0153280.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP608\A0153352.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP609\A0153425.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP610\A0153474.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP610\A0153496.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP610\A0153531.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP610\A0153560.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP610\A0153578.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP610\A0153627.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP611\A0153683.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP611\A0153757.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP612\A0153833.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP612\A0153868.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP612\A0154034.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP612\A0154068.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP613\A0154106.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP613\A0154132.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP614\A0154167.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP614\A0154209.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP615\A0154279.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP615\A0154324.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP615\A0154356.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP616\A0154395.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP616\A0154456.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP617\A0154521.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP618\A0154557.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP618\A0154585.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP619\A0154638.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP619\A0154699.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP619\A0154751.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP619\A0154799.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP619\A0154833.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP619\A0154860.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP620\A0154890.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP620\A0154912.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP621\A0154941.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP623\A0155501.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP625\A0155980.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP626\A0155991.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP627\A0156017.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP628\A0156047.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP628\A0156080.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP629\A0156311.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP630\A0157308.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP630\A0158308.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP630\A0158338.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP630\A0158368.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP630\A0159386.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP630\A0159421.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP631\A0160464.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP632\A0160495.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP632\A0160517.exe -> Adware.Bestofer : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP634\A0160588.exe -> Adware.Bestofer : Ignoré.
C:\Program Files\TBONBin -> Adware.BetterInternet : Ignoré.
C:\Program Files\TBONBin\TBONInst.cfg -> Adware.BetterInternet : Ignoré.
C:\Program Files\TBONBin\Uninstall.exe -> Adware.BetterInternet : Ignoré.
C:\Program Files\TBONBin	bon.exe -> Adware.BetterInternet : Ignoré.
C:\WINDOWS\system32\ptpusb32.dll -> Adware.Stud : Ignoré.
[1588] C:\WINDOWS\system32\ptpusb32.dll -> Adware.Stud : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP630\A0159434.exe -> Logger.Agent.ln : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP632\A0160475.dll -> Logger.Agent.ln : Ignoré.
C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\Cache(2)\82AFA4A2d01 -> Not-A-Virus.Downloader.Win32.WinFixer.au : Ignoré.
C:\Documents and Settings\Max\Application Data\Sun\Java\Deployment\cache\6.0\20\533dd614-526c1036 -> Not-A-Virus.ExploitByteVerify : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0141008.exe -> Not-A-Virus.PUP.AdvancedCleaner : Ignoré.
C:\System Volume Information\_restore{B8687C25-491C-4B92-A950-D228172F494F}\RP573\A0141007.exe -> Not-A-Virus.PUP.AdvancedCleaner.a : Ignoré.
C:\Documents and Settings\Max\Cookies\max@2o7[2].txt -> TrackingCookie.2o7 : Ignoré.
C:\Documents and Settings\Max\Cookies\max@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Ignoré.
C:\Documents and Settings\Max\Cookies\max@shopping.112.2o7[1].txt -> TrackingCookie.2o7 : Ignoré.
:mozilla.103:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Adrevolver : Ignoré.
:mozilla.104:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Adrevolver : Ignoré.
:mozilla.105:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Adrevolver : Ignoré.
C:\Documents and Settings\Max\Cookies\max@adrevolver[1].txt -> TrackingCookie.Adrevolver : Ignoré.
C:\Documents and Settings\Max\Cookies\max@dynamic.media.adrevolver[1].txt -> TrackingCookie.Adrevolver : Ignoré.
C:\Documents and Settings\Max\Cookies\max@media.adrevolver[1].txt -> TrackingCookie.Adrevolver : Ignoré.
C:\Documents and Settings\Max\Cookies\max@advertising[2].txt -> TrackingCookie.Advertising : Ignoré.
:mozilla.101:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Atdmt : Ignoré.
C:\Documents and Settings\Max\Cookies\max@bluestreak[1].txt -> TrackingCookie.Bluestreak : Ignoré.
C:\Documents and Settings\Max\Cookies\max@banner.casinoking[2].txt -> TrackingCookie.Casinoking : Ignoré.
:mozilla.54:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Comclick : Ignoré.
:mozilla.55:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Comclick : Ignoré.
:mozilla.56:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Comclick : Ignoré.
:mozilla.270:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Dealtime : Ignoré.
C:\Documents and Settings\Max\Cookies\max@stat.dealtime[2].txt -> TrackingCookie.Dealtime : Ignoré.
:mozilla.100:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Doubleclick : Ignoré.
C:\Documents and Settings\Max\Cookies\max@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignoré.
:mozilla.271:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Enhance : Ignoré.
:mozilla.272:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Enhance : Ignoré.
C:\Documents and Settings\Max\Cookies\max@enhance[2].txt -> TrackingCookie.Enhance : Ignoré.
:mozilla.38:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Estat : Ignoré.
C:\Documents and Settings\Max\Cookies\max@estat[1].txt -> TrackingCookie.Estat : Ignoré.
C:\Documents and Settings\Max\Cookies\max@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Ignoré.
C:\Documents and Settings\Max\Cookies\max@fastclick[1].txt -> TrackingCookie.Fastclick : Ignoré.
:mozilla.173:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Goldenpalace : Ignoré.
:mozilla.176:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Goldenpalace : Ignoré.
:mozilla.177:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Goldenpalace : Ignoré.
:mozilla.178:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Goldenpalace : Ignoré.
:mozilla.444:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Imrworldwide : Ignoré.
:mozilla.445:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Imrworldwide : Ignoré.
C:\Documents and Settings\Max\Cookies\max@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : Ignoré.
:mozilla.227:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Masterstats : Ignoré.
:mozilla.123:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Mediaplex : Ignoré.
C:\Documents and Settings\Max\Cookies\max@need2find[1].txt -> TrackingCookie.Need2find : Ignoré.
:mozilla.62:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.63:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.64:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.65:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.66:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.67:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.68:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
C:\Documents and Settings\Max\Cookies\max@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Ignoré.
C:\Documents and Settings\Max\Cookies\max@serving-sys[2].txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.106:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.
:mozilla.112:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.
:mozilla.114:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.
:mozilla.115:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.
C:\Documents and Settings\Max\Cookies\max@smartadserver[1].txt -> TrackingCookie.Smartadserver : Ignoré.
C:\Documents and Settings\Max\Cookies\max@statcounter[1].txt -> TrackingCookie.Statcounter : Ignoré.
C:\Documents and Settings\Max\Cookies\max@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Ignoré.
C:\Documents and Settings\Max\Cookies\max@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Ignoré.
C:\Documents and Settings\Max\Cookies\max@reduxads.valuead[1].txt -> TrackingCookie.Valuead : Ignoré.
:mozilla.122:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\p9t9v94n.default\cookies.txt -> TrackingCookie.Weborama : Ignoré.
C:\Documents and Settings\Max\Cookies\max@aimfar.solution.weborama[2].txt -> TrackingCookie.Weborama : Ignoré.
C:\Documents and Settings\Max\Cookies\max@intermarche.solution.weborama[2].txt -> TrackingCookie.Weborama : Ignoré.
C:\Documents and Settings\Max\Cookies\max@samsung.solution.weborama[2].txt -> TrackingCookie.Weborama : Ignoré.
C:\Documents and Settings\Max\Cookies\max@sodebo.solution.weborama[2].txt -> TrackingCookie.Weborama : Ignoré.
C:\Documents and Settings\Max\Cookies\max@weborama[2].txt -> TrackingCookie.Weborama : Ignoré.
C:\Documents and Settings\Max\Cookies\max@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Ignoré.
C:\Documents and Settings\Max\Cookies\max@ad.yieldmanager[3].txt -> TrackingCookie.Yieldmanager : Ignoré.
C:\Documents and Settings\Max\Cookies\max@zedo[2].txt -> TrackingCookie.Zedo : Ignoré.


