Analyse navilog

cyrus 34 -  
Bonjour,
je suis infesté de pub j'ai installé navilog
est-ce que qSearch Navipromo version 3.6.3 commencé le 14/08/2008 à 15:58:15,63

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Proprietaire"

Mise à jour le 09.08.2008 à 18h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***

*** Recherche dossiers dans "C:\Windows" ***

*** Recherche dossiers dans "C:\Program Files" ***

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***

*** Recherche dossiers dans "C:\ProgramData" ***

*** Recherche dossiers dans "c:\users\propri~1\appdata\roaming\micros~1\windows\startm~1\programs" ***

*** Recherche dossiers dans "C:\Users\Proprietaire\AppData\Local\virtualstore\Program Files" ***

*** Recherche dossiers dans "C:\Users\Proprietaire\AppData\Roaming" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

uelqun peut m'aider merci.
Configuration: Windows Vista
Internet Explorer 7.0

25 réponses

Résumé de la discussion

Le fil porte sur une infection publicitaire après l’installation de Navilog et la détection potentielle de modules comme qSearch Navipromo version 3.6.3, le tout enregistré dans un rapport système. Les réponses suggèrent des actions de diagnostic et de désinfection, notamment désactiver l’UAC sous Vista avant d’exécuter Navilog et recourir à HijackThis pour repérer d’éventuelles infections. D'autres conseils portent sur l’analyse de fichiers cachés, l’utilisation de VirusTotal pour les rapports suspects, et la nécessité de recueillir des logs avec HijackThis sans modifier prématurément le système. En cas d’infection persistante, l’analyse peut nécessiter la comparaison de rapports HijackThis et des scans en ligne comme VirusTotal, afin d’identifier des fichiers malveillants cachés dans les répertoires système.

Bobot (l’IA à votre service)
  1. toptitbal Contributeur sécurité
    Bonjour

    Tu es sous Vista, il faut désactiver l'UAC avant de lancer Navilog :

    Désactive le contrôle des comptes utilisateurs
    (tu le réactiveras après ta désinfection):

    * Va dans démarrer puis panneau de configuration
    * Double Clique sur l'icône "Comptes d'utilisateurs"
    * Clique ensuite sur désactiver et valide.
    1. jfkpresident Contributeur sécurité
      ton log est propre ;

      fais moi plaisir et vire moi shareaza >>c'est une grosse daube ;)

      tu peux désinstaller si tu le souhaite le service "Boonty games" >>exécuter>>services.msc>>>supprimer .

      vérifie que ton pare-feu soit bien activé .

      Si tu as des questions ,sinon tu peux mettre ton post en résolu .
      1. cyrus 34 Auteur
        jfk voici le rapport hijacthis du 21 08 08Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 12:19:25, on 14/08/2008
        Platform: Windows Vista SP1 (WinNT 6.00.1905)
        MSIE: Internet Explorer v7.00 (7.00.6001.18000)
        Boot mode: Normal

        Running processes:
        C:\Windows\System32\smss.exe
        C:\Windows\system32\csrss.exe
        C:\Windows\system32\wininit.exe
        C:\Windows\system32\csrss.exe
        C:\Windows\system32\services.exe
        C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsm.exe
        C:\Windows\system32\winlogon.exe
        C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe
        C:\Windows\system32\svchost.exe
        C:\Windows\system32\SLsvc.exe
        C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
        C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
        C:\Windows\System32\spoolsv.exe
        C:\Windows\system32\svchost.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\Windows\system32\svchost.exe
        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
        C:\Program Files\Spyware Doctor\pctsAuxs.exe
        C:\Program Files\Spyware Doctor\pctsSvc.exe
        C:\Windows\system32\taskeng.exe
        C:\Windows\system32\svchost.exe
        C:\Windows\System32\svchost.exe
        C:\Windows\system32\SearchIndexer.exe
        C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
        C:\Windows\system32\WUDFHost.exe
        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
        C:\Windows\system32\taskeng.exe
        C:\Windows\system32\Dwm.exe
        C:\Windows\Explorer.EXE
        C:\Program Files\Windows Defender\MSASCui.exe
        C:\Windows\RtHDVCpl.exe
        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
        C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        C:\Program Files\Common Files\Symantec Shared\ccApp.exe
        C:\Windows\ZSSnp211.exe
        C:\Windows\Domino.exe
        C:\Windows\System32\rundll32.exe
        C:\Program Files\Spyware Doctor\pctsTray.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
        C:\Program Files\Windows Sidebar\sidebar.exe
        C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
        C:\Program Files\Windows Media Player\wmpnscfg.exe
        C:\Program Files\e-Carte Bleue La Banque Postale\ecbl-lbp.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Windows\System32\rundll32.exe
        C:\Program Files\Windows Media Player\wmpnetwk.exe
        C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
        C:\Windows\system32\conime.exe
        C:\Windows\system32\wuauclt.exe
        C:\Program Files\Internet Explorer\IEUser.exe
        C:\Windows\System32\mobsync.exe
        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
        C:\Program Files\Shareaza\Shareaza.exe
        C:\Users\Proprietaire\Downloads\HiJackThis.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
        C:\Windows\system32\wbem\wmiprvse.exe
        C:\Windows\system32\NOTEPAD.EXE

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
        R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O1 - Hosts: ::1 localhost
        O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
        O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
        O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
        O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
        O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
        O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
        O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
        O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
        O4 - HKLM\..\Run: [ZSSnp211] C:\Windows\ZSSnp211.exe
        O4 - HKLM\..\Run: [Domino] C:\Windows\Domino.exe
        O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
        O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
        O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
        O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
        O4 - HKCU\..\Run: [title free] "C:\ProgramData\ford bold bold.4v4a14"
        O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
        O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
        O4 - Global Startup: e-Carte Bleue La Banque Postale.lnk = C:\Program Files\e-Carte Bleue La Banque Postale\ecbl-lbp.exe
        O4 - Global Startup: OFFICE One Startup v7.lnk = ?
        O13 - Gopher Prefix:
        O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
        O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
        O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
        O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
        O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
        O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
        O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
        O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
        O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
        O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
        O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
        O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
        O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
        O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
        O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
        O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
        3. cyrus 34 Auteur
          salut jfk ,voici le résultat de virus total | עברית | | Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español | English
          Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
          Fichier Domino.exe reçu le 2008.08.22 04:04:17 (CET)
          Situation actuelle: terminé

