Rapport HijackThis

[Kairaut]

D'accord, merci.

 

 

ComboFix 08-01-23.1C - Sharioh 2008-01-26 13:30:44.5 - FAT32x86

Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.341 [GMT 1:00]

Endroit: C:\Documents and Settings\Sharioh\Bureau\ComboFix.exe

Command switches used :: C:\Documents and Settings\Sharioh\Bureau\CFScript.txt

* Création d'un nouveau point de restauration

 

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

 

FILE

c:\id44l.exe

C:\WINDOWS\\system32\whml.exe

C:\WINDOWS\system32\dllcache\spoolms.exe

C:\WINDOWS\system32\wnss.exe

C:\WINDOWS\TEMP\A33.tmp

.

 

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-26 to 2008-01-26 ))))))))))))))))))))))))))))))))))))

.

 

2008-01-25 11:30 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe

2008-01-24 20:51 . 2008-01-24 20:51 <REP> d-------- C:\Program Files\Windows Live

2008-01-24 20:51 . 2008-01-24 20:51 <REP> d-------- C:\Program Files\Messenger Plus! Live

2008-01-23 17:51 . 2008-01-23 17:52 4,065,896 --a------ C:\upload_moi_BF.tar.gz

2008-01-23 00:53 . 2008-01-23 00:53 <REP> d-------- C:\WINDOWS\ERUNT

2008-01-22 22:27 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2008-01-22 02:40 . 2008-01-22 02:40 <REP> d-------- C:\Program Files\Avira

2008-01-20 19:38 . 2008-01-20 19:38 5,632 --ahs---- C:\WINDOWS\system32\Thumbs.db

2008-01-20 19:37 . 2008-01-20 19:38 44,032 --ahs---- C:\WINDOWS\Thumbs.db

2008-01-19 18:57 . 2008-01-19 18:57 <REP> d-------- C:\Program Files\Cinema Bizarre Player

2008-01-11 11:08 . 2008-01-11 11:08 1,158 --a------ C:\WINDOWS\mozver.dat

2008-01-10 23:12 . 2008-01-10 23:12 <REP> d-------- C:\Program Files\Veoh Networks

2008-01-10 23:01 . 2008-01-10 23:01 <REP> d-------- C:\WINDOWS\Downloaded Installations

2008-01-10 22:35 . 2008-01-10 22:35 <REP> d-------- C:\Program Files\DivX

2008-01-10 02:15 . 2008-01-10 02:15 <REP> d-------- C:\Program Files\Internet Download Manager

2008-01-08 22:43 . 2008-01-08 22:43 <REP> d-------- C:\Program Files\Azureus

2008-01-08 22:37 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl

2008-01-08 22:36 . 2008-01-08 22:36 <REP> d-------- C:\Program Files\Java

2008-01-08 22:36 . 2008-01-08 22:36 <REP> d-------- C:\Program Files\Fichiers communs\Java

2008-01-08 21:59 . 2008-01-08 21:59 118 --a------ C:\WINDOWS\system32\MRT.INI

2008-01-08 12:36 . 2008-01-08 13:13 202,160 --a------ C:\WINDOWS\system32\idmmbc.dll

2008-01-08 02:16 . 2008-01-08 02:16 630,784 --a------ C:\WINDOWS\system32\divxdec.ax

2008-01-07 00:23 . 2008-01-07 00:23 <REP> d-------- C:\Program Files\VideoLAN

2008-01-06 17:40 . 2008-01-06 17:40 <REP> d-------- C:\Program Files\CCleaner

2008-01-06 13:35 . 2008-01-06 13:35 <REP> d-------- C:\Program Files\Lavasoft

2008-01-06 13:34 . 2008-01-06 13:34 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard

2008-01-04 22:59 . 2008-01-04 22:59 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe

2008-01-04 22:59 . 2008-01-04 22:59 9,878 --a------ C:\WINDOWS\system32\dsm_fr.qm

2008-01-04 22:59 . 2008-01-04 22:59 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb

2008-01-04 22:58 . 2008-01-04 22:58 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll

2008-01-04 22:58 . 2008-01-04 22:58 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll

2008-01-04 22:58 . 2008-01-04 22:58 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll

2008-01-04 22:56 . 2008-01-04 22:56 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe

2008-01-04 22:56 . 2008-01-04 22:56 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll

