Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

[résolu] Faux antivirus et fenêtres qui s'ouvrent toutes seules

microgolgi

Par microgolgi
dans Analyses et éradication malwares

 Partager

Messages recommandés

microgolgi Member

microgolgi

Posté(e)
  • Auteur
Posté(e)
Re,

 

As-tu moyen de me poster le rapport de Vundofix ?

 

Poste un nouveau rapport HijackThis

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 10:30:37 26/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\awvtt.dll

C:\WINDOWS\system32\ttvwa.bak1

C:\WINDOWS\system32\ttvwa.bak2

C:\WINDOWS\system32\ttvwa.ini

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\awvtt.dll

C:\WINDOWS\system32\awvtt.dll Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\ttvwa.bak1

C:\WINDOWS\system32\ttvwa.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\ttvwa.bak2

C:\WINDOWS\system32\ttvwa.bak2 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\ttvwa.ini

C:\WINDOWS\system32\ttvwa.ini Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 14:23:02 26/08/2007

 

Listing files found while scanning....

 

C:\windows\system32\ftinspxg.exe

C:\windows\system32\maxjdmjb.dll

C:\WINDOWS\system32\mlnmp.bak1

C:\WINDOWS\system32\mlnmp.bak2

C:\WINDOWS\system32\mlnmp.ini

C:\WINDOWS\system32\pmnlm.dll

 

Beginning removal...

 

Attempting to delete C:\windows\system32\ftinspxg.exe

C:\windows\system32\ftinspxg.exe Has been deleted!

 

Attempting to delete C:\windows\system32\maxjdmjb.dll

C:\windows\system32\maxjdmjb.dll Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\mlnmp.bak1

C:\WINDOWS\system32\mlnmp.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\mlnmp.bak2

C:\WINDOWS\system32\mlnmp.bak2 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\mlnmp.ini

C:\WINDOWS\system32\mlnmp.ini Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\pmnlm.dll

C:\WINDOWS\system32\pmnlm.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 17:37:16 26/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\cfhkj.bak1

C:\WINDOWS\system32\cfhkj.ini

C:\WINDOWS\system32\jkhfc.dll

C:\windows\system32\mgcenlry.exe

C:\windows\system32\ustvytly.dll

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\cfhkj.bak1

C:\WINDOWS\system32\cfhkj.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\cfhkj.ini

C:\WINDOWS\system32\cfhkj.ini Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\jkhfc.dll

C:\WINDOWS\system32\jkhfc.dll Could not be deleted.

 

Attempting to delete C:\windows\system32\mgcenlry.exe

C:\windows\system32\mgcenlry.exe Has been deleted!

 

Attempting to delete C:\windows\system32\ustvytly.dll

C:\windows\system32\ustvytly.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\jkhfc.dll

C:\WINDOWS\system32\jkhfc.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 18:51:55 26/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\kjllm.bak1

C:\WINDOWS\system32\kjllm.ini

C:\WINDOWS\system32\mlljk.dll

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\kjllm.bak1

C:\WINDOWS\system32\kjllm.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\kjllm.ini

C:\WINDOWS\system32\kjllm.ini Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\mlljk.dll

C:\WINDOWS\system32\mlljk.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 14:32:44 30/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\jkkll.dll

C:\WINDOWS\system32\llkkj.bak1

C:\WINDOWS\system32\llkkj.bak2

C:\WINDOWS\system32\llkkj.ini

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\jkkll.dll

C:\WINDOWS\system32\jkkll.dll Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\llkkj.bak1

C:\WINDOWS\system32\llkkj.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\llkkj.bak2

C:\WINDOWS\system32\llkkj.bak2 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\llkkj.ini

C:\WINDOWS\system32\llkkj.ini Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 14:43:12 30/08/2007

 

Listing files found while scanning....

 

C:\WINDOWS\system32\rrutv.bak1

C:\WINDOWS\system32\rrutv.ini

C:\WINDOWS\system32\vturr.dll

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\rrutv.bak1

C:\WINDOWS\system32\rrutv.bak1 Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\rrutv.ini

C:\WINDOWS\system32\rrutv.ini Has been deleted!

 

Attempting to delete C:\WINDOWS\system32\vturr.dll

C:\WINDOWS\system32\vturr.dll Could not be deleted.

 

Performing Repairs to the registry.

Done!

 

Beginning removal...

 

Attempting to delete C:\WINDOWS\system32\vturr.dll

C:\WINDOWS\system32\vturr.dll Has been deleted!

 

Performing Repairs to the registry.

Done!

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 14:50:50 30/08/2007

 

Listing files found while scanning....

 

No infected files were found.

 

 

VundoFix V6.5.7

 

Checking Java version...

 

Scan started at 14:58:44 30/08/2007

 

Listing files found while scanning....

 

No infected files were found.

 

 

 

 

Logfile of HijackThis v1.99.1

Scan saved at 15:02:07, on 30/08/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe

C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE

C:\PROGRA~1\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\PROGRA~1\Wanadoo\Watch.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.chemtable.com/order3.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {60D13203-2DC3-4E31-8909-E70BEC38D9F8} - C:\WINDOWS\system32\nnnkhfe.dll

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: (no name) - {68FEF0F3-B2A7-4C52-9B00-8C495CD03F28} - C:\WINDOWS\system32\pmnlm.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {838F02C0-6F57-4332-8298-1D5A7A19F1F9} - C:\WINDOWS\system32\jkkll.dll (file missing)

O2 - BHO: (no name) - {8992AFAC-465A-40E6-8611-585EEB8DEE01} - C:\WINDOWS\system32\vturr.dll (file missing)

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: (no name) - {CACF3C3A-708F-4CD0-AE52-AE78A2CD536E} - C:\WINDOWS\system32\awvtt.dll (file missing)