          Résultat: 0/34 (0.00%)
          Formaté Impression des résultats
          Antivirus Version Dernière mise à jour Résultat
          AhnLab-V3 2008.8.21.0 2008.08.21 -
          AntiVir 7.8.1.23 2008.08.21 -
          Authentium 5.1.0.4 2008.08.22 -
          Avast 4.8.1195.0 2008.08.21 -
          BitDefender 7.2 2008.08.22 -
          CAT-QuickHeal 9.50 2008.08.21 -
          ClamAV 0.93.1 2008.08.21 -
          DrWeb 4.44.0.09170 2008.08.21 -
          eSafe 7.0.17.0 2008.08.21 -
          eTrust-Vet 31.6.6039 2008.08.21 -
          Ewido 4.0 2008.08.21 -
          F-Prot 4.4.4.56 2008.08.21 -
          Fortinet 3.14.0.0 2008.08.21 -
          GData 2.0.7306.1023 2008.08.20 -
          Ikarus T3.1.1.34.0 2008.08.22 -
          K7AntiVirus 7.10.423 2008.08.21 -
          Kaspersky 7.0.0.125 2008.08.22 -
          McAfee 5367 2008.08.21 -
          Microsoft 1.3807 2008.08.22 -
          NOD32v2 3377 2008.08.22 -
          Norman 5.80.02 2008.08.21 -
          Panda 9.0.0.4 2008.08.21 -
          PCTools 4.4.2.0 2008.08.21 -
          Prevx1 V2 2008.08.22 -
          Rising 20.58.32.00 2008.08.21 -
          Sophos 4.32.0 2008.08.22 -
          Sunbelt 3.1.1571.1 2008.08.22 -
          Symantec 10 2008.08.22 -
          TheHacker 6.3.0.6.058 2008.08.22 -
          TrendMicro 8.700.0.1004 2008.08.21 -
          VBA32 3.12.8.4 2008.08.21 -
          ViRobot 2008.8.21.1344 2008.08.21 -
          VirusBuster 4.5.11.0 2008.08.21 -
          Webwasher-Gateway 6.6.2 2008.08.22 -
          Information additionnelle
          File size: 49152 bytes
          MD5...: 5603c2c8940f5e43864d4000304ab175
          SHA1..: f22234ed04ad1220b28cacaabc2ab0361ce6fe11
          SHA256: aea3c84d561c605bb42968e98c6024909b6ad8cba64c45aed6343495fc78ab58
          SHA512: 02e2d0812465aeef722d041b45618385c9cbea27eb85e6dcfef55d0e5fc7a0e3
          cf5cdf6df05c5b9ec79aee540a32f8faf2d9a3371c2b6902382a4529892c9ea6
          PEiD..: InstallShield 2000
          PEInfo: PE Structure information

          ( base data )
          entrypointaddress.: 0x402590
          timedatestamp.....: 0x44e58125 (Fri Aug 18 08:58:13 2006)
          machinetype.......: 0x14c (I386)

          ( 4 sections )
          name viradd virsiz rawdsiz ntrpy md5
          .text 0x1000 0x5475 0x6000 5.99 eb40aa04898b145b39ad6fed65d76aea
          .rdata 0x7000 0xd0e 0x1000 4.86 ac8f8ad613fec801923e04b97959ead4
          .data 0x8000 0x5a98 0x3000 0.65 d87ce043bef47f3a61d4950c786abbce
          .rsrc 0xe000 0x360 0x1000 0.90 aafef067de0eebfa29c644d3bdefbed3

          ( 4 imports )
          > KERNEL32.dll: CloseHandle, GetLastError, CreateMutexA, UnmapViewOfFile, MapViewOfFile, Sleep, CreateFileMappingA, GetSystemTime, SetFilePointer, LoadLibraryA, GetProcAddress, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, FlushFileBuffers, SetStdHandle, IsBadCodePtr, IsBadWritePtr, IsBadReadPtr, SetUnhandledExceptionFilter, VirtualAlloc, WriteFile, VirtualFree, HeapCreate, HeapDestroy, GetFileType, GetStdHandle, SetHandleCount, RtlUnwind, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, GetVersion, ExitProcess, HeapFree, HeapAlloc, WideCharToMultiByte, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, GetModuleFileNameA, FreeEnvironmentStringsA, MultiByteToWideChar, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, GetCPInfo, GetACP, GetOEMCP
          > USER32.dll: DispatchMessageA, TranslateMessage, TranslateAcceleratorA, GetMessageA, LoadAcceleratorsA, RegisterDeviceNotificationA, UnregisterDeviceNotification, RegisterClassExA, CreateWindowExA, PostQuitMessage, DefWindowProcA
          > ole32.dll: CreateBindCtx, CoUninitialize, CoGetMalloc, CoCreateInstance, MkParseDisplayName, CoInitialize
          > OLEAUT32.dll: -, -

          ( 0 exports )

          ThreatExpert info: https://www.symantec.com?md5=5603c2c8940f5e43864d4000304ab175

          ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

          VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy
          1. jfkpresident Contributeur sécurité
            re; je comprend pas trop ta question ? tu clique sur parcourir et tu cherche ce fichier : C:\Windows\Domino.exe

            le chemin est : C:\ >>> windows>>>>domino.exe
            1. cyrus 34 Auteur
              bonsioir jfk , ou sont exactement les dossiers en tranparence dans l'explorateur de windows, donne moi le chemin d'accès, merci
              1. jfkpresident Contributeur sécurité
                Il va falloir analyser un ou des fichier(s) suspect(s) !

                Il se peut qu'il se trouvent dans les " dossiers cachés " du systeme.
                Il faut donc les rendre visibles pour le scan.

                Pour afficher les dossiers et fichiers cachés:

                Panneau de configuration > Options des dossiers > onglet Affichage.

                Coche Afficher les fichiers et dossiers cachés,
                Décoche Masquer les extensions de fichiers connus
                Décoche Masquer les fichiers protégés du Système.
                Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
                Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence.

