asak

le kaperky Tuesday, August 15, 2006 1:07:14 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 15/08/2006 Kaspersky Anti-Virus database records: 202417 Scan Settings Scan using the following antivirus database standard Scan Archives true Scan Mail Bases true Scan Target Folders C:\ATI\ C:\BeWAN ADSL Ethernet st\ C:\bfu\ C:\Config.Msi\ C:\Documents and Settings\Administrateur\ C:\Documents and Settings\All Users\Application Data\ C:\Documents and Settings\All Users\Bureau\ C:\Documents and Settings\All Users\DRM\ C:\Documents and Settings\All Users\Favoris\ C:\Documents and Settings\All Users\Menu Démarrer\ C:\Documents and Settings\All Users\Modèles\ C:\Documents and Settings\Default User\ C:\Documents and Settings\Invité\ C:\Documents and Settings\Lalonde Mickael\ C:\Documents and Settings\LocalService\ C:\Documents and Settings\NetworkService\ C:\INCINERATE\ C:\My RoboForm Data\ C:\Program Files\Common Files\ C:\Program Files\ComPlus Applications\ C:\Program Files\Cucusoft\ C:\Program Files\DAMN NFO Viewer\ C:\Program Files\directx\ C:\Program Files\D-Tools\ C:\Program Files\e-Carte Bleue\ C:\Program Files\ewido anti-spyware 4.0\ C:\Program Files\Fichiers communs\ C:\Program Files\Folding@Home\ C:\Program Files\Guitar Pro 5\ C:\Program Files\HighMAT CD Writing Wizard\ C:\Program Files\InstallShield Installation Information\ C:\Program Files\Internet Explorer\ C:\Program Files\Java\ C:\Program Files\JavaSoft\ C:\Program Files\Messenger\ C:\Program Files\microsoft frontpage\ C:\Program Files\Movie Maker\ C:\Program Files\Mozilla Thunderbird\ C:\Program Files\MSN\ C:\Program Files\MSN Gaming Zone\ C:\Program Files\NetMeeting\ C:\Program Files\Overnet\ C:\Program Files\Panda Software\ C:\Program Files\Uninstall Information\ C:\Program Files\Windows Journal Viewer\ C:\Program Files\Windows Media Player\ C:\Program Files\Windows NT\ C:\Program Files\WindowsUpdate\ C:\Program Files\WinRAR\ C:\Program Files\xerox\ C:\RECYCLER\ C:\System Volume Information\ C:\téléchargements\ C:\WINDOWS\ C:\WUTemp\ Scan Statistics Total number of scanned objects 50558 Number of viruses found 0 Number of infected objects 0 / 0 Number of suspicious objects 0 Duration of the scan process 00:44:59 Infected Object Name Virus Name Last Action C:\Documents and Settings\Lalonde Mickael\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Lalonde Mickael\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Lalonde Mickael\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Lalonde Mickael\Local Settings\Historique\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Lalonde Mickael\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Lalonde Mickael\ntuser.dat Object is locked skipped C:\Documents and Settings\Lalonde Mickael\NTUSER.DAT.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Folding@Home\FAHlog.txt Object is locked skipped C:\Program Files\Folding@Home\work\logfile_06.txt Object is locked skipped C:\Program Files\Folding@Home\work\wudata_06.arc Object is locked skipped C:\Program Files\Folding@Home\work\wudata_06.bed Object is locked skipped C:\Program Files\Folding@Home\work\wudata_06.goe Object is locked skipped C:\Program Files\Folding@Home\work\wudata_06.log Object is locked skipped C:\Program Files\Folding@Home\work\wudata_06.sas Object is locked skipped C:\System Volume Information\_restore{39566892-F4AF-4DEF-AB31-66187E5B646F}\RP223\change.log Object is locked skipped C:\WINDOWS\Debug\oakley.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd3725.sys Object is locked skipped C:\WINDOWS\system32\drivers\vaxscsi.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_304.dat Object is locked skipped C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. EWIDO -------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 12:05:11 15/08/2006 + Scan result: C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@redcats.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@ads.addynamix[1].txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@adtech[1].txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@casinodelrio[1].txt -> TrackingCookie.Casinodelrio : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@www.casinodelrio[2].txt -> TrackingCookie.Casinodelrio : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@casinotropez[1].txt -> TrackingCookie.Casinotropez : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@www.casinotropez[2].txt -> TrackingCookie.Casinotropez : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@estat[1].txt -> TrackingCookie.Estat : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@www.etracker[1].txt -> TrackingCookie.Etracker : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@as1.