O2 - BHO: (no name) - {D3388959-E43E-403A-A8F3-335F27D9B6ED} - C:\WINDOWS\system32\mlljk.dll (file missing)

O2 - BHO: (no name) - {DA38295B-6DF8-40C1-A086-39CB7DC7A5CD} - C:\WINDOWS\system32\jkhfc.dll (file missing)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx

O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O18 - Protocol: bw+0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw+0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: bwg0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwg0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: offline-8876480 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: nnnkhfe - C:\WINDOWS\SYSTEM32\nnnkhfe.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

bruce lee Devil Member !

bruce lee

Posté(e)
Posté(e)

Re,

 

Télécharge Deckard's System Scanner http://deckard.geekstogo.com/dss.exe sur ton bureau

 

Ferme toutes les applications en cours

Doublie clique sur dss.exe. Tu auras deux messages qui vont apparaitre à l'écran, clique sur OK pour les deux.

 

Sois patient, le scan peut être long.

 

A la fin tu auras de nouveau un message disant que bloc-notes va s'ouvrir clique sur OK puis fais un copier/coller de tout son contenu.

microgolgi Member

microgolgi

Posté(e)
  • Auteur
Posté(e)

Deckard's System Scanner v20070826.66

Run by jeremy on 2007-08-30 15:04:49

Computer is in Normal Mode.

--------------------------------------------------------------------------------

 

-- System Restore --------------------------------------------------------------

 

Successfully created a Deckard's System Scanner Restore Point.

 

 

-- Last 5 Restore Point(s) --

94: 2007-08-30 13:04:59 UTC - RP151 - Deckard's System Scanner Restore Point

93: 2007-08-28 21:54:16 UTC - RP150 - Software Distribution Service 3.0

92: 2007-08-28 11:45:59 UTC - RP149 - Point de vérification système

91: 2007-08-26 18:24:44 UTC - RP148 - Installed Ad-Aware 2007

90: 2007-08-25 16:47:01 UTC - RP147 - Removed Ad-Aware 2007

 

 

-- First Restore Point --

1: 2007-05-29 18:52:08 UTC - RP58 - Supprimé SpellForce 2 - Shadow Wars

 

 

Backed up registry hives.

Performed disk cleanup.

 

 

 

-- HijackThis (run as jeremy.exe) ----------------------------------------------

 

Logfile of HijackThis v1.99.1

Scan saved at 15:05:45, on 30/08/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe

C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE

C:\PROGRA~1\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\PROGRA~1\Wanadoo\Watch.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Documents and Settings\jeremy\Bureau\dss.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

C:\PROGRA~1\HIJACK~1\jeremy.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.chemtable.com/order3.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {60D13203-2DC3-4E31-8909-E70BEC38D9F8} - C:\WINDOWS\system32\nnnkhfe.dll

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: (no name) - {68FEF0F3-B2A7-4C52-9B00-8C495CD03F28} - C:\WINDOWS\system32\pmnlm.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {838F02C0-6F57-4332-8298-1D5A7A19F1F9} - C:\WINDOWS\system32\jkkll.dll (file missing)

O2 - BHO: (no name) - {8992AFAC-465A-40E6-8611-585EEB8DEE01} - C:\WINDOWS\system32\vturr.dll (file missing)

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: (no name) - {CACF3C3A-708F-4CD0-AE52-AE78A2CD536E} - C:\WINDOWS\system32\awvtt.dll (file missing)

O2 - BHO: (no name) - {D3388959-E43E-403A-A8F3-335F27D9B6ED} - C:\WINDOWS\system32\mlljk.dll (file missing)

O2 - BHO: (no name) - {DA38295B-6DF8-40C1-A086-39CB7DC7A5CD} - C:\WINDOWS\system32\jkhfc.dll (file missing)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx

O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O18 - Protocol: bw+0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw+0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: bwg0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwg0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0s - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: offline-8876480 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: nnnkhfe - C:\WINDOWS\SYSTEM32\nnnkhfe.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

 

-- HijackThis Fixed Entries (C:\PROGRA~1\HIJACK~1\backups\) --------------------

 

backup-20070830-135316-112 O4 - HKLM\..\Run: [gadynurvsl] c:\windows\system32\gadynurvsl.exe gadynurvsl

backup-20070830-135316-808 O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)

backup-20070830-135317-281 O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.downloadcontrol.com/files/insta...eInstall_fr.cab

 

-- File Associations -----------------------------------------------------------

 

All associations okay.

 

 

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

 

R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology (StarForce); SF FrontLine>

R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology (StarForce); SF FrontLine>

R0 sfsync04 (StarForce Protection Synchronization Driver (version 4.x)) - c:\windows\system32\drivers\sfsync04.sys <Not Verified; Protection Technology (StarForce); SF FrontLine>

R1 aslm75 - c:\windows\system32\drivers\aslm75.sys

R3 PCANDIS5 (PCANDIS5 NDIS Protocol Driver) - c:\windows\system32\pcandis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>

 

S3 L8042mou (Logitech SetPoint PS/2 Mouse Filter Driver) - c:\windows\system32\drivers\l8042mou.sys <Not Verified; Logitech, Inc.; Logitech SetPoint>

S3 PCAMPR5 (PCAMPR5 NDIS Protocol Driver) - c:\windows\system32\pcampr5.sys (file missing)

S3 RT2500USB (Hercules Wireless USB Dongle Driver) - c:\windows\system32\drivers\rt73.sys (file missing)

S3 SANDRA - c:\program files\sisoftware\sisoftware sandra lite 2005.sr3\sandra.sys (file missing)

S3 ZSMC211 (USB PC Camera (ZS211)) - c:\windows\system32\drivers\zs211.sys <Not Verified; ZSMC Corporation; >

 

 

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

 

R2 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service>

R2 EPSONStatusAgent2 (EPSON Printer Status Agent2) - c:\program files\fichiers communs\epson\ebapi\sagent2.exe <Not Verified; SEIKO EPSON CORPORATION; EPSON Bidirectional Printer>

R2 FTRTSVC (France Telecom Routing Table Service) - c:\windows\system32\ftrtsvc.exe <Not Verified; France Telecom; FTRTSVC NT Service>

 

 

-- Device Manager: Disabled ----------------------------------------------------

 

No disabled devices found.