                Rends toi sur ce site :

                https://www.virustotal.com/gui/

                Clique sur parcourir et cherche ce fichier : C:\Windows\Domino.exe

                Clique sur Send File.

                Un rapport va s'élaborer ligne à ligne.

                Attends la fin. Il doit comprendre la taille du fichier envoyé.

                Sauvegarde le rapport avec le bloc-note.

                Copie le dans ta réponse.
                1. cyrus 34 Auteur
                  rapport hijacthisLogfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 12:19:25, on 14/08/2008
                  Platform: Windows Vista SP1 (WinNT 6.00.1905)
                  MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                  Boot mode: Normal

                  Running processes:
                  C:\Windows\System32\smss.exe
                  C:\Windows\system32\csrss.exe
                  C:\Windows\system32\wininit.exe
                  C:\Windows\system32\csrss.exe
                  C:\Windows\system32\services.exe
                  C:\Windows\system32\lsass.exe
                  C:\Windows\system32\lsm.exe
                  C:\Windows\system32\winlogon.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\system32\SLsvc.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe
                  C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
                  C:\Windows\System32\spoolsv.exe
                  C:\Windows\system32\svchost.exe
                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                  C:\Windows\system32\svchost.exe
                  C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
                  C:\Program Files\Spyware Doctor\pctsAuxs.exe
                  C:\Program Files\Spyware Doctor\pctsSvc.exe
                  C:\Windows\system32\taskeng.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\System32\svchost.exe
                  C:\Windows\system32\SearchIndexer.exe
                  C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
                  C:\Windows\system32\WUDFHost.exe
                  C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                  C:\Windows\system32\taskeng.exe
                  C:\Windows\system32\Dwm.exe
                  C:\Windows\Explorer.EXE
                  C:\Program Files\Windows Defender\MSASCui.exe
                  C:\Windows\RtHDVCpl.exe
                  C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
                  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                  C:\Windows\ZSSnp211.exe
                  C:\Windows\Domino.exe
                  C:\Windows\System32\rundll32.exe
                  C:\Program Files\Spyware Doctor\pctsTray.exe
                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                  C:\Program Files\Windows Sidebar\sidebar.exe
                  C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
                  C:\Program Files\Windows Media Player\wmpnscfg.exe
                  C:\Program Files\e-Carte Bleue La Banque Postale\ecbl-lbp.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Windows\System32\rundll32.exe
                  C:\Program Files\Windows Media Player\wmpnetwk.exe
                  C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
                  C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
                  C:\Windows\system32\conime.exe
                  C:\Windows\system32\wuauclt.exe
                  C:\Program Files\Internet Explorer\IEUser.exe
                  C:\Windows\System32\mobsync.exe
                  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
                  C:\Program Files\Shareaza\Shareaza.exe
                  C:\Users\Proprietaire\Downloads\HiJackThis.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                  C:\Windows\system32\wbem\wmiprvse.exe
                  C:\Windows\system32\NOTEPAD.EXE

                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                  R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                  O1 - Hosts: ::1 localhost
                  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
                  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
                  O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                  O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
                  O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                  O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                  O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                  O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
                  O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                  O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
                  O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
                  O4 - HKLM\..\Run: [ZSSnp211] C:\Windows\ZSSnp211.exe
                  O4 - HKLM\..\Run: [Domino] C:\Windows\Domino.exe
                  O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
                  O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
                  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
                  O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                  O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                  O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
                  O4 - HKCU\..\Run: [title free] "C:\ProgramData\ford bold bold.4v4a14"
                  O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                  O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
                  O4 - Global Startup: e-Carte Bleue La Banque Postale.lnk = C:\Program Files\e-Carte Bleue La Banque Postale\ecbl-lbp.exe
                  O4 - Global Startup: OFFICE One Startup v7.lnk = ?
                  O13 - Gopher Prefix:
                  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                  O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
                  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                  O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
                  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
                  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
                  O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
                  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                  O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
                  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                  O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                  O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                  O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                  O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
                  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                  O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                  O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
                  O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
                  O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
                  1. jfkpresident Contributeur sécurité
                    Merci , si tu pouvais me recoller un nouveau hijack pour conclure .
                    1. cyrus 34 Auteur
                      bonjour ,jfk ,je viens de voir ton message et je comprends après réflexion ton opinion, c'est pour cela, que je t'envoie le rapport rapport lop n° 2.
                      Bonne journée.
                      --------------------\\ Lop S&D 4.2.2-9 XP/Vista

                      [ Windows VISTA (NT 6.0) Workstation Build 6001, Service Pack 1 ]
                      [ USER : Proprietaire ] [ "C:\Lop SD" ] [ Selection : 2 ]
                      [ 20/08/2008 | 14:30:10 ] [ PC : KLEIN (Proc:x86) ]
                      [ MAJ : 13-08-2008 | 21:02 ]
                      [ UAC => 0 ]

                      \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

                      Supprime! - C:\ProgramData\That Face Camp Shim\remote hide.exe
                      Supprime! - C:\Program Files\Circle Developement\Uninstall.exe
                      Supprime! - C:\Users\PROPRI~1\AppData\Roaming\MICROS~1\Windows\Cookies\proprietaire@adopt.euroclick[1].txt
                      Supprime! - C:\Users\PROPRI~1\AppData\Roaming\MICROS~1\Windows\Cookies\proprietaire@adopt.euroclick[2].txt
                      Supprime! - C:\ProgramData\That Face Camp Shim
                      Supprime! - C:\Program Files\Circle Developement

