rapport hijackthis

[nine143]

re,

 

1/telecharge silent runners http://www.silentrunners.org/Silent%20Runners.vbs

(fait clique droit sur le lien, puis enregistrer la cible sous)

 

2/déconnecte toi du net et ferme toutes les applications en cours.

 

3/lance silent runners laisse le travailler quand il aura finit de scanner tu en sauras averti par un message et un nouveau fichier texte sera crée ouvre ce fichier texte et colle la totalité du rapport.

 

 

hello,

 

bon j'ai re-re-regardé a maintes reprises pour voir le nom du fichier et c autochk.exe (et non autock.exe) pardon pour le H qui manquait décidement tu as vraiment du mérite à m'aider

 

voila le rapport m'sieur:

 

"Silent Runners.vbs", revision 48, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"

 

 

Startup items buried in registry:

---------------------------------

 

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"msnmsgr" = ""C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background" [MS]

"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]

 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"BDMCon" = "c:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe" ["SOFTWIN S.R.L."]

"BDNewsAgent" = ""C:\PROGRA~1\softwin\BITDEF~1\bdnagent.exe"" ["SOFTWIN S.R.L"]

"BDSwitchAgent" = ""C:\PROGRA~1\softwin\BITDEF~1\bdswitch.exe"" [null data]

"HotKeysCmds" = "C:\WINDOWS\system32\hkcmd.exe" ["Intel Corporation"]

"SynTPLpr" = "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" ["Synaptics, Inc."]

"SynTPEnh" = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."]

"SunJavaUpdateSched" = "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [null data]

"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]

"NWEReboot" = (empty string)

"IgfxTray" = "C:\WINDOWS\system32\igfxtray.exe" ["Intel Corporation"]

"DataLayer" = "C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."]

"BDOESRV" = ""C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"" ["SOFTWIN SRL"]

"AGRSMMSG" = "AGRSMMSG.exe" ["Agere Systems"]

"!ewido" = ""C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized" ["Anti-Malware Development a.s."]

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"

-> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"

\InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"

-> {HKLM...CLSID} = "HyperTerminal Icon Ext"

\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

"{2F603045-309F-11CF-9774-0020AFD0CFF6}" = "Synaptics Control Panel"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Synaptics\SynTP\SynTPCpl.dll" ["Synaptics, Inc."]

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"

-> {HKLM...CLSID} = "Outlook File Icon Extension"

\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]

"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"

-> {HKLM...CLSID} = "Nokia Phone Browser"

\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]

"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"

-> {HKLM...CLSID} = "Contact View"

\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"]

"{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View"

-> {HKLM...CLSID} = "Message View"

\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"]

"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"

-> {HKLM...CLSID} = "Shell Search Band"

\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]

"{D653647D-D607-4DF6-A5B8-48D2BA195F7B}" = "BitDefender Antivirus v9"

-> {HKLM...CLSID} = "BitDefender Antivirus v9"

\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender9\bdshelxt.dll" [null data]

"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"

-> {HKLM...CLSID} = "Mes dossiers de partage"

\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0812.00.dll" [MS]

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\

INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"

-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"

\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\

INFECTION WARNING! "AppInit_DLLs" = "sockspy.dll" [null data]

 

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"

-> {HKLM...CLSID} = "PDF Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

 

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\

BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"

-> {HKLM...CLSID} = "BitDefender Antivirus v9"

\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender9\bdshelxt.dll" [null data]

ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"

-> {HKLM...CLSID} = "CContextScan Object"

\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]

 

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"

-> {HKLM...CLSID} = "CContextScan Object"

\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]

 

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"

-> {HKLM...CLSID} = "BitDefender Antivirus v9"

\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender9\bdshelxt.dll" [null data]

 

 

Active Desktop and Wallpaper:

-----------------------------

 

Active Desktop is disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

 

HKCU\Control Panel\Desktop\

"Wallpaper" = "C:\Documents and Settings\clarence\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

 

 

Winsock2 Service Provider DLLs:

-------------------------------

 

Namespace Service Providers

 

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

 

Transport Service Providers

 

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 21

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

 

 

Toolbars, Explorer Bars, Extensions:

------------------------------------

 

Toolbars

 

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"

-> {HKLM...CLSID} = "MSN"

\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll" [MS]

 

Extensions (Tools menu items, main toolbar menu buttons)

 

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Console Java (Sun)"

"CLSIDExtension" = "{08B0E5C0-4FCB-11CF-AAA5-00401C608501}"

 

 

Miscellaneous IE Hijack Points

------------------------------

 

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

 

Added lines (compared with English-language version):

[strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"

 

Missing lines (compared with English-language version):

[strings]: 1 line

 

 

Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------

 

BitDefender Communicator, XCOMM, ""C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service" ["Softwin"]

BitDefender Desktop Update Service, LIVESRV, ""C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service" ["SOFTWIN S.R.L."]

BitDefender Scan Server, bdss, ""C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service" [null data]

BitDefender Virus Shield, VSSERV, ""C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service" ["SOFTWIN S.R.L."]

ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]

Pml Driver HPZ12, Pml Driver HPZ12, "C:\WINDOWS\system32\HPZipm12.exe" ["HP"]

Service Messenger Sharing USN Journal Reader, usnsvc, "C:\WINDOWS\system32\svchost.exe -k usnsvc" {"C:\Program Files\MSN Messenger\usnsvc.dll" [MS]}

STI Simulator, STI Simulator, "C:\WINDOWS\System32\PAStiSvc.exe" [null data]

 

 

Print Monitors:

---------------

 

HKLM\System\CurrentControlSet\Control\Print\Monitors\

HP Standard TCP/IP Port\Driver = "HpTcpMon.dll" ["Hewlett Packard"]

hpzlnt12\Driver = "hpzlnt12.dll" ["HP"]

Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS]

 

 

----------

+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

+ To search all directories of local fixed drives for DESKTOP.INI

DLL launch points and all Registry CLSIDs for dormant Explorer Bars,

use the -supp parameter or answer "No" at the first message box.

---------- (total run time: 41 seconds, including 16 seconds for message boxes)

 

bonne nuit

[bruce lee]

salut nine143,

 

bon j'ai re-re-regardé a maintes reprises pour voir le nom du fichier et c autochk.exe (et non autock.exe)

 

Ah beh ca me rassure, je trouvais ca bizzare

 

Le fichier qui te manque correspond a http://translate.google.com/translate?hl=f...ficial%26sa%3DG

 

As tu encore des problemes avec ton PC en ce qui concerne les virus?

 

Pour ton autre probleme, la suite se passe ici:

 

http://forum.zebulon.fr/index.php?showforum=12

 

@+

[nine143]

salut nine143,

Ah beh ca me rassure, je trouvais ca bizzare

 

Le fichier qui te manque correspond a http://translate.google.com/translate?hl=f...ficial%26sa%3DG

 

As tu encore des problemes avec ton PC en ce qui concerne les virus?

 

Pour ton autre probleme, la suite se passe ici:

 

http://forum.zebulon.fr/index.php?showforum=12

 

@+

 

hello,

eh bien je ne sais pas si j'ai encore des virus ou pas ce que je sais c'est que mon pc rame a fond...aujourdhui j'ai fai ewido et j'ai trouvé 28 fichier infecté mai quand je lance Bitdefender il me trouve aucun virus... donc... je sais pas.

En tout cas, Merci pour m'avoir accorder du temps.

 

[bruce lee]

bonjour nine143,

 

As tu le rapport de ewido? Si oui, poste le.

[nine143]

bonjour nine143,

 

As tu le rapport de ewido? Si oui, poste le.

 

bonjour Bruce Lee,

 

oui je l'ai :

 

---------------------------------------------------------

ewido anti-spyware - Scan Report

---------------------------------------------------------

 

+ Created at: 13:36:29 28/09/2006

 

+ Scan result:

 

 

 

:mozilla.108:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).

:mozilla.109:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).

:mozilla.120:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).

:mozilla.121:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).

:mozilla.122:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).

:mozilla.31:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).

:mozilla.20:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).

:mozilla.98:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Estat : Cleaned with backup (quarantined).

:mozilla.99:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Estat : Cleaned with backup (quarantined).

:mozilla.132:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

:mozilla.32:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

:mozilla.33:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

:mozilla.34:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

:mozilla.35:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

:mozilla.36:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

:mozilla.37:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

:mozilla.78:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Itrack : Cleaned with backup (quarantined).

:mozilla.92:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).

:mozilla.101:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.102:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.103:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.104:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.105:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.106:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.133:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).

:mozilla.89:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).

:mozilla.90:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).

:mozilla.129:C:\Documents and Settings\clarence\Application Data\Mozilla\Firefox\Profiles\5c5p5n1q.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).

 

 

::Report end

 

par contre ils vont tous en quarantaine je peux pas directement les supprimer plutot?

 

et puis mon Pc rame toujours et je suis perdue je sais plus ce qu'il faut que je fasse pour que ca refonctionne comme avant...pfiou.

j'ai essayé le lien que tu m'a donné et j'ai telechargé registry booster (je sais que ce n'est plus ton domaine) mais ce logiciel m'a trouvé 167 problemes sauf qu'il en corrige que 15 après faut que je paie.

est ce que la lenteur vient de la???

est ce que c'est le virus qui m'a créer ces problemes?

Merci encore.

 

Nine.

[bruce lee]

bonjour nine143,

 

j'ai essayé le lien que tu m'a donné et j'ai telechargé registry booster (je sais que ce n'est plus ton domaine) mais ce logiciel m'a trouvé 167 problemes sauf qu'il en corrige que 15 après faut que je paie.

 

effectivement, tu n'es pas dans la bonne partie du forum.

 

Non, tu n'as plus de bestioles dans ton PC; pour le probleme que tu as, la suite ce passe ici:

 

http://forum.zebulon.fr/index.php?showforum=12

 

 

@+ et désolé de ne pas pouvoir faire plus.

[nine143]

bonjour nine143,

effectivement, tu n'es pas dans la bonne partie du forum.

 

Non, tu n'as plus de bestioles dans ton PC; pour le probleme que tu as, la suite ce passe ici:

 

http://forum.zebulon.fr/index.php?showforum=12

@+ et désolé de ne pas pouvoir faire plus.

java script:add_smilie("","smid_144")

icon_Hello3.gif

 

hello

 

tu rigole c'est deja enorme ce que tu as fait!! MERCI MERCI!!