Fin du rapport

Utilisateur anonyme · Answer

t a supprimé ce qu il a trouvé ???

goos01 · Answer

Justement, je cherche a savoir comment faire

goos01 · Answer

c'est bon,j 'ai trouvé, tout est suprimé.

Utilisateur anonyme · Answer

OK refais un scan hijackthis et poste le  rapport stp

goos01 · Answer

Le voila

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:21:07, on 30/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0E150220-858B-4060-ADBD-BD17EA4B145B} - C:\WINDOWS\system32\ptpusb32.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin	bon.exe /r
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ladchkr - Unknown owner - C:\WINDOWS\system32\ladchkr.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Utilisateur anonyme · Answer

Copie le texte ci-dessous : 



File:: 
C:\WINDOWS\QTFont.qfn 
C:\WINDOWS\QTFont.for 
C:\WINDOWS\system32\MRT.INI 
C:\WINDOWS\system32\lsdelete.exe 
C:\WINDOWS\cnerolf.dat 
C:\Documents and Settings\Max\Application Data\ViewerApp.dat 
C:\Documents and Settings\Max\Application Data\wklnhst.dat 
C:\WINDOWS\system32\ptpusb32.dll
C:\program files\altnet\points manager\points manager.exe
C:\Program Files\TBONBin	bon.exe 
C:\DOCUME~1\Max\APPLIC~1\ACEMOR~1	rans proxy.exe
C:\Program Files\HPQ\Default Settings\cpqset.exe????????0?1?0?9??????? ???B?????????????hLC? ?????? 


Folder:: 
c:\program files\altnet
C:\Program Files\TBONBin 


Registry:: 
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0E150220-858B-4060-ADBD-BD17EA4B145B}] 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"tbon"=-
"Noun pop"=-



Ouvre le Bloc-Notes puis colle le texte copié. 
(Démarrer\Tous les programmes\Accessoires\Bloc notes.) 
Sauvegarde ce fichier sous le nom de CFScript.txt. 

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous : 

http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif 

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide. 

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! 

Ne touche à rien tant que le scan n'est pas terminé.