                      \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

                      --------------------\\ Listing des dossiers dans Local

                      [11/07/2008|10:33] C:\Users\PROPRI~1\AppData\Local\Adobe
                      [26/05/2008|12:05] C:\Users\PROPRI~1\AppData\Local\Application Data
                      [20/08/2008|14:29] C:\Users\PROPRI~1\AppData\Local\ApplicationHistory
                      [18/07/2008|08:24] C:\Users\PROPRI~1\AppData\Local\d3d9caps.dat
                      [09/08/2008|20:01] C:\Users\PROPRI~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
                      [26/05/2008|13:52] C:\Users\PROPRI~1\AppData\Local\fusioncache.dat
                      [26/05/2008|13:51] C:\Users\PROPRI~1\AppData\Local\GDIPFONTCACHEV1.DAT
                      [01/07/2008|17:17] C:\Users\PROPRI~1\AppData\Local\Google
                      [26/05/2008|12:05] C:\Users\PROPRI~1\AppData\Local\Historique
                      [20/08/2008|14:24] C:\Users\PROPRI~1\AppData\Local\IconCache.db
                      [15/08/2008|12:30] C:\Users\PROPRI~1\AppData\Local\Microsoft
                      [21/07/2008|12:13] C:\Users\PROPRI~1\AppData\Local\Microsoft Games
                      [01/06/2008|17:25] C:\Users\PROPRI~1\AppData\Local\Mozilla
                      [15/06/2008|09:02] C:\Users\PROPRI~1\AppData\Local\Packard Bell
                      [17/06/2008|20:34] C:\Users\PROPRI~1\AppData\Local\Shareaza
                      [20/08/2008|14:30] C:\Users\PROPRI~1\AppData\Local\Temp
                      [26/05/2008|12:05] C:\Users\PROPRI~1\AppData\Local\Temporary Internet Files
                      [02/06/2008|17:50] C:\Users\PROPRI~1\AppData\Local\VirtualStore

                      --------------------\\ Tâches planifiées dans C:\Windows\tasks

                      [15/08/2008 20:06][--a------] C:\Windows\tasks\Norton Internet Security - Analyse systŠme complŠte - Proprietaire.job
                      [20/08/2008 14:30][--a------] C:\Windows\tasks\Extension de garantie.job
                      [20/08/2008 14:27][--ah-----] C:\Windows\tasks\SA.DAT
                      [20/08/2008 14:26][--a------] C:\Windows\tasks\SCHEDLGU.TXT

                      --------------------\\ Listing des dossiers dans C:\ProgramData

                      [11/08/2008|14:00] C:\ProgramData\Adobe
                      [01/08/2008|13:50] C:\ProgramData\Application Data
                      [28/06/2008|11:37] C:\ProgramData\BOONTY
                      [26/05/2008|12:02] C:\ProgramData\Bureau
                      [11/06/2008|21:02] C:\ProgramData\Ciel
                      [01/08/2008|13:50] C:\ProgramData\Desktop
                      [01/08/2008|13:50] C:\ProgramData\Documents
                      [19/07/2008|17:06] C:\ProgramData\eMule
                      [26/05/2008|12:02] C:\ProgramData\Favoris
                      [01/08/2008|13:50] C:\ProgramData\Favorites
                      [26/05/2008|10:57] C:\ProgramData\Google
                      [20/08/2008|11:05] C:\ProgramData\Google Updater
                      [14/08/2008|07:34] C:\ProgramData\Grisoft
                      [26/05/2008|10:56] C:\ProgramData\InstallShield
                      [13/08/2008|10:39] C:\ProgramData\Malwarebytes
                      [26/05/2008|12:02] C:\ProgramData\Menu D‚marrer
                      [08/08/2008|20:10] C:\ProgramData\Messenger Plus!
                      [01/06/2008|18:59] C:\ProgramData\Microsoft
                      [26/05/2008|12:02] C:\ProgramData\ModŠles
                      [01/08/2008|20:15] C:\ProgramData\NVIDIA
                      [26/05/2008|11:12] C:\ProgramData\OFFICE One v7
                      [08/08/2008|19:58] C:\ProgramData\RealGlueDebug
                      [12/08/2008|14:53] C:\ProgramData\Roxio
                      [13/08/2008|09:46] C:\ProgramData\services
                      [26/05/2008|10:55] C:\ProgramData\Sonic
                      [08/08/2008|22:03] C:\ProgramData\Spybot - Search & Destroy
                      [01/08/2008|13:50] C:\ProgramData\Start Menu
                      [18/08/2008|11:39] C:\ProgramData\Symantec
                      [20/08/2008|14:29] C:\ProgramData\TEMP
                      [01/08/2008|13:50] C:\ProgramData\Templates
                      [01/06/2008|20:52] C:\ProgramData\WLInstaller

