publiquement

erreur de ma part, ne pas tenir compte de poste message excuz!

Hellou!!! Voici le 2eme rapport de Panda! Incident Statut Analyse Outil indésirable:application/funweb No Désinfecté hkey_current_user\software\Fun Web Products Outil indésirable:application/mywebsearch No Désinfecté hkey_current_user\software\MyWebSearch Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt[.xiti.com/] Spyware:Cookie/Advertising No Désinfecté C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt[.advertising.com/] Spyware:Cookie/Zedo No Désinfecté C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt[.zedo.com/] Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt[.doubleclick.net/] Outil indésirable:Application/Processor No Désinfecté C:\Documents and Settings\marie-christine\Bureau\SmitfraudFix\Process.exe Spyware:Cookie/Atlas DMT No Désinfecté C:\Documents and Settings\marie-christine\Cookies\marie-christine@atdmt[2].txt

Youpi !!! Ca marche avec panda! Voici le rapport: Incident Statut Analyse Outil indésirable:application/funweb No Désinfecté c:\program files\FunWebProducts Outil indésirable:application/mywebsearch No Désinfecté c:\program files\MyWebSearch Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt[.xiti.com/] Spyware:Cookie/Advertising No Désinfecté C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt[.advertising.com/] Spyware:Cookie/Zedo No Désinfecté C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt[.zedo.com/] Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt[.doubleclick.net/] Spyware:Cookie/Comclick No Désinfecté C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt[fl01.ct2.comclick.com/] Spyware:Cookie/Bluestreak No Désinfecté C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt[.bluestreak.com/] Outil indésirable:Application/FunWeb No Désinfecté C:\Documents and Settings\marie-christine\Bureau\hijackthis\backups\backup-20070102-211516-896.inf Outil indésirable:Application/Processor No Désinfecté C:\Documents and Settings\marie-christine\Bureau\SmitfraudFix\Process.exe Spyware:Cookie/Atlas DMT No Désinfecté C:\Documents and Settings\marie-christine\Cookies\marie-christine@atdmt[2].txt Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\marie-christine\Cookies\marie-christine@doubleclick[2].txt Spyware:Cookie/DriveCleaner No Désinfecté C:\Documents and Settings\marie-christine\Cookies\marie-christine@drivecleaner[2].txt Spyware:Cookie/DriveCleaner No Désinfecté C:\Documents and Settings\marie-christine\Cookies\[email protected][2].txt Spyware:Cookie/Systemdoctor No Désinfecté C:\Documents and Settings\marie-christine\Cookies\marie-christine@systemdoctor[1].txt Spyware:Cookie/Winantivirus No Désinfecté C:\Documents and Settings\marie-christine\Cookies\marie-christine@winantivirus[1].txt Spyware:Cookie/DriveCleaner No Désinfecté C:\Documents and Settings\marie-christine\Cookies\[email protected][2].txt Spyware:Cookie/Systemdoctor No Désinfecté C:\Documents and Settings\marie-christine\Cookies\[email protected][2].txt Spyware:Cookie/Winantivirus No Désinfecté C:\Documents and Settings\marie-christine\Cookies\[email protected][2].txt Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\marie-christine\Cookies\marie-christine@xiti[1].txt Outil indésirable:Application/Processor No Désinfecté C:\RECYCLER\S-1-5-21-1960000641-240542110-1040703084-1006\Dc1.zip[smitfraudFix/Process.exe] Outil indésirable:Application/Processor No Désinfecté C:\RECYCLER\S-1-5-21-1960000641-240542110-1040703084-1006\Dc2.zip[smitfraudFix/Process.exe] Outil indésirable:Application/Processor No Désinfecté C:\WINDOWS\SYSTEM32\Process.exe La suite....

Bonjour Bruce! Je ne parviens pas à faire le scan de Kapersky (jai pourtant regardé les trucs à faire sur Internet Explorer, mais y faire). Je recçois le message qui qui dit que Kapersky n'a pas pu telecharger tt les trucs ActiveX, pourtant j'ai vérifié le parametre de securité... Je fais koi dans ce cas?