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@www.myaffiliateprogram[2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@weborama[2].txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\Lalonde Mickael\Cookies\lalonde mickael@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). ::Report end clean Script clean par Malekal_morte - http://www.malekal.com Microsoft Windows XP [version 5.1.2600] Script execute en mode sans echec *** Suppression de fichiers sur C: *** Suppression des fichiers dans C:\WINDOWS\ *** Suppression des fichiers dans C:\WINDOWS\system32 *** Suppression des clefs du registre effectuee.. edg.txt Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Smapp"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMTray.exe" "QuickTime Task"="C:\\WINDOWS\\System32\\qttask.exe" "HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe" "HPHUPD05"="\"C:\\Program Files\\Hewlett-Packard\\{45B6180B-DCAB-4093-8EE8-6164457517F0}\\hphupd05.exe\"" "HP Software Update"="\"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd.exe\"" "HPHmon05"="C:\\WINDOWS\\System32\\hphmon05.exe" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1036" "eCarteBleue-CLEO"="\"C:\\Program Files\\e-Carte Bleue\\CL\\e-Carte Bleue VISA Cleo\\ECB-CLEO.exe\" /dontopenmycards" "APVXDWIN"="\"C:\\Program Files\\Panda Software\\Panda Titanium Antivirus 2004\\APVXDWIN.EXE\" /s" "KernelFaultCheck"="%systemroot%\\system32\\dumprep 0 -k" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\"" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe\"" "TkBellExe"="\"C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe\" -osboot" "RoboForm"="\"C:\\Program Files\\Siber Systems\\AI RoboForm\\RoboFormWatcher.exe\"" "vtaseh"="c:\\windows\\system32\\vtaseh.exe vtaseh" black light 08/15/06 13:38:23 [info]: BlackLight Engine 1.0.42 initialized 08/15/06 13:38:23 [info]: OS: 5.1 build 2600 (Service Pack 1) 08/15/06 13:38:24 [Note]: 7019 4 08/15/06 13:38:24 [Note]: 7005 0 08/15/06 13:38:27 [Note]: 7006 0 08/15/06 13:38:27 [Note]: 7011 1316 08/15/06 13:38:27 [Note]: 7026 0 08/15/06 13:38:27 [Note]: 7026 0 08/15/06 13:38:34 [Note]: FSRAW library version 1.7.1019 08/15/06 13:39:15 [Error]: 6019 0 08/15/06 13:39:15 [Error]: 6023 5 08/15/06 13:39:32 [Note]: 7007 0 et hijackthis Logfile of HijackThis v1.99.1 Scan saved at 13:40:31, on 15/08/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\WINDOWS\System32\qttask.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\e-Carte Bleue\CL\e-Carte Bleue VISA Cleo\ECB-CLEO.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Program Files\Siber Systems\AI RoboForm\RoboFormWatcher.exe C:\Program Files\Webroot\Washer\wwDisp.exe C:\Program Files\Folding@Home\winFAH.exe C:\Program Files\OpenOffice.org1.1.0\program\soffice.exe C:\Program Files\Folding@Home\FahCore_78.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Lalonde Mickael\Bureau\nettoyage\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = Supprimer cette entrée R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\System32\BhoECart.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [HPHUPD05] "C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1036 O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\e-Carte Bleue\CL\e-Carte Bleue VISA Cleo\ECB-CLEO.exe" /dontopenmycards O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboFormWatcher.exe" O4 - HKLM\..\Run: [vtaseh] c:\windows\system32\vtaseh.exe vtaseh O4 - HKCU\..\Run: [Window Washer] "C:\Program Files\Webroot\Washer\wwDisp.exe" O4 - Startup: Folding@home 4.00.lnk = ? O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Program Files\OpenOffice.org1.1.0\program\quickstart.exe O8 - Extra context menu item: &2 Customize Menu - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComCustomIEMenu.html O8 - Extra context menu item: &7 Fill Forms - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComFillForms.html O8 - Extra context menu item: &8 Save Forms - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComSavePass.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &7 Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Fill Id - {320AF880-6646-11D3-ABEE-C5DBF3571F47} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &5 Fill from Identity - {320AF880-6646-11D3-ABEE-C5DBF3571F47} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Fill Pass - {320AF880-6646-11D3-ABEE-C5DBF3571F48} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &6 Fill from Passcard - {320AF880-6646-11D3-ABEE-C5DBF3571F48} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &8 Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Go Fill - {320AF880-6646-11D3-ABEE-C5DBF3571F4A} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &Go && Fill from Passcard - {320AF880-6646-11D3-ABEE-C5DBF3571F4A} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Login - {320AF880-6646-11D3-ABEE-C5DBF3571F4B} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &Login (Go, Fill, Submit) - {320AF880-6646-11D3-ABEE-C5DBF3571F4B} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Options - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &Options - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Identities - {45DB34C3-955C-11D3-ABEF-444553540000} - C:\Program Files\Siber Systems\AI RoboForm\Identities.exe O9 - Extra 'Tools' menuitem: &3 Edit Identities - {45DB34C3-955C-11D3-ABEF-444553540000} - C:\Program Files\Siber Systems\AI RoboForm\Identities.exe O9 - Extra button: Passcards - {45DB34C3-955C-11D3-ABEF-444553540001} - C:\Program Files\Siber Systems\AI RoboForm\Passcards.exe O9 - Extra 'Tools' menuitem: &4 Edit Passcards - {45DB34C3-955C-11D3-ABEF-444553540001} - C:\Program Files\Siber Systems\AI RoboForm\Passcards.exe O9 - Extra button: RF toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &9 Robo Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: PackageHtmlCab - http://acces.blonde.com/package/PackageHtmlCab.CAB O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP...l_v1-0-3-17.cab O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} - http://www.bobtv.fr/download/cfweb_www.bob..._instmodule.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{C24A5410-248C-4009-8D07-CFEBF8130CD1}: NameServer = 212.151.136.246 212.151.137.166 O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Unknown owner - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Panda IManager Service (PSIMSVC) - Unknown owner - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe (file missing) O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe ça semble marcher correctemetn je n'ai plus vu de pop up merci de ton aide

voili voilo re rapporito 8/15/06 10:24:58 [info]: BlackLight Engine 1.0.42 initialized 08/15/06 10:24:58 [info]: OS: 5.1 build 2600 (Service Pack 1) 08/15/06 10:24:58 [Note]: 7019 4 08/15/06 10:24:58 [Note]: 7005 0 08/15/06 10:25:03 [Note]: 7006 0 08/15/06 10:25:03 [Note]: 7011 1292 08/15/06 10:25:03 [Note]: 7026 0 08/15/06 10:25:03 [Note]: 7026 0 08/15/06 10:25:03 [Note]: 7024 3 08/15/06 10:25:03 [info]: Hidden process: C:\windows\system32\vtaseh.exe 08/15/06 10:25:03 [Note]: FSRAW library version 1.7.1019 08/15/06 10:28:39 [Note]: 4020 64981 24248320 08/15/06 10:28:39 [Note]: 4018 64981 24248320 08/15/06 10:28:39 [Note]: 4013 67460 08/15/06 10:28:39 [Note]: 4020 64981 24248320 08/15/06 10:28:39 [Note]: 4018 64981 24248320 08/15/06 10:28:39 [Note]: 4013 67460 08/15/06 10:28:39 [Note]: 4020 64981 24248320 08/15/06 10:28:39 [Note]: 4018 64981 24248320 08/15/06 10:31:24 [info]: Hidden file: c:\WINDOWS\system32\vtaseh.dat 08/15/06 10:31:24 [Note]: 10002 1 08/15/06 10:31:24 [info]: Hidden file: C:\windows\system32\vtaseh.exe 08/15/06 10:31:24 [Note]: 10002 1 08/15/06 10:31:24 [info]: Hidden file: c:\WINDOWS\system32\vtaseh_nav.dat 08/15/06 10:31:24 [Note]: 10002 1 08/15/06 10:31:25 [info]: Hidden file: c:\WINDOWS\system32\vtaseh_navps.dat 08/15/06 10:31:25 [Note]: 10002 1 08/15/06 10:31:33 [info]: Hidden file: c:\WINDOWS\Prefetch\VTASEH.EXE-1A90C368.pf 08/15/06 10:31:33 [Note]: 10002 1