                      --------------------\\ Listing des dossiers dans C:\Program Files

                      [18/08/2008|11:46] C:\Program Files\12Ghosts
                      [11/08/2008|14:02] C:\Program Files\Adobe
                      [01/06/2008|18:50] C:\Program Files\Alwil Software
                      [28/06/2008|17:07] C:\Program Files\BoontyGames
                      [11/07/2008|10:45] C:\Program Files\CCleaner
                      [14/08/2008|13:15] C:\Program Files\Common Files
                      [26/05/2008|10:45] C:\Program Files\CyberLink
                      [05/07/2008|17:54] C:\Program Files\desktop.ini
                      [11/06/2008|21:00] C:\Program Files\DivX
                      [01/06/2008|20:17] C:\Program Files\e-Carte Bleue La Banque Postale
                      [26/05/2008|12:02] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
                      [14/08/2008|12:30] C:\Program Files\Google
                      [26/05/2008|10:51] C:\Program Files\HDReg
                      [01/08/2008|16:59] C:\Program Files\InstallShield Installation Information
                      [05/07/2008|17:44] C:\Program Files\Internet Explorer
                      [26/05/2008|11:09] C:\Program Files\ISSENDIS
                      [14/08/2008|13:20] C:\Program Files\Java
                      [11/06/2008|21:03] C:\Program Files\K-Lite Codec Pack
                      [01/06/2008|17:31] C:\Program Files\Lexmark 6200 Series
                      [26/05/2008|13:57] C:\Program Files\MadOnion.com
                      [13/08/2008|10:47] C:\Program Files\Malwarebytes' Anti-Malware
                      [08/08/2008|19:57] C:\Program Files\Messenger Plus! Live
                      [02/11/2006|14:37] C:\Program Files\Microsoft Games
                      [01/06/2008|21:12] C:\Program Files\Microsoft SQL Server Compact Edition
                      [05/07/2008|17:44] C:\Program Files\Movie Maker
                      [11/06/2008|21:08] C:\Program Files\Mozilla Firefox
                      [02/11/2006|14:37] C:\Program Files\MSBuild
                      [01/06/2008|22:27] C:\Program Files\MSXML 4.0
                      [17/08/2008|10:29] C:\Program Files\Navilog1
                      [11/07/2008|10:59] C:\Program Files\Norton Internet Security
                      [26/05/2008|11:13] C:\Program Files\OFFICE ONE 7.0
                      [26/05/2008|11:12] C:\Program Files\OFFICE One v7
                      [28/07/2008|16:40] C:\Program Files\Packard Bell
                      [01/08/2008|13:50] C:\Program Files\Packard Bell ImageWriter
                      [26/05/2008|10:44] C:\Program Files\Realtek
                      [02/11/2006|14:37] C:\Program Files\Reference Assemblies
                      [17/08/2008|10:24] C:\Program Files\RelevantKnowledge
                      [26/05/2008|10:56] C:\Program Files\Roxio
                      [18/06/2008|18:37] C:\Program Files\Shareaza
                      [26/05/2008|11:14] C:\Program Files\Skype
                      [08/08/2008|22:05] C:\Program Files\Spybot - Search & Destroy
                      [20/08/2008|11:16] C:\Program Files\Spyware Doctor
                      [01/06/2008|19:52] C:\Program Files\Symantec
                      [14/08/2008|12:18] C:\Program Files\Trend Micro
                      [02/11/2006|15:01] C:\Program Files\Uninstall Information
                      [11/06/2008|20:30] C:\Program Files\VideoLAN
                      [01/08/2008|17:00] C:\Program Files\Vimicro
                      [05/07/2008|17:44] C:\Program Files\Windows Calendar
                      [05/07/2008|17:44] C:\Program Files\Windows Collaboration
                      [05/07/2008|17:43] C:\Program Files\Windows Defender
                      [05/07/2008|17:44] C:\Program Files\Windows Journal
                      [02/06/2008|22:11] C:\Program Files\Windows Live
                      [14/08/2008|08:55] C:\Program Files\Windows Mail
                      [05/07/2008|17:44] C:\Program Files\Windows Media Player
                      [26/05/2008|12:02] C:\Program Files\Windows NT
                      [05/07/2008|17:44] C:\Program Files\Windows Photo Gallery
                      [05/07/2008|17:44] C:\Program Files\Windows Sidebar
                      [26/05/2008|10:46] C:\Program Files\X10 Hardware
                      [14/08/2008|14:40] C:\Program Files\Yahoo!
                      [31/07/2008|21:33] C:\Program Files\ZikiTranslator

                      --------------------\\ Listing des dossiers dans C:\Program Files\Common Files

                      [11/08/2008|14:00] C:\Program Files\Common Files\Adobe
                      [28/06/2008|11:37] C:\Program Files\Common Files\BOONTY Shared
                      [26/05/2008|10:55] C:\Program Files\Common Files\InstallShield
                      [14/08/2008|13:15] C:\Program Files\Common Files\Java
                      [01/06/2008|21:00] C:\Program Files\Common Files\microsoft shared
                      [11/06/2008|20:59] C:\Program Files\Common Files\PX Storage Engine
                      [26/05/2008|10:55] C:\Program Files\Common Files\Roxio Shared
                      [02/11/2006|13:18] C:\Program Files\Common Files\Services
                      [26/05/2008|10:55] C:\Program Files\Common Files\Sonic Shared
                      [02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
                      [26/05/2008|10:56] C:\Program Files\Common Files\SureThing Shared
                      [11/07/2008|10:57] C:\Program Files\Common Files\Symantec Shared
                      [05/07/2008|17:43] C:\Program Files\Common Files\System
                      [01/06/2008|21:00] C:\Program Files\Common Files\WindowsLiveInstaller
                      [26/05/2008|10:46] C:\Program Files\Common Files\X10

                      --------------------\\ Process

                      ( 63 Processus )

                      ... OK !

                      --------------------\\ Recherche avec S_Lop

                      Aucun fichier / dossier Lop trouvé !

                      --------------------\\ Recherche de Fichiers / Dossiers Lop

                      Aucun fichier / dossier Lop trouvé !

                      --------------------\\ Verification du Registre

                      ..... OK !

                      --------------------\\ Verification du fichier Hosts

                      Fichier Hosts PROPRE

                      --------------------\\ Recherche de fichiers avec Catchme

                      catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-08-20 14:30:44
                      Windows 6.0.6001 Service Pack 1 NTFS
                      scanning hidden processes ...
                      scanning hidden files ...
                      scan completed successfully
                      hidden processes: 0
                      hidden files: 711

                      --------------------\\ Recherche d'autres infections

                      Aucune autre infection trouvée !

                      [F:60][D:10]-> C:\Users\PROPRI~1\AppData\Local\Temp
                      [F:202][D:1]-> C:\Users\PROPRI~1\AppData\Roaming\MICROS~1\Windows\Cookies
                      [F:959][D:4]-> C:\Users\PROPRI~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
                      [F:65][D:8]-> C:\$Recycle.Bin

                      --------------------\\ Fin du rapport a 14:33:38,11
                      [ UAC => 1 ]
                      1. jfkpresident Contributeur sécurité
                        bonjour cyrus ,j'aurais bien voulu voir le rapport lopS&D option 2 et ainsi pouvoir finir la désinfection jusqu'au bout ...

                        C'est tres frustrant quand un internaute te demande de l'aide et ensuite s'en va s'en meme se soucier de savoir si son pc est propre .

                        si tu es toujours la on continu .
                        1. cyrus 34 Auteur
                          bonjour jfk
                          apparament je n'ai plus de popup ,j'ai installéé popup killer et ça a l'air de marcher
                          a bientot merci.
                          1. jfkpresident Contributeur sécurité
                            relance LopS&D et choisis l'option 2 .
                            ensuite colle le rapport généré ainsi qu'un nouveau hijack .
                            1. cyrus 34 Auteur
                              voila le rapport lop
                              --------------------\\ Lop S&D 4.2.2-9 XP/Vista

                              [ Windows VISTA (NT 6.0) Workstation Build 6001, Service Pack 1 ]
                              [ USER : Proprietaire ] [ "C:\Lop SD" ] [ Selection : 1 ]
                              [ 16/08/2008 | 19:55:10 ] [ PC : KLEIN (Proc:x86) ]
                              [ MAJ : 13-08-2008 | 21:02 ]
                              [ UAC => 0 ]