goos01 · Answer

le voila: ComboFix 08-05-29.1 - Max 2008-05-30 0:50:11.3 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.552 [GMT 2:00] Endroit: C:\Documents and Settings\Max\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Max\Bureau\CFScript.txt..txt [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE :: C:\DOCUME~1\Max\APPLIC~1\ACEMOR~1 rans proxy.exe C:\Documents and Settings\Max\Application Data\ViewerApp.dat C:\Documents and Settings\Max\Application Data\wklnhst.dat C:\program files\altnet\points manager\points manager.exe C:\Program Files\TBONBin bon.exe C:\WINDOWS\cnerolf.dat C:\WINDOWS\QTFont.for C:\WINDOWS\QTFont.qfn C:\WINDOWS\system32\lsdelete.exe C:\WINDOWS\system32\MRT.INI C:\WINDOWS\system32\ptpusb32.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Max\Application Data\ViewerApp.dat C:\Documents and Settings\Max\Application Data\wklnhst.dat C:\Program Files\TBONBin C:\Program Files\TBONBin bon.exe C:\WINDOWS\cnerolf.dat C:\WINDOWS\QTFont.for C:\WINDOWS\QTFont.qfn C:\WINDOWS\system32\lsdelete.exe C:\WINDOWS\system32\MRT.INI . ((((((((((((((((((((((((((((( Fichiers créés 2008-04-28 to 2008-05-29 )))))))))))))))))))))))))))))))))))) . 2008-05-29 22:05 . 2008-05-29 22:05 d-------- C:\Documents and Settings\Max\Application Data\Grisoft 2008-05-29 22:05 . 2008-05-29 22:05 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-05-29 22:05 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-05-29 19:11 . 2008-05-29 19:20 d-------- C:\Program Files\Lopxp 2008-05-29 18:49 . 2008-05-29 18:49 d-------- C:\WINDOWS\LastGood 2008-05-29 18:28 . 2008-05-29 18:28 d-------- C:\Program Files\Sunbelt Software 2008-05-29 17:39 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-05-29 17:39 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-05-29 17:39 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-05-29 17:39 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-05-29 17:39 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe 2008-05-29 17:39 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-05-29 17:39 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-05-29 17:39 . 2008-05-29 17:58 5,244 --a------ C:\WINDOWS\system32 mp.reg 2008-05-29 17:24 . 2008-05-29 17:24 d-------- C:\Program Files\Avira 2008-05-29 17:24 . 2008-05-29 17:24 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-05-29 16:01 . 2008-05-29 16:01 d-------- C:\Documents and Settings\Max\Application Data\Malwarebytes 2008-05-29 16:00 . 2008-05-29 16:01 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-29 16:00 . 2008-05-29 16:00 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-05-29 16:00 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-05-29 16:00 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-05-29 14:24 . 2008-05-29 14:24 d-------- C:\Program Files\Lavasoft 2008-05-29 14:24 . 2008-05-29 14:25 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-05-29 13:59 . 2008-05-29 13:59 d-------- C:\Program Files\Trend Micro 2008-05-29 13:46 . 2008-05-29 13:46 10,279,675 --a------ C:\upload_moi_MAXIME.tar.gz 2008-05-29 13:08 . 2008-05-29 13:16 d-------- C:\Lop SD 2008-05-29 12:57 . 2008-05-29 20:45 d-------- C:\Program Files\Navilog1 2008-05-27 18:56 . 2008-05-27 18:56 d-------- C:\Documents and Settings\Max\Application Data\Joost 2008-05-27 18:11 . 2008-05-27 18:11 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-29 11:20 . 2008-04-29 11:20 15,648 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys 2008-04-29 11:19 . 2008-04-29 11:19 15,648 --a------ C:\WINDOWS\system32\drivers\Awrtrd.sys 2008-04-29 11:19 . 2008-04-29 11:19 12,960 --a------ C:\WINDOWS\system32\drivers\Awrtpd.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-29 22:17 --------- d-----w C:\Program Files\AdwarePunisher 2008-05-29 12:23 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-05-27 16:42 --------- d-----w C:\Program Files\BitTorrent Fastest Tool 2008-05-27 16:41 --------- d-----w C:\Program Files\ABC Amber Text2Image Converter 2008-05-27 14:42 --------- d-----w C:\Program Files\eMule 2008-04-08 16:28 --------- d-----w C:\Program Files\Java 2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:51 621,344 ------w C:\WINDOWS\system32\dllcache\mswstr10.dll 2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-25 04:51 194,144 ------w C:\WINDOWS\system32\dllcache\msjint40.dll 2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-20 08:09 1,845,376 ------w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-01 16:28 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-02-29 08:57 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-02-29 08:56 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-12-23 12:58 62,344 -c--a-w C:\Documents and Settings\Max\Application Data\GDIPFONTCACHEV1.DAT 2006-01-15 12:48 278,528 -c--a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0E150220-858B-4060-ADBD-BD17EA4B145B}] C:\WINDOWS\system32\ptpusb32.