

frederic.garcia11
Membres-
Compteur de contenus
3 -
Inscription
-
Dernière visite
Autres informations
-
Mes langues
Français
frederic.garcia11's Achievements

Junior Member (3/12)
0
Réputation sur la communauté
-
j'ai désinstallé flashget et suivi la procédure de Tornado. Voici les deux rapports Ewido: Résultats du scan: G:\Documents and Settings\FREDO 2\Cookies\fredo 2@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyer et sauvegarder G:\Documents and Settings\FREDO 2\Cookies\fredo 2@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyer et sauvegarder G:\Documents and Settings\FREDO 2\Cookies\fredo 2@casalemedia[2].txt -> TrackingCookie.Casalemedia : Nettoyer et sauvegarder G:\Documents and Settings\FREDO 2\Cookies\fredo 2@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Nettoyer et sauvegarder G:\Documents and Settings\FREDO 2\Cookies\fredo 2@weborama[2].txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder G:\Documents and Settings\FREDO 2\Cookies\fredo 2@wreport.weborama[1].txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder G:\Documents and Settings\FREDO 2\Cookies\fredo 2@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder H:\RECYCLER\NPROTECT\00000001.ZIP/nocd_patch_crack.exe -> Trojan.BHO.b : Nettoyer et sauvegarder H:\RECYCLER\NPROTECT\00000002/fstraffic v2.01 (for microsoft flight simulator).exe -> Worm.Bagle.fc : Nettoyer et sauvegarder H:\RECYCLER\NPROTECT\00000003/fstraffic v2.01 by pc.exe -> Worm.Bagle.fc : Nettoyer et sauvegarder H:\RECYCLER\NPROTECT\00000004.ZIP/voice buddy 3.0 crack.exe -> Trojan.Small : Nettoyer et sauvegarder HIJACKTHIS: Running processes: G:\WINDOWS\System32\smss.exe G:\WINDOWS\system32\csrss.exe G:\WINDOWS\system32\winlogon.exe G:\WINDOWS\system32\services.exe G:\WINDOWS\system32\lsass.exe G:\WINDOWS\system32\Ati2evxx.exe G:\WINDOWS\system32\svchost.exe G:\WINDOWS\system32\svchost.exe G:\WINDOWS\System32\svchost.exe G:\WINDOWS\system32\svchost.exe G:\WINDOWS\system32\spoolsv.exe G:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe G:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe G:\WINDOWS\system32\CTsvcCDA.exe G:\Program Files\ewido anti-malware\ewidoctrl.exe G:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE G:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE G:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE G:\WINDOWS\system32\wdfmgr.exe G:\WINDOWS\system32\ZoneLabs\vsmon.exe G:\WINDOWS\system32\Ati2evxx.exe G:\WINDOWS\Explorer.EXE G:\WINDOWS\system32\MsPMSPSv.exe G:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe G:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe G:\Program Files\MessengerPlus! 3\MsgPlus.exe G:\Program Files\WinZip\WZQKPICK.EXE G:\WINDOWS\System32\alg.exe G:\Program Files\AntiVir PersonalEdition Classic\avguard.exe G:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe G:\Program Files\AntiVir PersonalEdition Classic\sched.exe G:\Program Files\HIJACKThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Ultimate Edition 2.0 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - G:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - g:\program files\google\googletoolbar2.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - G:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar2.dll O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - G:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [AVG7_CC] G:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] G:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [Zone Labs Client] G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [MessengerPlus3] "G:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [avgnt] "G:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [spySweeper] "G:\Program Files\SpySweeper\SpySweeper.exe" /0 O4 - Global Startup: Adobe Gamma Loader.exe.lnk = G:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WinZip Quick Pick.lnk = G:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://g:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://g:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://g:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://g:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://G:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Imprimer - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Similar Pages - res://g:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://g:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "G:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - G:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - G:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - G:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: ewido security suite control - ewido networks - G:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: GhostStartService - Symantec Corporation - G:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - G:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE O23 - Service: Speed Disk service - Symantec Corporation - G:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - G:\WINDOWS\system32\ZoneLabs\vsmon.exe Merci encore et A+
-
rapport HIJACKThis
frederic.garcia11 a répondu à un(e) sujet de frederic.garcia11 dans Analyses et éradication malwares
Merci Tornado, je vais faire ces manips et je te tiens au courant -
Bonjour à tous Tout nouveau sur ce forum, je me permet de vous soumettre mon problème. Je reçois toujours les mêmes mails, à chaque ouverture d'outlook(162 à chaque fois). Ces mails sont divers et variés et mis à part certains non désirés, je reçois des newletters auxquelles je suis abonné. Mon problème, c'est qu'il semblerait que ces mails se reproduisent indéfiniment. De plus quand je surfe sur le net la sécurité s'enclenche (logos site sensible qui apparait en bas de l'écran) ne permettant pas l'ouverture de la page du site désiré. J'ai essayé de changer ce réglage, mais apparemment rien n'y fait. Je vous fait part du rapport ci après, en vous remerciant par avance de l'intérêt que vous porterez à mon problème. Running processes: G:\WINDOWS\System32\smss.exe G:\WINDOWS\system32\csrss.exe G:\WINDOWS\system32\winlogon.exe G:\WINDOWS\system32\services.exe G:\WINDOWS\system32\lsass.exe G:\WINDOWS\system32\Ati2evxx.exe G:\WINDOWS\system32\svchost.exe G:\WINDOWS\system32\svchost.exe G:\WINDOWS\System32\svchost.exe G:\WINDOWS\system32\svchost.exe G:\WINDOWS\system32\spoolsv.exe G:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe G:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe G:\WINDOWS\system32\CTsvcCDA.exe G:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE G:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE G:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE G:\WINDOWS\system32\wdfmgr.exe G:\WINDOWS\system32\ZoneLabs\vsmon.exe G:\WINDOWS\system32\Ati2evxx.exe G:\WINDOWS\Explorer.EXE G:\WINDOWS\system32\MsPMSPSv.exe G:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe G:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe G:\Program Files\MessengerPlus! 3\MsgPlus.exe G:\Program Files\SpySweeper\SpySweeper.exe G:\Program Files\WinZip\WZQKPICK.EXE G:\WINDOWS\System32\alg.exe G:\Program Files\HIJACKThis\HijackThis.exe G:\Program Files\Internet Explorer\iexplore.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Ultimate Edition 2.0 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - G:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - G:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - g:\program files\google\googletoolbar2.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - G:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - G:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar2.dll O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - G:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [AVG7_CC] G:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] G:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [Zone Labs Client] G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [MessengerPlus3] "G:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKCU\..\Run: [spySweeper] "G:\Program Files\SpySweeper\SpySweeper.exe" /0 O4 - Global Startup: Adobe Gamma Loader.exe.lnk = G:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WinZip Quick Pick.lnk = G:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://g:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://g:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://g:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://g:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://G:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Imprimer - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Similar Pages - res://g:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://g:\program files\google\GoogleToolbar2.dll/cmtrans.html O8 - Extra context menu item: Télécharger avec FlashGet - G:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: Télécharger tout avec FlashGet - G:\PROGRA~1\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - G:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - G:\PROGRA~1\FlashGet\flashget.exe O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "G:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - G:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: GhostStartService - Symantec Corporation - G:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - G:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE O23 - Service: Speed Disk service - Symantec Corporation - G:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - G:\WINDOWS\system32\ZoneLabs\vsmon.exe