                              --------------------\\ Listing des dossiers dans Local

                              [11/07/2008|10:33] C:\Users\PROPRI~1\AppData\Local\Adobe
                              [26/05/2008|12:05] C:\Users\PROPRI~1\AppData\Local\Application Data
                              [16/08/2008|19:25] C:\Users\PROPRI~1\AppData\Local\ApplicationHistory
                              [18/07/2008|08:24] C:\Users\PROPRI~1\AppData\Local\d3d9caps.dat
                              [09/08/2008|20:01] C:\Users\PROPRI~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
                              [26/05/2008|13:52] C:\Users\PROPRI~1\AppData\Local\fusioncache.dat
                              [26/05/2008|13:51] C:\Users\PROPRI~1\AppData\Local\GDIPFONTCACHEV1.DAT
                              [01/07/2008|17:17] C:\Users\PROPRI~1\AppData\Local\Google
                              [26/05/2008|12:05] C:\Users\PROPRI~1\AppData\Local\Historique
                              [16/08/2008|19:41] C:\Users\PROPRI~1\AppData\Local\IconCache.db
                              [15/08/2008|12:30] C:\Users\PROPRI~1\AppData\Local\Microsoft
                              [21/07/2008|12:13] C:\Users\PROPRI~1\AppData\Local\Microsoft Games
                              [01/06/2008|17:25] C:\Users\PROPRI~1\AppData\Local\Mozilla
                              [15/06/2008|09:02] C:\Users\PROPRI~1\AppData\Local\Packard Bell
                              [17/06/2008|20:34] C:\Users\PROPRI~1\AppData\Local\Shareaza
                              [16/08/2008|19:55] C:\Users\PROPRI~1\AppData\Local\Temp
                              [26/05/2008|12:05] C:\Users\PROPRI~1\AppData\Local\Temporary Internet Files
                              [02/06/2008|17:50] C:\Users\PROPRI~1\AppData\Local\VirtualStore

                              --------------------\\ Tâches planifiées dans C:\Windows\tasks

                              [15/08/2008 20:06][--a------] C:\Windows\tasks\Norton Internet Security - Analyse systŠme complŠte - Proprietaire.job
                              [16/08/2008 19:30][--a------] C:\Windows\tasks\Extension de garantie.job
                              [16/08/2008 19:42][--ah-----] C:\Windows\tasks\SA.DAT
                              [16/08/2008 19:41][--a------] C:\Windows\tasks\SCHEDLGU.TXT

                              --------------------\\ Listing des dossiers dans C:\ProgramData

                              [11/08/2008|14:00] C:\ProgramData\Adobe
                              [01/08/2008|13:50] C:\ProgramData\Application Data
                              [28/06/2008|11:37] C:\ProgramData\BOONTY
                              [26/05/2008|12:02] C:\ProgramData\Bureau
                              [11/06/2008|21:02] C:\ProgramData\Ciel
                              [01/08/2008|13:50] C:\ProgramData\Desktop
                              [01/08/2008|13:50] C:\ProgramData\Documents
                              [19/07/2008|17:06] C:\ProgramData\eMule
                              [26/05/2008|12:02] C:\ProgramData\Favoris
                              [01/08/2008|13:50] C:\ProgramData\Favorites
                              [08/08/2008|19:57] C:\ProgramData\ford bold bold.4v4a14
                              [08/08/2008|19:57] C:\ProgramData\ford bold bold.691niu
                              [26/05/2008|10:57] C:\ProgramData\Google
                              [16/08/2008|19:38] C:\ProgramData\Google Updater
                              [14/08/2008|07:34] C:\ProgramData\Grisoft
                              [26/05/2008|10:56] C:\ProgramData\InstallShield
                              [13/08/2008|10:39] C:\ProgramData\Malwarebytes
                              [26/05/2008|12:02] C:\ProgramData\Menu D‚marrer
                              [08/08/2008|20:10] C:\ProgramData\Messenger Plus!
                              [01/06/2008|18:59] C:\ProgramData\Microsoft
                              [26/05/2008|12:02] C:\ProgramData\ModŠles
                              [01/08/2008|20:15] C:\ProgramData\NVIDIA
                              [26/05/2008|11:12] C:\ProgramData\OFFICE One v7
                              [08/08/2008|19:58] C:\ProgramData\RealGlueDebug
                              [12/08/2008|14:53] C:\ProgramData\Roxio
                              [13/08/2008|09:46] C:\ProgramData\services
                              [26/05/2008|10:55] C:\ProgramData\Sonic
                              [08/08/2008|22:03] C:\ProgramData\Spybot - Search & Destroy
                              [01/08/2008|13:50] C:\ProgramData\Start Menu
                              [16/08/2008|19:34] C:\ProgramData\Symantec
                              [08/08/2008|19:58] C:\ProgramData\team 4 size.i8s7p
                              [16/08/2008|19:43] C:\ProgramData\TEMP
                              [01/08/2008|13:50] C:\ProgramData\Templates
                              [14/08/2008|14:11] C:\ProgramData\That Face Camp Shim
                              [01/06/2008|20:52] C:\ProgramData\WLInstaller