2008-01-04 22:56 . 2008-01-04 22:56 8,835 --a------ C:\WINDOWS\system32\dpufr.qm

2008-01-04 22:56 . 2008-01-04 22:56 3,162 --a------ C:\WINDOWS\system32\dtu_fr.qm

2007-12-31 16:09 . 2007-12-31 16:09 <REP> d--hs---- C:\FOUND.011

2007-12-29 20:24 . 2007-12-29 20:24 <REP> d--hs---- C:\FOUND.010

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-01-04 21:58 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys

2008-01-04 21:58 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys

2008-01-04 21:58 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys

2008-01-04 21:58 129,784 ------w C:\WINDOWS\system32\pxafs.dll

2008-01-04 21:58 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe

2008-01-04 21:58 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe

2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll

2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll

2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll

2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll

2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll

2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll

2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll

2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll

2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll

2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll

2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll

2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll

2007-12-16 18:46 --------- d-----w C:\Program Files\SAGEM

2007-12-14 01:42 --------- d-----w C:\Program Files\Windows Live Favorites

2007-12-14 00:01 --------- d-----w C:\Program Files\Orange HSS

2007-12-14 00:01 --------- d-----w C:\Program Files\Fichiers communs\France Telecom

2007-12-11 00:20 --------- d-----w C:\Program Files\Controle Parental

2007-12-10 16:29 --------- d-----w C:\Program Files\ABBYY FineReader 6.0 Sprint

2007-12-10 16:25 --------- d-----w C:\Program Files\epson

2007-11-27 00:55 --------- d-----w C:\Program Files\Thomson

2007-11-27 00:54 --------- d-----w C:\Program Files\Wanadoo Messager

2007-11-27 00:53 --------- d-----w C:\Program Files\Wanadoo

2007-11-07 09:28 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll

2007-11-07 09:28 728,576 ----a-w C:\WINDOWS\system32\dllcache\lsasrv.dll

2007-10-30 23:23 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll

2007-10-30 17:20 360,064 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys

2007-10-29 22:36 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll

2007-10-29 22:36 1,293,824 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll

.

 

((((((((((((((((((((((((((((( snapshot@2008-01-25_11.34.00.57 )))))))))))))))))))))))))))))))))))))))))

.

+ 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE

+ 2008-01-26 12:30:20 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users�000001\NTUSER.DAT

+ 2008-01-26 12:30:20 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users�000002\UsrClass.dat

+ 2008-01-26 12:30:20 241,664 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users�000003\NTUSER.DAT

+ 2008-01-26 12:30:20 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users�000004\UsrClass.dat

+ 2008-01-26 12:30:20 5,607,424 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users�000005\ntuser.dat

+ 2008-01-26 12:30:20 147,456 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users�000006\UsrClass.dat

+ 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]

"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [2008-01-08 12:44 2577840]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 20:00 15360]

"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [ ]

"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:34 64512]

"LaunchApp"="" []

"ntiMUI"="C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 17:15 45056]

"Acer ePresentation HPD"="C:\Acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-03-31 16:39 204800]

"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-10 20:00 208952]

"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 20:00 59392]

"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-10 20:00 455168]

"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-10 20:00 455168]

"SkyTel"="SkyTel.EXE" [2006-05-16 03:04 2879488 C:\WINDOWS\SkyTel.exe]

"ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 12:11 421888]

"Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 22:12 579584]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07 761946]

"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-06-23 06:59 602112]

"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12 90112]

"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40 413696]

"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]

"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]

"OPTENET_GUI"="C:\PROGRA~1\CONTRO~1\bin\optgui.exe" [2006-12-20 10:14 404536]

"ORAHSSSessionManager"="C:\Program Files\Orange HSS\SessionManager\SessionManager.exe" [2007-07-24 19:03 102400]

"SystrayORAHSS"="C:\Program Files\Orange HSS\Systray\SystrayApp.exe" [2007-07-24 19:55 94208]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-22 02:44 249896]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 20:00 15360]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles

"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"= 0 (0x0)

 

R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys [2004-12-17 16:14]

R2 DritekPortIO;Dritek General Port I/O;C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2005-12-23 01:13]

R2 int15;int15;C:\WINDOWS\system32\drivers\int15.sys [2006-06-02 13:59]

