interprétation rapport Hijackthis

dleclerc · le 26 juillet 2007

Bonjour

Quelqu'un peut il me dire si ce rapport indique une infection par des spywares ou autres malfaisants

Denis

Logfile of HijackThis v1.99.1

Scan saved at 21:48:32, on 24/07/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\Program Files\Fichiers communs\AOL\1160515324\ee\AOLSoftware.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\McAfee\MSK\MskAgent.exe

C:\Program Files\SiteAdvisor\6066\SiteAdv.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Program Files\Spyware Doctor\SDTrayApp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Macrogaming\SweetIM\SweetIM.exe

C:\Program Files\AOL 9.0l\aoltray.exe

C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

C:\Program Files\Google\Google Updater\GoogleUpdater.exe

C:\Program Files\OpenOffice.org 2.2\program\soffice.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN

C:\PROGRA~1\INCRED~1\bin\IMApp.exe

C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

C:\Program Files\Pack Securite\Common\FSMA32.EXE

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\Pack Securite\Common\FSMB32.EXE

C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe

C:\Program Files\Pack Securite\Common\FCH32.EXE

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

C:\Program Files\Pack Securite\Common\FAMEH32.EXE

C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

C:\Program Files\Pack Securite\FSPC\fspc.exe

C:\PROGRA~1\McAfee\MSC\mcpromgr.exe

c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe

c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\PROGRA~1\McAfee\MPS\mps.exe

C:\Program Files\McAfee\MSK\MskSrver.exe

C:\Program Files\Spyware Doctor\svcntaux.exe

C:\Program Files\Spyware Doctor\swdsvc.exe

C:\Program Files\SiteAdvisor\6066\SAService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\McAfee\MPS\mpsevh.exe

C:\WINDOWS\wanmpsvc.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Pack Securite\FSAUA\program\fsus.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\WINDOWS\system32\RDSHOST.exe

C:\WINDOWS\system32\sessmgr.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\SYSTEM32\RDSADDIN.EXE

C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe

C:\Program Files\McAfee\MPS\mpsevh.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/french

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/def...://fr.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll

O2 - BHO: SWEETIE Class - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll

O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1160515324\ee\AOLSoftware.exe

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe

O4 - HKLM\..\Run: [siteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe

O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - HKLM\..\Run: [sDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [incrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [sweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe

O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe

O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0l\aoltray.exe

O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe

O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?93d8461a530b4976ab9e9862e657cf61

O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?93d8461a530b4976ab9e9862e657cf61

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll

O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll

O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\program files\pack securite\fsps\program\fslsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...080/mcfscan.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe

O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe

O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe

O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe

O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

dleclerc · le 26 juillet 2007

ai-je déposé ma question au bon endroit ? je ne vois pas de réponse ?

D L

pdesprat · le 27 juillet 2007

voici mon interpretation

Logfile of HijackThis v1.99.1

Votre version semble être actuelle.

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Votre version semble être actuelle.

C:\WINDOWS\System32\smss.exe

Very safe

This entry was classified from our visitors as good.

C:\WINDOWS\system32\csrss.exe

Safe

Systemprozess - Client Server Runtime

C:\WINDOWS\system32\winlogon.exe

Very safe

This entry was classified from our visitors as good.

C:\WINDOWS\system32\services.exe

Safe

This entry was classified from our visitors as good.

C:\WINDOWS\system32\lsass.exe

Very safe

This entry was classified from our visitors as good.

C:\WINDOWS\system32\svchost.exe

Safe

This entry was classified from our visitors as good.

C:\WINDOWS\system32\svchost.exe

Safe

This entry was classified from our visitors as good.

C:\Program Files\Windows Defender\MsMpEng.exe

Very safe

This entry was classified from our visitors as good.

C:\WINDOWS\System32\svchost.exe

Very safe

This entry was classified from our visitors as good.

C:\WINDOWS\system32\svchost.exe

Safe

This entry was classified from our visitors as good.