 

 

-- Files created between 2007-07-30 and 2007-08-30 -----------------------------

 

2007-08-30 13:51:33 0 d-------- C:\!KillBox

2007-08-30 13:34:09 0 d-------- C:\Program Files\Navilog1

2007-08-27 22:19:53 0 d-------- C:\Program Files\Picasa2

2007-08-27 05:56:52 773284 -----n--- C:\WINDOWS\system32\kjllm.bak2

2007-08-26 20:24:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2007-08-26 20:24:09 0 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard

2007-08-26 16:47:40 0 d-------- C:\Documents and Settings\jeremy\.housecall6.6

2007-08-26 16:45:57 69689 --a------ C:\WINDOWS\UNZIP.DLL <Not Verified; Trend Micro Inc.; Trend Active Update 1.32>

2007-08-26 16:45:57 507904 --a------ C:\WINDOWS\TMUPDATE.DLL <Not Verified; Trend Micro Inc.; ActiveUpdate Module>

2007-08-26 16:45:56 286720 --a------ C:\WINDOWS\PATCH.EXE <Not Verified; Trend Micro Inc.; ActiveUpdate Module>

2007-08-26 10:30:37 0 d-------- C:\VundoFix Backups

2007-08-25 18:48:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2007-08-25 18:39:40 0 d-------- C:\Program Files\Lavasoft

2007-08-24 20:49:54 574508 --a------ C:\WINDOWS\system32\yeppeljd.exe

2007-08-24 14:38:23 0 d-------- C:\Documents and Settings\jeremy\Application Data\Creative

2007-08-24 12:48:59 0 d-------- C:\WINDOWS\system32\NtmsData

2007-08-24 12:27:41 25088 -----n--- C:\WINDOWS\system32\CTSVCCTL.EXE <Not Verified; Creative Technology Ltd; Creative Service Control>

2007-08-24 12:27:41 44032 -----n--- C:\WINDOWS\system32\CTSVCCDA.EXE <Not Verified; Creative Technology Ltd; Creative Service for CDROM Access>

2007-08-24 12:23:12 38402 -----n--- C:\WINDOWS\system32\drivers\StMp3Rec.sys <Not Verified; Generic; Generic MP3 Player>

2007-08-24 12:20:09 0 d-------- C:\Program Files\Creative

2007-08-23 21:25:04 43542 --a------ C:\WINDOWS\system32\nnnkhfe.dll

2007-08-22 17:12:27 0 dr-h----- C:\Documents and Settings\jeremy\Application Data\SecuROM

2007-08-22 17:12:26 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >

2007-08-22 17:08:37 0 d-------- C:\Program Files\Ubisoft

2007-08-22 17:00:50 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2007-08-16 16:32:42 0 d-------- C:\Program Files\MSXML 6.0

2007-08-12 20:30:58 102400 --a------ C:\WINDOWS\system32\CmutEuro32.dll <Not Verified; Euro Information; Librairie Europe commune Crédit Mutuel et CIC>

2007-08-12 20:30:58 176128 --a------ C:\WINDOWS\calceuro.exe <Not Verified; Euro-Information; CALCEURO>

2007-08-12 20:30:56 0 d-------- C:\Program Files\CyberMUT

2007-08-12 20:28:04 0 d-------- C:\Documents and Settings\jeremy\Application Data\Grisbi

2007-08-05 14:44:46 0 d-------- C:\Documents and Settings\jeremy\Application Data\uTorrent

2007-08-02 19:41:09 37027 --a------ C:\WINDOWS\atmoUn.exe

2007-08-02 19:41:07 0 d-------- C:\Program Files\Viewpoint

2007-08-02 19:41:07 0 d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint

2007-08-01 19:08:55 0 d-------- C:\Documents and Settings\jeremy\Application Data\MySpace

2007-08-01 19:08:52 0 d-------- C:\Program Files\MySpace

 

 

-- Find3M Report ---------------------------------------------------------------

 

2007-08-30 14:50:43 0 d-------- C:\Program Files\Wanadoo

2007-08-27 22:20:04 0 d-------- C:\Program Files\Google

2007-08-26 20:24:09 0 d-------- C:\Program Files\Fichiers communs

2007-08-26 19:24:27 506796 --a------ C:\WINDOWS\system32\perfh00C.dat

2007-08-26 19:24:27 84354 --a------ C:\WINDOWS\system32\perfc00C.dat

2007-08-26 12:40:23 0 d-------- C:\Documents and Settings\jeremy\Application Data\dvdcss

2007-08-24 12:30:25 0 d--h----- C:\Program Files\InstallShield Installation Information

2007-08-16 23:31:34 0 d-------- C:\Documents and Settings\jeremy\Application Data\AdobeUM

2007-07-28 10:06:40 0 d-------- C:\Documents and Settings\jeremy\Application Data\Serif