bonjour j'ai une cochonnerie dans mon pc et je n'arrive pas a m'en debarassé j'ai passé ewido et spybot et j'ai toujours ce problème de pub. Ma souris se barre dans le coin par moment aussi c'est vachement désagréable voila mon log hijackthis Logfile of HijackThis v1.99.1 Scan saved at 09:38:15, on 15/08/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\WINDOWS\System32\qttask.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\e-Carte Bleue\CL\e-Carte Bleue VISA Cleo\ECB-CLEO.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Program Files\Siber Systems\AI RoboForm\RoboFormWatcher.exe C:\Program Files\Webroot\Washer\wwDisp.exe C:\Program Files\Folding@Home\winFAH.exe C:\Program Files\OpenOffice.org1.1.0\program\soffice.exe C:\Program Files\Folding@Home\FahCore_78.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Lalonde Mickael\Bureau\nettoyage\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = Supprimer cette entrée R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\System32\BhoECart.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [HPHUPD05] "C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1036 O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\e-Carte Bleue\CL\e-Carte Bleue VISA Cleo\ECB-CLEO.exe" /dontopenmycards O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboFormWatcher.exe" O4 - HKCU\..\Run: [Window Washer] "C:\Program Files\Webroot\Washer\wwDisp.exe" O4 - Startup: Folding@home 4.00.lnk = ? O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Program Files\OpenOffice.org1.1.0\program\quickstart.exe O8 - Extra context menu item: &2 Customize Menu - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComCustomIEMenu.html O8 - Extra context menu item: &7 Fill Forms - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComFillForms.html O8 - Extra context menu item: &8 Save Forms - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComSavePass.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &7 Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Fill Id - {320AF880-6646-11D3-ABEE-C5DBF3571F47} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &5 Fill from Identity - {320AF880-6646-11D3-ABEE-C5DBF3571F47} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Fill Pass - {320AF880-6646-11D3-ABEE-C5DBF3571F48} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &6 Fill from Passcard - {320AF880-6646-11D3-ABEE-C5DBF3571F48} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &8 Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Go Fill - {320AF880-6646-11D3-ABEE-C5DBF3571F4A} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &Go && Fill from Passcard - {320AF880-6646-11D3-ABEE-C5DBF3571F4A} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Login - {320AF880-6646-11D3-ABEE-C5DBF3571F4B} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &Login (Go, Fill, Submit) - {320AF880-6646-11D3-ABEE-C5DBF3571F4B} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Options - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &Options - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Identities - {45DB34C3-955C-11D3-ABEF-444553540000} - C:\Program Files\Siber Systems\AI RoboForm\Identities.exe O9 - Extra 'Tools' menuitem: &3 Edit Identities - {45DB34C3-955C-11D3-ABEF-444553540000} - C:\Program Files\Siber Systems\AI RoboForm\Identities.exe O9 - Extra button: Passcards - {45DB34C3-955C-11D3-ABEF-444553540001} - C:\Program Files\Siber Systems\AI RoboForm\Passcards.exe O9 - Extra 'Tools' menuitem: &4 Edit Passcards - {45DB34C3-955C-11D3-ABEF-444553540001} - C:\Program Files\Siber Systems\AI RoboForm\Passcards.exe O9 - Extra button: RF toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &9 Robo Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: PackageHtmlCab - http://acces.blonde.com/package/PackageHtmlCab.CAB O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP...l_v1-0-3-17.cab O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - http://www.bobtv.fr/download/cfweb_www.bob..._instmodule.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{C24A5410-248C-4009-8D07-CFEBF8130CD1}: NameServer = 212.151.136.246 212.151.137.166 O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Unknown owner - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Panda IManager Service (PSIMSVC) - Unknown owner - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe (file missing) O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe si qq1 peut m'aider ce serait cool