C:\WINDOWS\system32\svchost.exe

Safe

This entry was classified from our visitors as good.

C:\WINDOWS\Explorer.EXE

Very safe

This entry was classified from our visitors as good.

C:\WINDOWS\system32\spoolsv.exe

Safe

This entry was classified from our visitors as good.

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

Neutral

Checks for updates for RealPlayer

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

Java Runtime

C:\Program Files\Fichiers communs\AOL\1160515324\ee\AOLSoftware.exe

Comes with ICQ 6

C:\Program Files\Windows Defender\MSASCui.exe

Very safe

This entry was classified from our visitors as good.

C:\Program Files\McAfee\MSK\MskAgent.exe

Neutral

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\mcafee\spamki~1\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. Bestandteil von McAfee

C:\Program Files\SiteAdvisor\6066\SiteAdv.exe

Very safe

McAfee SiteAdvisor

C:\Program Files\Picasa2\PicasaMediaDetector.exe

Safe

Picasa Media

C:\Program Files\Spyware Doctor\SDTrayApp.exe

Very safe Fuzzy Algorithmcheck (4.22 / 5.00), Safe

C:\WINDOWS\system32\ctfmon.exe

Very safe

This entry was classified from our visitors as good.

C:\Program Files\Macrogaming\SweetIM\SweetIM.exe

Neutral

Macrogaming SweetIM

C:\Program Files\AOL 9.0l\aoltray.exe

AOL Trayicon

C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

Ulead Photo Express

C:\Program Files\Google\Google Updater\GoogleUpdater.exe

Very safe

Google Updater

C:\Program Files\OpenOffice.org 2.2\program\soffice.exe

Very safe

Open Office

C:\Program Files\MSN Messenger\MsnMsgr.Exe

Safe

This entry was classified from our visitors as good.

C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN

Open Office Quickstart

C:\PROGRA~1\INCRED~1\bin\IMApp.exe

Very safe

Incredi Mail

C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

Safe

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\gemeinsame dateien\aol\acs\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. Part of AOL

C:\Program Files\Pack Securite\Common\FSMA32.EXE

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\f-secure.*\common\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. F-SECURE ANTI-VIRUS

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

Safe

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\google\common\google updater\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. This entry was classified from our visitors as good.

C:\Program Files\Pack Securite\Common\FSMB32.EXE

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\f-secure\common\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. F-SECURE ANTI-VIRUS

C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe

McAfee HackerWatch Service

C:\Program Files\Pack Securite\Common\FCH32.EXE

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\f-secure.*\common\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. F-Secure Antivirus

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

Very safe

Part of McAfee

c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

Safe

McAfee Network Agent

C:\Program Files\Pack Securite\Common\FAMEH32.EXE

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\f-secure.*\common\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. F-Secure Internet Security Site

C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

Very safe

McAfee Scanner

C:\Program Files\Pack Securite\FSPC\fspc.exe

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\f-secure internet security\fspc\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. Part of Shaw Secure FSPC

C:\PROGRA~1\McAfee\MSC\mcpromgr.exe

Very safe

McAfee Protection Manager

c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe

McAfee Proxy Service

c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe

McAfee Redirector Service

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

Safe

This entry was classified from our visitors as good.

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

Very safe

McAfee SystemGuards

C:\Program Files\McAfee\MPF\MPFSrv.exe

Safe

McAfee Personal Firewall Service

C:\PROGRA~1\McAfee\MPS\mps.exe

Very safe

McAfee Privacy Service

C:\Program Files\McAfee\MSK\MskSrver.exe

McAfee SpamKiller Service

C:\Program Files\Spyware Doctor\svcntaux.exe

Safe

Spyware Doctor - Antispyware Application

C:\Program Files\Spyware Doctor\swdsvc.exe

Safe

Spyware Doctor - Anti Spyware

C:\Program Files\SiteAdvisor\6066\SAService.exe

Very safe

McAffee SiteAdvisor

C:\WINDOWS\system32\svchost.exe

Safe

This entry was classified from our visitors as good.