2007-07-26 20:14:23 30720 --a------ C:\WINDOWS\6816White12.dat

2007-07-26 20:14:23 4 --a------ C:\WINDOWS\6816Error.dat

2007-07-26 20:14:19 30720 --a------ C:\WINDOWS\6816Dark12.dat

2007-07-26 20:14:15 3 --a------ C:\WINDOWS\6816Offset.dat

2007-07-26 20:14:15 3 --a------ C:\WINDOWS\6816Gain.dat

2007-07-26 20:14:15 6 --a------ C:\WINDOWS\6816Exposure.dat

2007-07-22 16:32:49 0 d-------- C:\Program Files\TagRename

2007-07-22 16:17:38 0 d-------- C:\Program Files\Free Audio Pack

2007-07-15 22:09:23 0 d-------- C:\Documents and Settings\jeremy\Application Data\EoRezo

2007-07-15 22:05:53 0 d-------- C:\Documents and Settings\jeremy\Application Data\ItsLabel

2007-07-13 23:03:49 0 d-------- C:\Program Files\Windows Media Connect 2

2007-07-13 21:28:19 0 d-------- C:\Program Files\Messenger Plus! Live

2007-07-13 21:28:18 0 d-------- C:\Program Files\Windows Live

2007-07-13 21:28:18 0 d-------- C:\Program Files\MSN Messenger

2007-07-02 07:56:03 0 d-------- C:\Program Files\Winamp

2007-06-26 18:57:17 279552 --a------ C:\WINDOWS\system32\hhfkhorzcu.exe

2007-06-26 00:40:47 274432 --a------ C:\WINDOWS\system32\urdluiy.exe

2007-06-23 16:28:48 273408 --a------ C:\WINDOWS\system32\oyftqpesh.exe

2007-06-22 16:41:45 278528 --a------ C:\WINDOWS\system32\hwmmwtygaw.exe

2007-06-22 07:42:45 275456 --a------ C:\WINDOWS\system32\qosairqmy.exe

2007-06-22 00:14:20 276992 --a------ C:\WINDOWS\system32\xczzotqs.exe

2007-06-21 17:22:32 457728 --a------ C:\WINDOWS\system32\ihmuhob.exe

2007-06-21 07:38:43 459264 --a------ C:\WINDOWS\system32\xdjwxx.exe

2007-06-20 19:11:22 452608 --a------ C:\WINDOWS\system32\awilors.exe

2007-06-20 18:01:32 451584 --a------ C:\WINDOWS\system32\pdwmuqvlce.exe

2007-06-19 22:25:31 451584 --a------ C:\WINDOWS\system32\wtoartir.exe

2007-06-18 19:06:01 454656 --a------ C:\WINDOWS\system32\evyozivw.exe

2007-06-17 22:20:31 79 --a------ C:\WINDOWS\system32\netwbix32.dll

2007-06-15 23:50:21 1277 --a------ C:\WINDOWS\mozver.dat

 

 

-- Registry Dump ---------------------------------------------------------------

 

*Note* empty entries & legit default entries are not shown

 

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60D13203-2DC3-4E31-8909-E70BEC38D9F8}]

23/08/2007 21:25 43542 --a------ C:\WINDOWS\system32\nnnkhfe.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{68FEF0F3-B2A7-4C52-9B00-8C495CD03F28}]

C:\WINDOWS\system32\pmnlm.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{838F02C0-6F57-4332-8298-1D5A7A19F1F9}]

C:\WINDOWS\system32\jkkll.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8992AFAC-465A-40E6-8611-585EEB8DEE01}]

C:\WINDOWS\system32\vturr.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CACF3C3A-708F-4CD0-AE52-AE78A2CD536E}]

C:\WINDOWS\system32\awvtt.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D3388959-E43E-403A-A8F3-335F27D9B6ED}]

C:\WINDOWS\system32\mlljk.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DA38295B-6DF8-40C1-A086-39CB7DC7A5CD}]

C:\WINDOWS\system32\jkhfc.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [19/04/2007 13:26]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [28/07/2007 00:03]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [19/08/2004 17:09]

"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [12/02/2007 19:30]

"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [07/07/2006 18:45]

"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [23/08/2004 14:50]

"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [02/12/2004 18:23]

"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [17/08/2007 22:48]

 

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [24/10/2003 06:37:56]

Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [12/02/2007 19:30:42]

Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [26/06/2007 22:36:46]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{60D13203-2DC3-4E31-8909-E70BEC38D9F8}"= C:\WINDOWS\system32\nnnkhfe.dll [23/08/2007 21:25 43542]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnkhfe]

nnnkhfe.dll 23/08/2007 21:25 43542 C:\WINDOWS\system32\nnnkhfe.dll

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

@="Volume shadow copy"

 

 

 

 

-- End of Deckard's System Scanner: finished at 2007-08-30 15:08:28 ------------

 

 

voila

bruce lee Devil Member !

bruce lee

Posté(e)
Posté(e)

re,

 

Si durant la procédure ci-dessous, il y a des étapes que tu n'as pas reussi a faire, merci de continuer la procédure jusqu'au bout et de les signaler dans ta prochaine reponse.

 

Je te conseille d'enregistrer la page web compléte sous Internet Explorer comme ceci :

 

* Clique sur Fichier/Enregistrer sous Dans Type, choisis : Archive web (fichier seul (*.mht) / Enregistre la sur le bureau,comme cela tu retrouvera la mise en forme ou imprime cette réponse. Une partie de la désinfection se déroulera en mode sans échec.

 

 

1/ Ouvre le Bloc-notes (Démarrer\Tous les programmes\Accessoires\Bloc-notes)

 

2/ Copie ce qui est en citation ci-dessous (sans le mot citation) par sélection puis Ctrl-C :

 

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{60D13203-2DC3-4E31-8909-E70BEC38D9F8}"=-

 

-Enregistrez ce fichier reg dans : Bureau

-Nom du fichier : Fixme.reg

-Type du fichier : tous les fichiers

-Cliquez sur Enregistrer

-Quittez le Bloc Notes

 

 

3/Télécharge puis installe http://www.ewido.net/en/download

Une fois AVG AS lancé, clique sur Mise à jour

Ferme le programme.