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 10:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe" [2006-12-17 14:23 165304] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208] "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2007-10-22 21:42 190024] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-20 21:15 344064] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11 1388544] "AGRSMMSG"="AGRSMMSG.exe" [2005-04-13 12:12 88209 C:\WINDOWS\AGRSMMSG.exe] "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2005-02-08 18:38 159744] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-05-04 10:59 794624] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-10-13 16:04 278528] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 13:54 253952] "eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 13:24 290816] "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-03-29 14:45 233534] "ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184] "ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920] "PCLEPCI"="C:\PROGRA~1\Pinnacle\PPE\PPE.EXE" [2004-02-03 15:13 49152] "USBToolTip"="C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe" [2005-06-13 02:30 192512] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-05 10:00 110592 C:\WINDOWS\system32\bthprops.cpl] "AltnetPointsManager"="c:\program files\altnet\points manager\points manager.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792] "PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 01:26 406016] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2007-09-08 18:16 185632] "NWEReboot"="" [] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2007-10-22 21:42 190024] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ HP Digital Imaging Monitor.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624] Picture Package Menu.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2006-06-24 18:22:07 151552] Picture Package VCD Maker.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2006-06-24 18:21:59 106496] Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 15:40:46 118784] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MJPG"= Pvmjpg30.dll "VIDC.PIM1"= pclepim1.dll "VIDC.I420"= vdrcodec.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\Program Files\eMule\emule.exe"= "C:\Program Files\Pinnacle\Studio 10\programs\RM.exe"= "C:\Program Files\Pinnacle\Studio 10\programs\PMSRegisterFile.exe"= "C:\WINDOWS\system32\sessmgr.exe"= "C:\WINDOWS\system32\usmt\migwiz.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpfccopy.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpoews01.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpofxm08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hposfx08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hposid01.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqCopy.exe"= "C:\Program Files\Hp\Digital Imaging\Unload\HpqDIA.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqkygrp.exe"= "C:\Program Files\Hp\Digital Imaging\Unload\HpqPhUnl.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqscnvw.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqste08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpzwiz01.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\Program Files\Pinnacle\Studio 10\programs\Studio.exe"= "C:\Program Files\Joost\xulrunner\tvprunner.exe"= "C:\Program Files\Pinnacle\Studio 10\programs\umi.exe"= R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21] R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21] R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21] S2 ladchkr;ladchkr;C:\WINDOWS\system32\ladchkr.exe [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3197db24-6cf6-11dc-9167-00150023b77f}] \Shell\AutoRun\command - E:\LaunchU3.exe *Newly Created Service* - AVG_ANTI-SPYWARE_DRIVER *Newly Created Service* - AVG_ANTI-SPYWARE_GUARD *Newly Created Service* - FWDRV *Newly Created Service* - KHIPS *Newly Created Service* - SPF4 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\assfxcs] C:\WINDOWS\system32\assfxcs.exe . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-05-29 10:15:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-05-29 22:00:02 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe "2008-05-16 23:13:44 C:\WINDOWS\Tasks\HubTask 0 {0E7C166E-2D2F-4269-9034-DE1898BF2B1A} 0~0.job" - C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Mediahub.exe "2008-05-29 22:41:22 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-30 00:59:09 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????0?1?0?9??????? ???B?????????????hLC? ?????? Balayage des fichiers cachés ... ************************************************************************** . Temps d'accomplissement: 2008-05-30 1:03:40 ComboFix-quarantined-files.txt 2008-05-29 23:02:32 ComboFix2.txt 2008-05-29 16:59:39 Pre-Run: 6,989,185,024 octets libres Post-Run: 6,976,892,928 octets libres 207 --- E O F --- 2008-05-20 11:41:05