C:\Program Files\McAfee\MPS\mpsevh.exe

Part of McAfee

C:\WINDOWS\wanmpsvc.exe

Safe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

Neutral

C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\f-secure internet security\fsaua\program\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. F-Secure Internet Security

C:\WINDOWS\System32\alg.exe

Very safe Service utilisé par Windows, superflu si vous n’utilisez pas ICS !

This entry was classified from our visitors as good.

C:\Program Files\Pack Securite\FSAUA\program\fsus.exe

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\f-secure internet security\fsaua\program\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. F-Secure Internet Security

C:\WINDOWS\System32\svchost.exe

Very safe

This entry was classified from our visitors as good.

C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe

Eventuellement méchant! Selon notre base de données, ce processus s’exécute normalement dans c:\programme\gemeinsame dateien\.*\! Vérifiez si vous connaissez ce processus et arrangez un contrôle antivirus si nécessaire. McAfee E-mail Proxy

C:\Program Files\MSN Messenger\usnsvc.exe

Very safe

This entry was classified from our visitors as good.

C:\WINDOWS\system32\RDSHOST.exe

Safe Tâche inconnue.

This entry was classified from our visitors as good.

C:\WINDOWS\system32\sessmgr.exe

Very safe

C:\WINDOWS\system32\csrss.exe

Safe

Systemprozess - Client Server Runtime

C:\WINDOWS\system32\winlogon.exe

Very safe

This entry was classified from our visitors as good.

C:\WINDOWS\SYSTEM32\RDSADDIN.EXE

Safe Tâche inconnue.

C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe

Windows Helpcenter

C:\Program Files\McAfee\MPS\mpsevh.exe

Part of McAfee

C:\Program Files\Internet Explorer\iexplore.exe

Safe

This entry was classified from our visitors as good.

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

Safe Tâche inconnue.

This entry was classified from our visitors as good.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html

Ce site a été identifié comme étant non dangereux

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/

Ce site a été identifié comme étant non dangereux

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/french

Ce site a été identifié comme étant non dangereux

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

Safe Ce site a été identifié comme étant non dangereux

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

Safe Ce site a été identifié comme étant non dangereux

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

Safe Ce site a été identifié comme étant non dangereux

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

Safe Ce site a été identifié comme étant non dangereux

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/def...://fr.yahoo.com

Ce site a été identifié comme étant non dangereux

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html

Ce site a été identifié comme étant non dangereux

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

Very safe Ce site a été identifié comme étant non dangereux

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll dangeureux

Nasty Fuzzy Algorithmcheck (2.72 / 5.00), Nasty

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

Cette inscription a été identifiée comme étant non dangereuse.

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

Ycomp*_*_*_*.dll - Yahoo Companion!, Yahoo Companion!

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

Very safe AcroIEhelper.ocx, AcroIEhelper.dll - Adobe Acrobat reader, http://www.adobe.com/products/acrobat/re adstep2.html

O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll

Very safe saIE.dll - SiteAdvisor, http://www.siteadvisor.com/preview/

O2 - BHO: SWEETIE Class - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll

toolbar.dll - SweetIM, http://www.sweetim.com - see eula, http://www.sweetim.com/eula.html

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

Safe This entry was classified from our visitors as good.

O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll

eorezobho.dll - EoRezo, http://www.eorezo.com/cgi-bin/index.cgi

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

SUN Java

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll

Safe scriptproxy.dll, scriptsn.dll - McAfee, http://us.mcafee.com/ ScriptScan

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

Neutral WindowsLiveLogin.dll - Microsoft Windows_Live, http://ideas.live.com/

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

Safe This entry was classified from our visitors as good.