 

 

4/ Télécharge OTMoveIt de OldTimer.

Sauvegarde le sur ton Bureau.

 

 

5/Démarre en mode sans échec http://cybersecurite.xooit.com/t88-Demarre...s-echec.htm#665

 

6/Lance hijackthis en cliquant sur do a scan system only et coche ces lignes:

 

O2 - BHO: (no name) - {60D13203-2DC3-4E31-8909-E70BEC38D9F8} - C:\WINDOWS\system32\nnnkhfe.dll

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: (no name) - {68FEF0F3-B2A7-4C52-9B00-8C495CD03F28} - C:\WINDOWS\system32\pmnlm.dll (file missing)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {838F02C0-6F57-4332-8298-1D5A7A19F1F9} - C:\WINDOWS\system32\jkkll.dll (file missing)

O2 - BHO: (no name) - {8992AFAC-465A-40E6-8611-585EEB8DEE01} - C:\WINDOWS\system32\vturr.dll (file missing)

O2 - BHO: (no name) - {CACF3C3A-708F-4CD0-AE52-AE78A2CD536E} - C:\WINDOWS\system32\awvtt.dll (file missing)

O2 - BHO: (no name) - {D3388959-E43E-403A-A8F3-335F27D9B6ED} - C:\WINDOWS\system32\mlljk.dll (file missing)

O2 - BHO: (no name) - {DA38295B-6DF8-40C1-A086-39CB7DC7A5CD} - C:\WINDOWS\system32\jkhfc.dll (file missing)

Toutes les lignes O18 sauf les 5 dernieres

O20 - Winlogon Notify: nnnkhfe - C:\WINDOWS\SYSTEM32\nnnkhfe.dll

 

Ferme toutes les fenêtres ouvertes sauf Hijackthis et clique sur fix checked

 

 

7/Utilisation du fichier: fixme.reg précedemment créé

- double cliquez sur le fichier (Bureau) / Acceptez l'avertissement concernant la fusion / ne pas s'étonner de ne rien voir / validez le message disant que la fusion est terminée.

 

 

8/ Relance AVG AS puis choisis l'onglet Analyse

Puis l'onglet Paramètres

Sous la question Comment réagir ?, clique sur Actions recommandées et choisis Quarantaine

Reclique sur l'onglet Analyse puis réalise une Analyse complète du système

 

Si un fichier infecté est détecté en fin d'analyse

Clique sur Appliquer toutes les actions

 

Clique sur Enregistrer le rapport puis sur Enregistrer le rapport sous

Enregistre ce fichier texte sur ton bureau

 

 

9/[*]Double-Clique sur OTMoveIt.exe pour le lancer.

[*]Copie le chemin des fichiers suivants en selectionnant TOUT et en appuyant sur CTRL+C (ou, après avoir sélectionner, clique-droit et choisis Copier) :

 

C:\WINDOWS\system32\nnnkhfe.dll

C:\WINDOWS\system32\kjllm.bak2

C:\WINDOWS\system32\yeppeljd.exe

C:\WINDOWS\system32\hhfkhorzcu.exe

C:\WINDOWS\system32\urdluiy.exe

C:\WINDOWS\system32\oyftqpesh.exe

C:\WINDOWS\system32\hwmmwtygaw.exe

C:\WINDOWS\system32\qosairqmy.exe

C:\WINDOWS\system32\xczzotqs.exe

C:\WINDOWS\system32\ihmuhob.exe

C:\WINDOWS\system32\xdjwxx.exe

C:\WINDOWS\system32\awilors.exe

C:\WINDOWS\system32\pdwmuqvlce.exe

C:\WINDOWS\system32\wtoartir.exe

C:\WINDOWS\system32\evyozivw.exe

  • Retourne dans OTMoveit, fais un clique-droit dans la fenêtre "Paste List of Files/Folders to be moved" et choisis Coller.
  • Clique sur le bouton rouge Moveit!.
  • Ferme OTMoveIt.
    Note : Si un fichier ou un dossier ne peut être déplacer immédiatement il te sera demander de redémarrer ta machine pour finir le processus. Si c'est le cas, choisis Yes.

Poste moi le rapport de OTMoveIT disponible ici : C:\_OTMoveIt\MovedFiles.

 

 

10/Poste le rapport d'AVG Anti spyware 7.5 ainsi qu'un nouveau log Hijackthis.

 

Bon courage, et si tu as la moindre question n'hésite surtout pas :P

 

@+

microgolgi Member

microgolgi

Posté(e)
  • Auteur
Posté(e)

Rapport de OTMoveIT

 

DllUnregisterServer procedure not found in C:\WINDOWS\system32\nnnkhfe.dll

C:\WINDOWS\system32\nnnkhfe.dll NOT unregistered.

File move failed. C:\WINDOWS\system32\nnnkhfe.dll scheduled to be moved on reboot.

C:\WINDOWS\system32\kjllm.bak2 moved successfully.

File/Folder C:\WINDOWS\system32\yeppeljf.exe not found.

C:\WINDOWS\system32\hhfkhorzcu.exe moved successfully.

C:\WINDOWS\system32\urdluiy.exe moved successfully.

C:\WINDOWS\system32\oyftqpesh.exe moved successfully.

C:\WINDOWS\system32\hwmmwtygaw.exe moved successfully.

C:\WINDOWS\system32\qosairqmy.exe moved successfully.