Oui je l'ai encore le rapport SMIDT2, voici: SmitFraudFix v2.132 Rapport fait à 20:58:46,28, 02/01/2007 Executé à partir de C:\Documents and Settings\marie-christine\Bureau\SmitfraudFix OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT Le type du système de fichiers est NTFS Fix executé en mode sans echec »»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae" [HKEY_CLASSES_ROOT\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32] @="C:\WINDOWS\system32\cthkpcv.dll" [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32] @="C:\WINDOWS\system32\cthkpcv.dll" »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri C:\WINDOWS\system32\cthkpcv.dll -> Hoax.Win32.Renos.gen.i C:\WINDOWS\system32\cthkpcv.dll -> Deleted »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés C:\DOCUME~1\MARIE-~1\Favoris\Online Security Test.url supprimé C:\Program Files\Video ActiveX Object\ supprimé »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé. »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Fin

Et là, le rapport Hijack2 (après le scan de AVG): Logfile of HijackThis v1.99.1 Scan saved at 22:38:48, on 02/01/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Canon\BJCard\Bjmcmng.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\Program Files\Apoint\Apntex.exe c:\program files\mcafee.com\agent\mcagent.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\PROGRA~1\Wanadoo\TaskbarIcon.exe C:\Program Files\Canon\BJCard\BJLaunch.exe C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\marie-christine\Bureau\hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [intelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe O4 - HKLM\..\Run: [bJLaunchEXE] C:\Program Files\Canon\BJCard\BJLaunch.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www.albatross18.com/season2/cabs/A18X.ocx O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...90/mcinsctl.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://miniling.spaces.live.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Canon BJ Memory Card Manager (Bjmcmng) - CANON INC. - C:\Program Files\Canon\BJCard\Bjmcmng.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe PS : j'ai pas pu supprimer le dossier Boonty Shared, parce que je ne l'ai pas trouvé. Juste le fichier NTSYTEM.

Bonsoir Bruce! Voili voulou le rapport AVG: --------------------------------------------------------- AVG Anti-Spyware - Rapport d'analyse --------------------------------------------------------- + Créé à: 22:34:30 02/01/2007 + Résultat de l'analyse: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP77\A0029458.exe -> Adware.180Solutions : Nettoyé et sauvegardé (mise en quarantaine). C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP101\A0031628.DLL -> Adware.FunWeb : Nettoyé et sauvegardé (mise en quarantaine). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03 -> Adware.Generic : Nettoyé et sauvegardé (mise en quarantaine). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006 -> Adware.IntCodec : Nettoyé et sauvegardé (mise en quarantaine). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On -> Adware.IntCodec : Nettoyé et sauvegardé (mise en quarantaine). C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP101\A0031671.DLL -> Adware.IWon : Nettoyé et sauvegardé (mise en quarantaine). C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP101\A0031685.EXE -> Adware.MyWebSearch : Nettoyé et sauvegardé (mise en quarantaine). C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP118\A0033091.exe -> Adware.Trymedia : Nettoyé et sauvegardé (mise en quarantaine). C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP91\A0030247.exe -> Adware.Trymedia : Nettoyé et sauvegardé (mise en quarantaine). C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP101\A0031660.DLL -> Downloader.IstBar : Nettoyé et sauvegardé (mise en quarantaine). :mozilla.59:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé. :mozilla.60:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé. :mozilla.30:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé. :mozilla.31:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé. :mozilla.32:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé. :mozilla.33:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé. C:\Documents and Settings\marie-christine\Cookies\marie-christine@atdmt[1].txt -> TrackingCookie.Atdmt : Nettoyé. :mozilla.51:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé. :mozilla.52:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé. :mozilla.53:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé. :mozilla.55:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé. :mozilla.56:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé. C:\Documents and Settings\marie-christine\Cookies\marie-christine@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé. C:\Documents and Settings\marie-christine\Cookies\[email protected][1].txt -> TrackingCookie.Reliablestats : Nettoyé. :mozilla.18:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé. :mozilla.20:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé. :mozilla.21:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé. C:\Documents and Settings\marie-christine\Cookies\marie-christine@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé. :mozilla.46:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé. :mozilla.47:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé. :mozilla.48:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé. :mozilla.49:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé. :mozilla.50:C:\Documents and Settings\marie-christine\Application Data\Mozilla\Firefox\Profiles\wutbggv2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé. Fin du rapport