                              --------------------\\ Listing des dossiers dans C:\Program Files

                              [11/08/2008|14:02] C:\Program Files\Adobe
                              [01/06/2008|18:50] C:\Program Files\Alwil Software
                              [28/06/2008|17:07] C:\Program Files\BoontyGames
                              [11/07/2008|10:45] C:\Program Files\CCleaner
                              [08/08/2008|19:57] C:\Program Files\Circle Developement
                              [14/08/2008|13:15] C:\Program Files\Common Files
                              [26/05/2008|10:45] C:\Program Files\CyberLink
                              [05/07/2008|17:54] C:\Program Files\desktop.ini
                              [11/06/2008|21:00] C:\Program Files\DivX
                              [01/06/2008|20:17] C:\Program Files\e-Carte Bleue La Banque Postale
                              [26/05/2008|12:02] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
                              [06/06/2008|18:46] C:\Program Files\FreeAngel
                              [14/08/2008|12:30] C:\Program Files\Google
                              [14/08/2008|07:34] C:\Program Files\Grisoft
                              [26/05/2008|10:51] C:\Program Files\HDReg
                              [01/08/2008|16:59] C:\Program Files\InstallShield Installation Information
                              [05/07/2008|17:44] C:\Program Files\Internet Explorer
                              [26/05/2008|11:09] C:\Program Files\ISSENDIS
                              [14/08/2008|13:20] C:\Program Files\Java
                              [11/06/2008|21:03] C:\Program Files\K-Lite Codec Pack
                              [01/06/2008|17:31] C:\Program Files\Lexmark 6200 Series
                              [26/05/2008|13:57] C:\Program Files\MadOnion.com
                              [13/08/2008|10:47] C:\Program Files\Malwarebytes' Anti-Malware
                              [08/08/2008|19:57] C:\Program Files\Messenger Plus! Live
                              [02/11/2006|14:37] C:\Program Files\Microsoft Games
                              [01/06/2008|21:12] C:\Program Files\Microsoft SQL Server Compact Edition
                              [05/07/2008|17:44] C:\Program Files\Movie Maker
                              [11/06/2008|21:08] C:\Program Files\Mozilla Firefox
                              [02/11/2006|14:37] C:\Program Files\MSBuild
                              [01/06/2008|22:27] C:\Program Files\MSXML 4.0
                              [15/08/2008|12:31] C:\Program Files\Navilog1
                              [11/07/2008|10:59] C:\Program Files\Norton Internet Security
                              [26/05/2008|11:13] C:\Program Files\OFFICE ONE 7.0
                              [26/05/2008|11:12] C:\Program Files\OFFICE One v7
                              [28/07/2008|16:40] C:\Program Files\Packard Bell
                              [01/08/2008|13:50] C:\Program Files\Packard Bell ImageWriter
                              [26/05/2008|10:44] C:\Program Files\Realtek
                              [02/11/2006|14:37] C:\Program Files\Reference Assemblies
                              [26/05/2008|10:56] C:\Program Files\Roxio
                              [18/06/2008|18:37] C:\Program Files\Shareaza
                              [26/05/2008|11:14] C:\Program Files\Skype
                              [08/08/2008|22:05] C:\Program Files\Spybot - Search & Destroy
                              [15/08/2008|09:40] C:\Program Files\Spyware Doctor
                              [01/06/2008|19:52] C:\Program Files\Symantec
                              [14/08/2008|12:18] C:\Program Files\Trend Micro
                              [02/11/2006|15:01] C:\Program Files\Uninstall Information
                              [11/06/2008|20:30] C:\Program Files\VideoLAN
                              [01/08/2008|17:00] C:\Program Files\Vimicro
                              [05/07/2008|17:44] C:\Program Files\Windows Calendar
                              [05/07/2008|17:44] C:\Program Files\Windows Collaboration
                              [05/07/2008|17:43] C:\Program Files\Windows Defender
                              [05/07/2008|17:44] C:\Program Files\Windows Journal
                              [02/06/2008|22:11] C:\Program Files\Windows Live
                              [14/08/2008|08:55] C:\Program Files\Windows Mail
                              [05/07/2008|17:44] C:\Program Files\Windows Media Player
                              [26/05/2008|12:02] C:\Program Files\Windows NT
                              [05/07/2008|17:44] C:\Program Files\Windows Photo Gallery
                              [05/07/2008|17:44] C:\Program Files\Windows Sidebar
                              [26/05/2008|10:46] C:\Program Files\X10 Hardware
                              [14/08/2008|14:40] C:\Program Files\Yahoo!
                              [31/07/2008|21:33] C:\Program Files\ZikiTranslator

                              --------------------\\ Listing des dossiers dans C:\Program Files\Common Files

                              [11/08/2008|14:00] C:\Program Files\Common Files\Adobe
                              [28/06/2008|11:37] C:\Program Files\Common Files\BOONTY Shared
                              [26/05/2008|10:55] C:\Program Files\Common Files\InstallShield
                              [14/08/2008|13:15] C:\Program Files\Common Files\Java
                              [01/06/2008|21:00] C:\Program Files\Common Files\microsoft shared
                              [11/06/2008|20:59] C:\Program Files\Common Files\PX Storage Engine
                              [26/05/2008|10:55] C:\Program Files\Common Files\Roxio Shared
                              [02/11/2006|13:18] C:\Program Files\Common Files\Services
                              [26/05/2008|10:55] C:\Program Files\Common Files\Sonic Shared
                              [02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
                              [26/05/2008|10:56] C:\Program Files\Common Files\SureThing Shared
                              [11/07/2008|10:57] C:\Program Files\Common Files\Symantec Shared
                              [05/07/2008|17:43] C:\Program Files\Common Files\System
                              [01/06/2008|21:00] C:\Program Files\Common Files\WindowsLiveInstaller
                              [26/05/2008|10:46] C:\Program Files\Common Files\X10

                              --------------------\\ Process

                              ( 67 Processus )

                              iexplore.exe ~ [PID:860] ~ [Threads:3]
                              iexplore.exe ~ [PID:1604] ~ [Threads:1]

                              --------------------\\ Recherche avec S_Lop

                              C:\ProgramData\team 4 size.i8s7p
                              C:\ProgramData\ford bold bold.4v4a14
                              C:\ProgramData\ford bold bold.691niu

                              --------------------\\ Recherche de Fichiers / Dossiers Lop

                              C:\ProgramData\That Face Camp Shim
                              C:\ProgramData\That Face Camp Shim\remote hide.exe
                              C:\Program Files\Circle Developement
                              C:\Program Files\Circle Developement\Uninstall.exe
                              C:\Users\PROPRI~1\AppData\Roaming\MICROS~1\Windows\Cookies\proprietaire@adopt.euroclick[1].txt
                              C:\Users\PROPRI~1\AppData\Roaming\MICROS~1\Windows\Cookies\proprietaire@adopt.euroclick[2].txt

                              --------------------\\ Verification du Registre

                              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "title free"="\"C:\\ProgramData\\ford bold bold.4v4a14\""

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

                              --------------------\\ Verification du fichier Hosts

                              Fichier Hosts PROPRE

                              --------------------\\ Recherche de fichiers avec Catchme

                              catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                              Rootkit scan 2008-08-16 19:55:48
                              Windows 6.0.6001 Service Pack 1 NTFS
                              scanning hidden processes ...
                              scanning hidden files ...
                              scan completed successfully
                              hidden processes: 0
                              hidden files: 711

                              --------------------\\ Recherche d'autres infections

                              Aucune autre infection trouvée !