C:\WINDOWS\system32\xczzotqs.exe moved successfully.

C:\WINDOWS\system32\ihmuhob.exe moved successfully.

C:\WINDOWS\system32\xdjwxx.exe moved successfully.

C:\WINDOWS\system32\awilors.exe moved successfully.

C:\WINDOWS\system32\pdwmuqvlce.exe moved successfully.

C:\WINDOWS\system32\wtoartir.exe moved successfully.

C:\WINDOWS\system32\evyozivw.exe moved successfully.

 

Created on 08/30/2007 17:38:41

 

---------------------------------------------------------

AVG Anti-Spyware - Rapport d'analyse

---------------------------------------------------------

 

+ Créé à: 17:32:41 30/08/2007

 

+ Résultat de l'analyse:

 

 

 

C:\System Volume Information\_restore{53BE7D99-FA0C-4D2E-A3F8-8B3038249D30}\RP149\A0045337.exe -> Downloader.Tiny.id : Nettoyé et sauvegardé (mise en quarantaine).

C:\System Volume Information\_restore{53BE7D99-FA0C-4D2E-A3F8-8B3038249D30}\RP149\A0045342.exe -> Downloader.Tiny.id : Nettoyé et sauvegardé (mise en quarantaine).

C:\Deckard\System Scanner\backup\WINDOWS\Downloaded Program Files\USDR6V_0001_N19M2604NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.q : Nettoyé et sauvegardé (mise en quarantaine).

:mozilla.71:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.

:mozilla.72:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.

:mozilla.73:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.

:mozilla.229:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.230:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.231:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.232:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.233:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.234:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.235:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.236:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.237:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.238:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.239:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.240:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.241:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.242:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.243:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.244:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.245:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.537:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.538:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.558:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.

C:\Documents and Settings\jeremy\Cookies\jeremy@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.

:mozilla.252:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.

:mozilla.253:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.

:mozilla.93:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Addynamix : Nettoyé.

:mozilla.94:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Addynamix : Nettoyé.

:mozilla.95:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Addynamix : Nettoyé.

:mozilla.96:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Addynamix : Nettoyé.

:mozilla.208:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.

:mozilla.209:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.

:mozilla.152:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.

:mozilla.153:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.

:mozilla.154:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.

:mozilla.155:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.

:mozilla.216:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.

C:\Documents and Settings\jeremy\Cookies\jeremy@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.

:mozilla.13:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.

C:\Documents and Settings\jeremy\Cookies\jeremy@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.

:mozilla.786:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Clickhype : Nettoyé.

:mozilla.337:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Com : Nettoyé.

:mozilla.830:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.

:mozilla.831:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.

:mozilla.832:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.

:mozilla.338:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Cpvfeed : Nettoyé.

:mozilla.339:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Cpvfeed : Nettoyé.

:mozilla.340:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Cpvfeed : Nettoyé.

:mozilla.341:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Cpvfeed : Nettoyé.

C:\Documents and Settings\jeremy\Cookies\jeremy@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyé.

:mozilla.167:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.

:mozilla.45:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.

:mozilla.935:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Etracker : Nettoyé.

:mozilla.255:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.

:mozilla.75:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.

:mozilla.76:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.

:mozilla.77:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.

:mozilla.78:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.

:mozilla.79:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.

:mozilla.940:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.

:mozilla.941:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.

:mozilla.942:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.

:mozilla.943:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.

:mozilla.944:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.

:mozilla.452:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Hotlog : Nettoyé.

C:\Documents and Settings\jeremy\Cookies\jeremy@hotlog[2].txt -> TrackingCookie.Hotlog : Nettoyé.

:mozilla.460:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.

:mozilla.461:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.

C:\Documents and Settings\jeremy\Cookies\jeremy@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.

:mozilla.7:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Netflame : Nettoyé.

:mozilla.168:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.

:mozilla.974:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Paypal : Nettoyé.

:mozilla.605:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.

:mozilla.606:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.

:mozilla.607:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.

:mozilla.616:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.

:mozilla.617:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.

:mozilla.618:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.

:mozilla.619:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.

:mozilla.620:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.

:mozilla.306:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.634:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.635:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.636:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.637:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.638:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.

C:\Documents and Settings\jeremy\Cookies\jeremy@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.

:mozilla.106:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.108:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.110:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.111:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.112:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.113:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.114:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.655:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.

:mozilla.656:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.

:mozilla.657:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.

:mozilla.658:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.

:mozilla.670:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.

:mozilla.671:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.

:mozilla.672:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.

:mozilla.176:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.

:mozilla.609:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Valuead : Nettoyé.

:mozilla.610:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Valuead : Nettoyé.

:mozilla.611:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Valuead : Nettoyé.

:mozilla.612:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Valuead : Nettoyé.

:mozilla.613:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Valuead : Nettoyé.

:mozilla.730:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.

:mozilla.731:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.

:mozilla.732:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.

:mozilla.856:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Webtrends : Nettoyé.

:mozilla.759:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Yadro : Nettoyé.

:mozilla.760:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Yadro : Nettoyé.

:mozilla.778:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.

:mozilla.779:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.

:mozilla.780:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.

:mozilla.781:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.

:mozilla.782:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.

:mozilla.783:C:\Documents and Settings\jeremy\Application Data\Mozilla\Firefox\Profiles\pht2srqd.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.

C:\Documents and Settings\jeremy\Cookies\jeremy@zedo[2].txt -> TrackingCookie.Zedo : Nettoyé.