R2 OPTENET_FILTER;Orange Contrôle Parental;C:\Program Files\Controle Parental\bin\optproxy.exe [2006-12-21 19:15]

R2 tvicport;tvicport;C:\WINDOWS\system32\drivers\tvicport.sys [2006-06-02 13:59]

S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;C:\WINDOWS\system32\eLock2BurnerLockDriver.sys []

S2 eLock2FSCTLDriver;eLock2FSCTLDriver;C:\WINDOWS\system32\eLock2FSCTLDriver.sys []

S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 20:00]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3daa9e70-95ea-11dc-8837-0016d41b3ad8}]

\Shell\AutoRun\command - F:\ClickMe.exe

 

.

Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

"2008-01-26 11:49:02 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"

[Gof]

Bonjour Kairaut

 

Il ne s'agissait que de "restes" registre, les fichiers n'étaient plus là. Bon boulot. Je vais te faire effectuer une analyse en ligne, profites en pour me donner des nouvelles du pc en me joignant le rapport :

 

 

Rends toi sur ESET Online Scanner : http://www.eset.com/onlinescan/

• Coche la case YES, I accept the Terms Of Use
  
• Clique sur le bouton Start
  
• Clique maintenant sur Install button
  
• Clique à nouveau sur Start
  

• Les mises à jour du scan en ligne vont se faire.
  
• Ne coche pas Remove found threats
  
• Clique sur Scan button
  

• Le scan va démarrer, sois patient.
  
• Quand le scan sera terminé, clique sur Details tab
  
• Copie colle en réponse le contenu de C:\Program Files\EsetOnlineScanner\log.txt back
  

[Kairaut]

Bonsoir !

 

Voilà le rapport de ESET, et pardon pour le temps de réaction.

Petite précision : j'ai pas cliqué sur "détails tab" à la fin du scan parce que je n'ai pas trouvé de "details tab", c'est important ? ^^

 

 

 

# version=4

# OnlineScanner.ocx=1.0.0.56

# OnlineScannerDLLA.dll=1, 0, 0, 51

# OnlineScannerDLLW.dll=1, 0, 0, 51

# OnlineScannerUninstaller.exe=1, 0, 0, 49

# vers_standard_module=2846 (20080204)

# vers_arch_module=1.063 (20080117)

# vers_adv_heur_module=1.060 (20070601)

# EOSSerial=d1bce59eea14594ea86d9500d9450f7d

# end=finished

# remove_checked=false

# unwanted_checked=false

# utc_time=2008-02-04 06:01:11

# local_time=2008-02-04 07:01:11 (+0100, Paris, Madrid)

# country="France"

# osver=5.1.2600 NT Service Pack 2

# scanned=343709

# found=0

# scan_time=17871

[Gof]

Bonjour Kairaut

 

Le rapport n'a rien révélé. Qu'en est-il de tes alertes ? Sont-elles toujours présentes ? Comment se comporte le pc ?

 

Profites-en en me répondant pour me joindre un nouveau rapport HijackThis.

[Kairaut]

Bonjour !

Je n'ai plus d'alertes pour le moment, et mon PC va globalement bien sauf qu'il est assez lent au démarrage :/

 

Merci encore

 

 

 

Logfile of HijackThis v1.99.1

Scan saved at 14:52, on 2008-02-06

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\fxssvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\PROGRA~1\LAUNCH~1\LManager.exe

C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Acer\Empowering Technology\ePower\ePower_DMC.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\HijackThis\HijackThis.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [boot] C:\Acer\Empowering Technology\ePower\Boot.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"

O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm

O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

[Gof]

Bonjour Kairaut

 

Je n'ai plus d'alertes pour le moment, et mon PC va globalement bien sauf qu'il est assez lent au démarrage :/

Je crois que tes soucis de lenteur pourraient venir de la présence de

• Ad-Aware 2007
  Et d'un service google "Google Updater Service (gusvc)", lié à GoogleEarth.
  

Le premier, nativement, occasionne souvent des ralentissements importants (pour un résultat discutable, voir ce sujet) ; en présence d'un autre antimalware (avg as), cela peut en occasionner d'avantage.

Le deuxième est souvent aussi à l'origine de ralentissements et de lenteurs sur les systèmes.