Utilisateur anonyme · Answer

parfais 


refais un scan hijackthis et poste le stp

goos01 · Answer

voilou: 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:11:42, on 30/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0E150220-858B-4060-ADBD-BD17EA4B145B} - C:\WINDOWS\system32\ptpusb32.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ladchkr - Unknown owner - C:\WINDOWS\system32\ladchkr.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

higelin22 · Answer

y reste toujours altnet a supprimer non?

Utilisateur anonyme · Answer

Réouvre hijackthis 

fais scan only 
coche ces lignes :

O2 - BHO: (no name) - {0E150220-858B-4060-ADBD-BD17EA4B145B} - C:\WINDOWS\system32\ptpusb32.dll (file missing) 

O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) 

tu les coches et tu clic sur fix checked 

ensuite fais ça :

Démarrer > executer > ' services.msc ' , 

- Clic droit sur le service cité - ladchkr
- propriétés 
- et dans "type de démarrage" et mets le sur « désactivé ». 
- Ensuite si le "Status du service" est sur "Démarré" faire : « arrêté » 

Tutorial : https://www.zebulon.fr/dossiers/windows/31-services.html 


ensuite désinstal java car pas a jours (faille de sécurité) et telecharge et instal cette version :


https://www.java.com/fr/download/manual.jsp


ensuite fais ça :

télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. 
double-clique sur OTMoveIt.exe pour le lancer. 
copie la ligne qui se trouve ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 


c:\program files\altnet\points manager\points manager.exe 


clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. + un rapport hijackthis fais apres passage de otmoveit

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

goos01 · Answer

rapport otmovit :
File/Folder c:\program files\altnet\points manager\points manager.exe not found.
 
OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 05302008_013945


rapport hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:41:51, on 30/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Utilisateur anonyme · Answer

OK on va devoir recommencer otmovit 


double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en gras ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

c:\program files\altnet\points manager\points manager.exe -s 


clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

goos01 · Answer

File/Folder  not found.
File/Folder c:\program files\altnet\points manager\points manager.exe -s not found.
 
OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 05302008_014811

Utilisateur anonyme · Answer

ok reste une crasse mais on finira demain si tu veux bien

en attendant regarde dans poste de travail
entre dans le disque C
Entre dans programmes 
et supprime le dossier : altnet

si il est present et dis le moi 

si tu le trouve et que tu le supprime refais un scan hijackthis et poste le rapport stp 

bonne nuit 

@+

goos01 · Answer

ok,, merci pour ton aide, bonne nuit. je regarde ca et je te tien au courant demain
@+

goos01 · Answer

Bonjour, je n'est pas trouvé altnet dans programme

Utilisateur anonyme · Answer

SALUT 

apparrement reste un petite saleté 


telecharge Ccleaner :

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

instal le sans la barre yahoo 

fais lancer le nettoyage

repete l opération jusqu a ce qu il trouve rien 

ensuite fais registre

fais chercher les erreures 

ensuite fais corriger les erreures 

repete l opération jusqu a ce qu il trouve rien 


ensuite :


lance reg cleaner pour nettoyer le registre un peux plus 


http://manuelsdaide.com/RegCleaner/RegCleaner.htm 
________________ 



ensuite refais un scan hijackthis et psote le rapport stp

goos01 · Answer

pour regcleaner, je suis un peu perdu, il faut que je supprime tout ce qu'il y a dans la liste?

Utilisateur anonyme · Answer

pour regcleaner 

ouvre le et clic sur TOOL

Choisi registri cleanup

clic sur automatic registry cleaner

laisse scanner et supprime tout

goos01 · Answer

merci, 
voila le rapport hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:50:50, on 30/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Utilisateur anonyme · Answer

et voila ton pc est enfin propre 


bon petite chose :

il est hyper dangereux de s avanturer sur le net sans un pare feu valable et un antivirus !!!!




* pour supprimer les outils/fix utilisés : 

Télécharge ToolsCleaner sur ton bureau. 
--> https://www.commentcamarche.net/telecharger/ 34055291 toolsclean(...) 
# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

goos01 · Answer

ok, merci, mais le dernier lien n'est pas valide...

Je peut te demander une derniere chose si ca te dérange pas?

goos01 · Answer

c'est bon j 'ai trouvé tools cleaner, je post le rapprort des que c'est fini

Utilisateur anonyme · Answer

ok

goos01 · Answer

des que j'envoie "rechercher" sur toolscleaner, le prog se bloque et il ne répond pas...

Utilisateur anonyme · Answer

Réessai en mode sans echec

sinon faudra tout supprimer manuellement (hijackthis combofix smthfraud etc)

goos01 · Answer

effectivement, en mode sans echec ca ne marche pas non plus

Utilisateur anonyme · Answer

ok appremment toolcleaner a été retiré du net 

enfin bref 

Supprime les icones des fix qu il y a sur ton bureau 

vas dans poste de travail
entre dans le disque C

supprime combofix 

Qoobox

smithfraud etc 

fais le tour ...


Pour te proteger garde antivir

ton parefeu

malewarebyte et ccleaner et aussi avg 


fais des scan de temps en temps 



Si tu es satisfait de mon intervention

et que tu n as plus de probleme 

change le statut du sujet en résolu stp

pour cela va en haut sur ta premiere question et la tu as le choix

goos01 · Answer

Merci, je suis plus que satisfait, je n'imaginait pas qu'on allait m'aider aussi rapidement et qu'on alllait m'accorder autant de temps. merci pour tout.

Par contre, je peut te demander une derniere faveur?

j'ai mes ports usb qui deconnent, en fait, j'ai un message qui me met "crête d'alimentation sur le port concentrateur" "un peripherique usb a dépassé les limites de l'alimentation de concentrateur."
que pui'je faire?

Utilisateur anonyme · Answer

appremment ce peripherique est mort 


faut le localiser 

et voir si possible de changer le cable 

ciao @ +

goos01 · Answer

merci @+

Utilisateur anonyme · Answer

de nada

Rapport hijackthis et autres problemes

63 réponses

Discussions similaires

Newsletters