 

 

Fin du rapport

 

 

 

Logfile of HijackThis v1.99.1

Scan saved at 17:43:32, on 30/08/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\PROGRA~1\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

C:\PROGRA~1\Wanadoo\Watch.exe

C:\Program Files\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.chemtable.com/order3.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {60D13203-2DC3-4E31-8909-E70BEC38D9F8} - C:\WINDOWS\system32\nnnkhfe.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx

O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: offline-8876480 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: nnnkhfe - C:\WINDOWS\SYSTEM32\nnnkhfe.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

Et voila! eh ebn c long l'analyse avec AVG AS.

microgolgi Member

microgolgi

Posté(e)
  • Auteur
Posté(e) (modifié)

Deckard's System Scanner v20070826.66

Run by jeremy on 2007-08-30 18:19:25

Computer is in Normal Mode.

--------------------------------------------------------------------------------

 

 

 

-- HijackThis (run as jeremy.exe) ----------------------------------------------

 

Logfile of HijackThis v1.99.1

Scan saved at 18:19:31, on 30/08/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\PROGRA~1\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\PROGRA~1\Wanadoo\Watch.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Documents and Settings\jeremy\Bureau\dss.exe

C:\PROGRA~1\HIJACK~1\jeremy.exe

C:\WINDOWS\system32\NOTEPAD.EXE

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.chemtable.com/order3.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {60D13203-2DC3-4E31-8909-E70BEC38D9F8} - C:\WINDOWS\system32\nnnkhfe.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: (no name) - {D4BB6CA1-DF75-4EC1-809B-98CE51B05E1F} - C:\WINDOWS\system32\vturp.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx

O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: offline-8876480 - {4B4DBA08-3C50-4119-8F13-A446EE1F511C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: nnnkhfe - C:\WINDOWS\SYSTEM32\nnnkhfe.dll

O20 - Winlogon Notify: vturp - C:\WINDOWS\system32\vturp.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

 

-- Files created between 2007-07-30 and 2007-08-30 -----------------------------

 

2007-08-30 17:45:49 6488 ---hs---- C:\WINDOWS\system32\prutv.bak1

2007-08-30 17:45:41 298080 --a------ C:\WINDOWS\system32\vturp.dll

2007-08-30 15:31:31 0 d-------- C:\Documents and Settings\jeremy\Application Data\Grisoft

2007-08-30 15:31:12 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft

2007-08-30 13:51:33 0 d-------- C:\!KillBox

2007-08-30 13:34:09 0 d-------- C:\Program Files\Navilog1

2007-08-27 22:19:53 0 d-------- C:\Program Files\Picasa2

2007-08-26 20:24:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2007-08-26 20:24:09 0 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard

2007-08-26 16:47:40 0 d-------- C:\Documents and Settings\jeremy\.housecall6.6

2007-08-26 16:45:57 69689 --a------ C:\WINDOWS\UNZIP.DLL <Not Verified; Trend Micro Inc.; Trend Active Update 1.32>

2007-08-26 16:45:57 507904 --a------ C:\WINDOWS\TMUPDATE.DLL <Not Verified; Trend Micro Inc.; ActiveUpdate Module>

2007-08-26 16:45:56 286720 --a------ C:\WINDOWS\PATCH.EXE <Not Verified; Trend Micro Inc.; ActiveUpdate Module>

2007-08-26 10:30:37 0 d-------- C:\VundoFix Backups

2007-08-25 18:48:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2007-08-25 18:39:40 0 d-------- C:\Program Files\Lavasoft

2007-08-24 20:49:54 574508 --a------ C:\WINDOWS\system32\yeppeljd.exe

2007-08-24 14:38:23 0 d-------- C:\Documents and Settings\jeremy\Application Data\Creative

2007-08-24 12:48:59 0 d-------- C:\WINDOWS\system32\NtmsData

2007-08-24 12:27:41 25088 -----n--- C:\WINDOWS\system32\CTSVCCTL.EXE <Not Verified; Creative Technology Ltd; Creative Service Control>

2007-08-24 12:27:41 44032 -----n--- C:\WINDOWS\system32\CTSVCCDA.EXE <Not Verified; Creative Technology Ltd; Creative Service for CDROM Access>

2007-08-24 12:23:12 38402 -----n--- C:\WINDOWS\system32\drivers\StMp3Rec.sys <Not Verified; Generic; Generic MP3 Player>

2007-08-24 12:20:09 0 d-------- C:\Program Files\Creative

2007-08-23 21:25:04 43542 --a------ C:\WINDOWS\system32\nnnkhfe.dll

2007-08-22 17:12:27 0 dr-h----- C:\Documents and Settings\jeremy\Application Data\SecuROM

2007-08-22 17:12:26 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >

2007-08-22 17:08:37 0 d-------- C:\Program Files\Ubisoft

2007-08-22 17:00:50 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2007-08-16 16:32:42 0 d-------- C:\Program Files\MSXML 6.0

2007-08-12 20:30:58 102400 --a------ C:\WINDOWS\system32\CmutEuro32.dll <Not Verified; Euro Information; Librairie Europe commune Crédit Mutuel et CIC>

2007-08-12 20:30:58 176128 --a------ C:\WINDOWS\calceuro.exe <Not Verified; Euro-Information; CALCEURO>

2007-08-12 20:30:56 0 d-------- C:\Program Files\CyberMUT

2007-08-12 20:28:04 0 d-------- C:\Documents and Settings\jeremy\Application Data\Grisbi

2007-08-05 14:44:46 0 d-------- C:\Documents and Settings\jeremy\Application Data\uTorrent

2007-08-02 19:41:09 37027 --a------ C:\WINDOWS\atmoUn.exe

2007-08-02 19:41:07 0 d-------- C:\Program Files\Viewpoint

2007-08-02 19:41:07 0 d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint

2007-08-01 19:08:55 0 d-------- C:\Documents and Settings\jeremy\Application Data\MySpace