 

Je vais te faire effectuer une deuxième analyse en ligne :

 

• Fais un scan en ligne Kaspersky
  
• Clique sur Accept
  
• Une barre jaune va te demander si tu acceptes d'installer le Kavwebscan_Unicode.cab, installe l'Active X.
  
• clique une nouvelle fois sur "Accept"
  
• Les bases de mises à jour vont s'installer, patiente un moment
  
• Clique sur Next.
  
• Clique sur My Computer, le scan se met en route; attends la fin du scan sans fermer la fenêtre sinon il s'arrêtera.
  

A la fin du scan, si des objets infectés sont découverts, clique sur Save report as... Choisis bureau et nomme le rapport "rapport Kaspersky" et dans le champ d'enregistrement, choisis "fichiers texte" enregistre alors le rapport.

Copie/colle l'entièreté du fichier texte ouvert, par clic droit dessus, sélectionner tout/copier.

Colle ce rapport dans ta réponse sur le forum.

Aide en cas de problème :Cybersécurité

NOTE: Le scan est à faire avec Internet Explorer.

 

Si tout va bien, je te fais désinstaller ensuite les outils que l'on a utilisés.

[Kairaut]

Enfin, j'ai pu régler mes problèmes de lenteurs. Merci

Et Voilà le rapport :

 

 

-------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER REPORT

Monday, February 11, 2008 3:41:52 PM

Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.98.0

Kaspersky Anti-Virus database last update: 11/02/2008

Kaspersky Anti-Virus database records: 556343

-------------------------------------------------------------------------------

 

Scan Settings:

Scan using the following antivirus database: extended

Scan Archives: true

Scan Mail Bases: true

 

Scan Target - My Computer:

C:\

D:\

E:\

 

Scan Statistics:

Total number of scanned objects: 93014

Number of viruses found: 0

Number of infected objects: 0

Number of suspicious objects: 0

Duration of the scan process: 01:54:42

 

Infected Object Name / Virus Name / Last Action

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped

C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{8F78B807-DBCA-4E7A-8AA5-8C20A8C12674}.crmlog Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\ModemLog_HDAUDIO Soft Data Fax Modem with SmartCP.txt Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_ba4.dat Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_8c8.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Sharioh\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Sharioh\ntuser.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Temp\~DFAC33.tmp Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Temp\~DFAC40.tmp Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Temp\~DFBC37.tmp Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Temp\Perflib_Perfdata_ccc.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Temp\Perflib_Perfdata_adc.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Temp\Perflib_Perfdata_af4.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Temp\~DFBC43.tmp Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Historique\History.IE5\MSHist012008021120080212\index.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\ApplicationHistory\ePower_DMC.exe.3ca0acde.ini.inuse Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\Microsoft\Windows Live Contacts\caroline32820@hotmail.com\real\members.stg Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\Microsoft\Windows Live Contacts\caroline32820@hotmail.com\shadow\members.stg Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\Cache\_CACHE_MAP_ Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\Cache\_CACHE_001_ Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\Cache\_CACHE_002_ Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\Cache\_CACHE_003_ Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\Cache\9812791Ad01 Object is locked skipped

C:\Documents and Settings\Sharioh\Local Settings\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\Cache\FDF09C04d01 Object is locked skipped

C:\Documents and Settings\Sharioh\Mes documents\Mes fichiers reçus\MsnMsgr.txt Object is locked skipped

C:\Documents and Settings\Sharioh\Mes documents\Mes fichiers reçus\lcapi0.log Object is locked skipped

C:\Documents and Settings\Sharioh\Mes documents\Mes fichiers reçus\Transport0.log Object is locked skipped

C:\Documents and Settings\Sharioh\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\history.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\parent.lock Object is locked skipped

C:\Documents and Settings\Sharioh\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\formhistory.dat Object is locked skipped

C:\Documents and Settings\Sharioh\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\cert8.db Object is locked skipped

C:\Documents and Settings\Sharioh\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\key3.db Object is locked skipped

C:\Documents and Settings\Sharioh\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\search.sqlite Object is locked skipped

C:\Documents and Settings\Sharioh\Application Data\Mozilla\Firefox\Profiles\zjk9trsm.default\urlclassifier2.sqlite Object is locked skipped

C:\System Volume Information\_restore{2DB37729-7E03-4F82-ADEF-4057C22A22C7}\RP18\change.log Object is locked skipped

 

Scan process completed.

Modifié le 11 février 2008 par Kairaut