Merci t'es tres sympa!

Et voici le raport Hijack: Logfile of HijackThis v1.99.1 Scan saved at 16:30:52, on 01/01/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Canon\BJCard\Bjmcmng.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Video ActiveX Object\isamonitor.exe C:\Program Files\Video ActiveX Object\pmsngr.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Video ActiveX Object\pmmon.exe C:\Program Files\Video ActiveX Object\isamini.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\Apoint\Apntex.exe C:\PROGRA~1\Wanadoo\TaskbarIcon.exe C:\Program Files\Canon\BJCard\BJLaunch.exe C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\marie-christine\Bureau\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/index.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaul...earch.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - C:\Program Files\Video ActiveX Object\isaddon.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: Protection Bar - {0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} - C:\Program Files\Video ActiveX Object\iesplugin.dll O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [intelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe O4 - HKLM\..\Run: [bJLaunchEXE] C:\Program Files\Canon\BJCard\BJLaunch.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [gwiz] C:\WINDOWS\system32\ntsystem.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www.albatross18.com/season2/cabs/A18X.ocx O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...tup1.0.0.15.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...90/mcinsctl.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://miniling.spaces.live.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O21 - SSODL: buprestidae - {b59f3ba4-98da-4b5f-8a2d-7b56fb11140b} - C:\WINDOWS\system32\cthkpcv.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Canon BJ Memory Card Manager (Bjmcmng) - CANON INC. - C:\Program Files\Canon\BJCard\Bjmcmng.exe O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing) O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Bonne année Bruce! (un sacré boulot! Tu bosses le 1er Janvier) Voici, le rapport SMIDTtruc SmitFraudFix v2.132 Rapport fait à 10:38:31,20, 31/12/2006 Executé à partir de C:\Documents and Settings\marie-christine\Bureau\SmitfraudFix OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT Le type du système de fichiers est NTFS Fix executé en mode normal »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\cthkpcv.dll PRESENT ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\marie-christine »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\marie-christine\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\MARIE-~1\Favoris C:\DOCUME~1\MARIE-~1\Favoris\Online Security Test.url PRESENT ! »»»»»»»»»»»»»»»»»»»»»»»» Bureau »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\Video ActiveX Object\ PRESENT ! »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Ma page d'accueil" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae" [HKEY_CLASSES_ROOT\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32] @="C:\WINDOWS\system32\cthkpcv.dll" [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32] @="C:\WINDOWS\system32\cthkpcv.dll" »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll »»»»»»»»»»»»»»»»»»»»»»»» Fin

Bonjour, Je suis désespérée. J'ai lu de nombreux message sur ANtiVERMINS. Je viens de découvrir que c'est un virus ou trojan, bref.... Je ne sais quoi. Je suis une vrai novice en informatique. SVP, aidez à m'en débarasser le plus simplement possible. J'ai des messages "System Alert: malware threats" ou "system Alert" en permanence. Que dois-je faire? MERCI MERCI de votre attention. Bonne fêtes!

Coucou ! J'ai un petit souci avec mon windows XP (c'est encore la faute à Microsoft) Bref... après réinstallation de XP, j'ai plus de sons. Même après avoir réinstaller mon logiciel soundblaster, ca ne marche toujours pas ... et surtout il manque le fichier ctlface.sys Pourriez m'aider! Merci !!!!!!!!