2007-08-01 19:08:52 0 d-------- C:\Program Files\MySpace

 

 

-- Find3M Report ---------------------------------------------------------------

 

2007-08-30 17:42:16 0 d-------- C:\Program Files\Wanadoo

2007-08-27 22:20:04 0 d-------- C:\Program Files\Google

2007-08-26 20:24:09 0 d-------- C:\Program Files\Fichiers communs

2007-08-26 19:24:27 506796 --a------ C:\WINDOWS\system32\perfh00C.dat

2007-08-26 19:24:27 84354 --a------ C:\WINDOWS\system32\perfc00C.dat

2007-08-26 12:40:23 0 d-------- C:\Documents and Settings\jeremy\Application Data\dvdcss

2007-08-24 12:30:25 0 d--h----- C:\Program Files\InstallShield Installation Information

2007-08-16 23:31:34 0 d-------- C:\Documents and Settings\jeremy\Application Data\AdobeUM

2007-07-28 10:06:40 0 d-------- C:\Documents and Settings\jeremy\Application Data\Serif

2007-07-26 20:14:23 30720 --a------ C:\WINDOWS\6816White12.dat

2007-07-26 20:14:23 4 --a------ C:\WINDOWS\6816Error.dat

2007-07-26 20:14:19 30720 --a------ C:\WINDOWS\6816Dark12.dat

2007-07-26 20:14:15 3 --a------ C:\WINDOWS\6816Offset.dat

2007-07-26 20:14:15 3 --a------ C:\WINDOWS\6816Gain.dat

2007-07-26 20:14:15 6 --a------ C:\WINDOWS\6816Exposure.dat

2007-07-22 16:32:49 0 d-------- C:\Program Files\TagRename

2007-07-22 16:17:38 0 d-------- C:\Program Files\Free Audio Pack

2007-07-15 22:09:23 0 d-------- C:\Documents and Settings\jeremy\Application Data\EoRezo

2007-07-15 22:05:53 0 d-------- C:\Documents and Settings\jeremy\Application Data\ItsLabel

2007-07-13 23:03:49 0 d-------- C:\Program Files\Windows Media Connect 2

2007-07-13 21:28:19 0 d-------- C:\Program Files\Messenger Plus! Live

2007-07-13 21:28:18 0 d-------- C:\Program Files\Windows Live

2007-07-13 21:28:18 0 d-------- C:\Program Files\MSN Messenger

2007-07-02 07:56:03 0 d-------- C:\Program Files\Winamp

2007-06-17 22:20:31 79 --a------ C:\WINDOWS\system32\netwbix32.dll

2007-06-15 23:50:21 1277 --a------ C:\WINDOWS\mozver.dat

 

 

-- Registry Dump ---------------------------------------------------------------

 

*Note* empty entries & legit default entries are not shown

 

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60D13203-2DC3-4E31-8909-E70BEC38D9F8}]

23/08/2007 21:25 43542 --a------ C:\WINDOWS\system32\nnnkhfe.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4BB6CA1-DF75-4EC1-809B-98CE51B05E1F}]

30/08/2007 17:45 298080 --a------ C:\WINDOWS\system32\vturp.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [19/04/2007 13:26]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [28/07/2007 00:03]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11/06/2007 11:25]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [19/08/2004 17:09]

"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [12/02/2007 19:30]

"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [07/07/2006 18:45]

"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [23/08/2004 14:50]

"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [02/12/2004 18:23]

"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [17/08/2007 22:48]

 

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [24/10/2003 06:37:56]

Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [12/02/2007 19:30:42]

Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [26/06/2007 22:36:46]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"=0 (0x0)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{60D13203-2DC3-4E31-8909-E70BEC38D9F8}"= C:\WINDOWS\system32\nnnkhfe.dll [23/08/2007 21:25 43542]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnkhfe]

nnnkhfe.dll 23/08/2007 21:25 43542 C:\WINDOWS\system32\nnnkhfe.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vturp]

C:\WINDOWS\system32\vturp.dll 30/08/2007 17:45 298080 C:\WINDOWS\system32\vturp.dll

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

@="Volume shadow copy"

 

 

 

 

-- End of Deckard's System Scanner: finished at 2007-08-30 18:21:34 ------------

Modifié par microgolgi
bruce lee Devil Member !

bruce lee

Posté(e)
Posté(e) (modifié)

Re,

 

Ton infection est assez conriance donc ta désinfection risque d'être un peu longue :P

 

Télécharge kerio http://www.inoculer.com/firewall5.php3

-tuto pour kerio http://www.vulgarisation-informatique.com/kerio.php

 

Installe le puis mets le à jour si necessaire.

 

Refais un scan avec VundoFix puis poste le rapport s'il te plait.

Modifié par bruce lee
microgolgi Member

microgolgi

Posté(e)
  • Auteur
Posté(e)
Re,

 

Ton infection est assez conriance donc ta désinfection risque d'être un peu longue :P

 

Télécharge kerio http://www.inoculer.com/firewall5.php3

-tuto pour kerio http://www.vulgarisation-informatique.com/kerio.php

 

Installe le puis mets le à jour si necessaire.

 

Refais un scan avec VundoFix puis poste le rapport s'il te plait.

Eh ben mais elle vient d'ou cette infection? et c quoi exactement comme infection?

bon allez jv suivre ton procedure

bruce lee Devil Member !

bruce lee

Posté(e)
Posté(e) (modifié)

Re,

 

Eh ben mais elle vient d'ou cette infection? et c quoi exactement comme infection?

 

Tu as surement du télécharger quelque chose qui ne fallait pas :P . Cette infection provoque des fenêtres de pubs.

Modifié par bruce lee

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...