                              [F:39][D:4]-> C:\Users\PROPRI~1\AppData\Local\Temp
                              [F:91][D:1]-> C:\Users\PROPRI~1\AppData\Roaming\MICROS~1\Windows\Cookies
                              [F:144][D:4]-> C:\Users\PROPRI~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
                              [F:11][D:4]-> C:\$Recycle.Bin

                              --------------------\\ Fin du rapport a 19:58:37,09
                              [ UAC => 1 ]
                              1. cyrus 34 Auteur
                                bonjour jfk
                                je t'envoie le rapport de lop ,j'espère que tu trouveras quelque chose , merci.
                                1. jfkpresident Contributeur sécurité
                                  en attendant toptit ,fait ceci :

                                  télécharge lopS&D

                                  *double-cliquez dessus pour installer le programme.
                                  * Un raccourci sera créé sur votre bureau , double-cliquez dessus pour lancer l'outil.
                                  *choisis la langue .
                                  *choisis l'option 1 (recherche) .
                                  *copie/colle le rapport sur le forum.
                                  2. cyrus 34 Auteur
                                    voici le rappor hijactLogfile of Trend Micro HijackThis v2.0.2
                                    Scan saved at 12:19:25, on 14/08/2008
                                    Platform: Windows Vista SP1 (WinNT 6.00.1905)
                                    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                                    Boot mode: Normal

                                    Running processes:
                                    C:\Windows\System32\smss.exe
                                    C:\Windows\system32\csrss.exe
                                    C:\Windows\system32\wininit.exe
                                    C:\Windows\system32\csrss.exe
                                    C:\Windows\system32\services.exe
                                    C:\Windows\system32\lsass.exe
                                    C:\Windows\system32\lsm.exe
                                    C:\Windows\system32\winlogon.exe
                                    C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe
                                    C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe
                                    C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\SLsvc.exe
                                    C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe
                                    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
                                    C:\Windows\System32\spoolsv.exe
                                    C:\Windows\system32\svchost.exe
                                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                                    C:\Windows\system32\svchost.exe
                                    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
                                    C:\Program Files\Spyware Doctor\pctsAuxs.exe
                                    C:\Program Files\Spyware Doctor\pctsSvc.exe
                                    C:\Windows\system32\taskeng.exe
                                    C:\Windows\system32\svchost.exe
                                    C:\Windows\System32\svchost.exe
                                    C:\Windows\system32\SearchIndexer.exe
                                    C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
                                    C:\Windows\system32\WUDFHost.exe
                                    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                                    C:\Windows\system32\taskeng.exe
                                    C:\Windows\system32\Dwm.exe
                                    C:\Windows\Explorer.EXE
                                    C:\Program Files\Windows Defender\MSASCui.exe
                                    C:\Windows\RtHDVCpl.exe
                                    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
                                    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                                    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                                    C:\Windows\ZSSnp211.exe
                                    C:\Windows\Domino.exe
                                    C:\Windows\System32\rundll32.exe
                                    C:\Program Files\Spyware Doctor\pctsTray.exe
                                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                                    C:\Program Files\Windows Sidebar\sidebar.exe
                                    C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
                                    C:\Program Files\Windows Media Player\wmpnscfg.exe
                                    C:\Program Files\e-Carte Bleue La Banque Postale\ecbl-lbp.exe
                                    C:\Program Files\Internet Explorer\iexplore.exe
                                    C:\Windows\System32\rundll32.exe
                                    C:\Program Files\Windows Media Player\wmpnetwk.exe
                                    C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
                                    C:\Program Files\Internet Explorer\iexplore.exe
                                    C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
                                    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
                                    C:\Windows\system32\conime.exe
                                    C:\Windows\system32\wuauclt.exe
                                    C:\Program Files\Internet Explorer\IEUser.exe
                                    C:\Windows\System32\mobsync.exe
                                    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
                                    C:\Program Files\Shareaza\Shareaza.exe
                                    C:\Users\Proprietaire\Downloads\HiJackThis.exe
                                    C:\Program Files\Internet Explorer\iexplore.exe
                                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                                    C:\Windows\system32\wbem\wmiprvse.exe
                                    C:\Windows\system32\NOTEPAD.EXE

                                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                                    R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                                    O1 - Hosts: ::1 localhost
                                    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                                    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                                    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
                                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                                    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
                                    O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
                                    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                                    O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
                                    O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                                    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                                    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                                    O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
                                    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                                    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                                    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
                                    O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
                                    O4 - HKLM\..\Run: [ZSSnp211] C:\Windows\ZSSnp211.exe
                                    O4 - HKLM\..\Run: [Domino] C:\Windows\Domino.exe
                                    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
                                    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
                                    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
                                    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
                                    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
                                    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                                    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                                    O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
                                    O4 - HKCU\..\Run: [title free] "C:\ProgramData\ford bold bold.4v4a14"
                                    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                                    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                                    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                                    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                                    O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
                                    O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
                                    O4 - Global Startup: e-Carte Bleue La Banque Postale.lnk = C:\Program Files\e-Carte Bleue La Banque Postale\ecbl-lbp.exe
                                    O4 - Global Startup: OFFICE One Startup v7.lnk = ?
                                    O13 - Gopher Prefix:
                                    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                                    O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
                                    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                                    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                                    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
                                    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
                                    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
                                    O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
                                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                                    O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
                                    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                                    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
                                    O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                                    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                                    O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
                                    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                                    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                                    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                                    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
                                    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
                                    O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
                                    • 1
                                    • 2

                                    Discussions similaires

                                    Nouveau tag ajouté | Nouvelle option activé sans permission?
                                    BountyFullChest

                                    1 réponse
                                    Huawei P8 Lite "nouveau tag ajouté"
                                    ArianeKathleen

                                    25 réponses
                                    Nouveau tag ajouté - Utilité
                                    Eerfers

                                    1 réponse
                                    Google Chrome "  Échec de l'analyse antivirus "
                                    jmpower

                                    18 réponses
                                    " Échec de l'analyse antivirus " la solution.
                                    bazfile

                                    0 réponse