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

Very safe swg.dll - Google Toolbar Notifier, http://googlesystem.blogspot.com/2006/07 /google-is-your-default-search.html

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

MSN Toolbar Helper

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

Msntb.dll - MSN Toolbar, http://toolbar.msn.com/

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

Very safe Ycomp*_*_*_*.dll - Yahoo Companion!, http://companion.yahoo.com/

O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll

Very safe saIE.dll - SiteAdvisor, http://www.siteadvisor.com/preview/

O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll

Nasty toolbar.dll - SweetIM, http://www.sweetim.com - see eula, http://www.sweetim.com/eula.html

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

Safe This entry was classified from our visitors as good.

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

Part of RealPlayer

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

Java von Sun

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1160515324\ee\AOLSoftware.exe

Non dangereux, mais tout de même superflu. Quoted from AOL Beta Team

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

Very safe This entry was classified from our visitors as good.

O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe

Bestandteil von McAfee

O4 - HKLM\..\Run: [siteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe

Very safe McAfee SiteAdvisor

O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

Safe Non dangereux, mais tout de même superflu. Media detector for Picasa's automatic photo organizer

O4 - HKLM\..\Run: [sDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"

Fuzzy Algorithmcheck (4.22 / 5.00), Safe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

Safe This entry was classified from our visitors as good.

O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

Microsoft s MSN Messenger 6

O4 - HKCU\..\Run: [incrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c

Neutral Incredi Mail

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

Neutral Associated with GoogleToolbarNotifier from Google Inc.

O4 - HKCU\..\Run: [sweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe

Neutral Non dangereux, mais tout de même superflu. vSweetIM - send fancier smiley-faces and IM graphics to friends who are using MSN Messenger. They are only able to see these advanced smiley-faces if they also have SweetIM installed

O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe

Very safe OpenOffice.org 1.1.2 Quickstarter

O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0l\aoltray.exe

Fuzzy Algorithmcheck (4 / 5.00), Safe

O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

Non dangereux, mais tout de même superflu. Ulead Calendar Checker - part of Ulead Photo Express

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

Safe Non dangereux, mais tout de même superflu. This entry was classified from our visitors as good.

O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe

Google Updater

O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

Very safe This entry was classified from our visitors as good.

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

Safe Cette inscription &Windows Live Search a été identifiée comme étant non dangereuse.

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?93d8461a530b4976ab9e9862e657cf61

Cette inscription Ouvrir dans un nouvel onglet d'arrière-plan a été identifiée comme étant non dangereuse.

O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?93d8461a530b4976ab9e9862e657cf61

Cette inscription Ouvrir dans un nouvel onglet de premier plan a été identifiée comme étant non dangereuse.

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

Cette inscription a été identifiée comme étant non dangereuse.

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

Cette inscription Console Java a été identifiée comme étant non dangereuse.

O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll

Cette inscription Parental... a été identifiée comme étant non dangereuse.

O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll

Cette inscription a été identifiée comme étant non dangereuse.

O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll

Cette inscription Parental... a été identifiée comme étant non dangereuse.

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

Neutral

Inscription superflue (car sans effet) qui peut donc être effacée ! Cette inscription a été identifiée comme étant non dangereuse.

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

Safe

Inscription superflue (car sans effet) qui peut donc être effacée ! This entry was classified from our visitors as good.

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

Very safe

Inscription superflue (car sans effet) qui peut donc être effacée ! This entry was classified from our visitors as good.

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

Very safe Cette inscription Messenger a été identifiée comme étant non dangereuse.

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

Neutral Cette inscription Windows Messenger a été identifiée comme étant non dangereuse.

O10 - Unknown file in Winsock LSP: c:\program files\pack securite\fsps\program\fslsp.dll

Cette inscription devrait être bonne. Pour en être certain, scannez votre disque dur avec LSPFix de Cexx.org. Ne pas effacer cette inscription manuellement, essayez plutôt de vous en débarrasser avec le programm LSPFix von Cexx.org.