Résolu: chevaux de troie sur mon PC

[angelique]

moins bonne nouvelle mon fond d'écran est tout bleu, c'est le choix aucun dans la liste windows.

quoique là je ne m'inquiète pas, je pense que c'est normal avec le nettoyage qui a été fait, n'est ce pas Angélique.

 

oui , c'est normal, SmitfraudFix t'a degagé netproject et remis ton fond par defaut, tu n'as qu'à le remettre si tu le souhaites.

 

• Télécharge combofix.exe (par sUBs) et sauvegarde le sur ton bureau.

 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

 

* Double-clique combofix.exe afin de l'exécuter et suis les instructions.

* Lorsque l'analyse sera complétée, un rapport apparaîtra que tu me posteras.

[lsdefiste]

* Lorsque l'analyse sera complétée, un rapport apparaîtra que tu me posteras.

 

Bonjour Angélique,

 

depuis hier, quand j'allume mon PC, le bureau est vide. il finit par se remplir quand je fais "ctrl-alt-sup"

quoique aujourd'hui, rien, si ce n'est un nouveau pop up de "chasseur d'erreur".

Mais suite au redémarrage après le scan combofix, l'écran est resté désespérément vide. Heureusement que j'avais remis mon super paysage comme fond d'écran

J'ai dû éteindre de façon hard mon PC.

 

Voici le rapport combofix:

 

ComboFix 08-03-01.3 - Marcus_LeGéanaute 2008-03-02 9:53:36.1 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.127 [GMT 1:00]

Endroit: C:\Documents and Settings\Marcus_LeGéanaute\Bureau\ComboFix.exe

 

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

.

 

((((((((((((((((((((((((((((( Fichiers créés 2008-02-02 to 2008-03-02 ))))))))))))))))))))))))))))))))))))

.

 

2008-03-01 15:49 . 2008-03-01 16:05 1,576 --a------ C:\WINDOWS\system32\tmp.reg

2008-03-01 00:08 . 2008-03-01 00:09 <REP> d-------- C:\Program Files\Windows Live

2008-03-01 00:08 . 2008-03-01 00:08 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller

2008-03-01 00:08 . 2008-03-01 00:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller

2008-02-27 19:58 . 2008-02-27 23:47 <REP> d-------- C:\Program Files\Jhoos

2008-02-26 22:45 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2008-02-26 20:59 . 2008-02-26 20:59 <REP> d-------- C:\Program Files\Panda Security

2008-02-26 20:29 . 2008-02-26 20:29 10,177,407 --a------ C:\upload_moi_LEG?ANAUTE.tar.gz

2008-02-26 19:35 . 2008-02-26 19:35 <REP> d-------- C:\WINDOWS\system32\fr-fr

2008-02-26 19:35 . 2008-02-26 19:35 759 --a------ C:\WINDOWS\system32\spupdsvc.inf

2008-02-26 19:32 . 2008-02-26 19:33 1,374 --a------ C:\WINDOWS\imsins.BAK

2008-02-10 10:55 . 2001-09-30 19:10 246,784 --a------ C:\WINDOWS\system32\ActiveSkin.ocx

2008-02-10 10:55 . 2001-05-24 12:59 162,304 --a------ C:\UNWISE.EXE

2008-02-10 10:55 . 2002-01-18 18:12 112 --a------ C:\WINDOWS\ActiveSkin.INI

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-02-29 23:34 --------- d-----w C:\Program Files\Dictionnaire

2008-02-26 21:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft

2008-02-26 21:24 --------- d-----w C:\Program Files\Navilog1

2008-02-25 21:15 --------- d-----w C:\Program Files\MahJong

2008-01-27 19:55 --------- d-----w C:\Program Files\MSN Pictures Displayer

2008-01-24 20:42 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-01-13 15:31 --------- d-----w C:\Program Files\MP3 Player Utilities 4.05

2006-10-02 16:42 3,992,565 -c--a-w C:\Program Files\Matroska_Pack_Full_v1[2].1.2.exe

2006-10-02 16:00 6,652,812 -c--a-w C:\Program Files\sld.codec.pack.2.2.exe

2006-10-02 15:45 15,895,440 -c--a-w C:\Program Files\DivXPlay.exe

2006-09-30 15:54 513,648 -c--a-w C:\Program Files\peercast-win32.exe

2006-09-25 16:18 774,144 -c--a-w C:\Program Files\RngInterstitial.dll

2005-05-11 22:36 12,288 -c--a-w C:\WINDOWS\Fonts\RandFont.dll

.

 

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\ypager.exe" [2004-08-06 14:33 2502656]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-31 20:13 249896]

"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2005-06-03 06:16 81920]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

VESWinlogon.dll 2005-05-20 16:42 73728 C:\WINDOWS\system32\VESWinlogon.dll

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage rapide du logiciel HP Image Zone.lnk]

path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage rapide du logiciel HP Image Zone.lnk

backup=C:\WINDOWS\pss\Démarrage rapide du logiciel HP Image Zone.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]

path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk

backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk]

path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk

backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^Marcus_LeGéanaute^Menu Démarrer^Programmes^Démarrage^MSN Pictures Displayer.lnk]

path=C:\Documents and Settings\Marcus_LeGéanaute\Menu Démarrer\Programmes\Démarrage\MSN Pictures Displayer.lnk

backup=C:\WINDOWS\pss\MSN Pictures Displayer.lnkStartup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]

--a------ 2005-03-03 20:47 483328 C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]

--a------ 2003-11-07 09:21 114688 C:\Program Files\Apoint\Apoint.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]

--a------ 2005-04-29 06:56 45056 C:\Program Files\Realtek\InstallShield\AzMixerSel.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

--a------ 2004-08-05 13:00 15360 C:\WINDOWS\system32\ctfmon.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

--a------ 2005-06-29 06:33 77824 C:\WINDOWS\system32\hkcmd.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

--a------ 2005-06-29 06:33 94208 C:\WINDOWS\system32\igfxtray.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]

--a------ 2004-08-05 13:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

--------- 2002-09-12 18:13 1101824 C:\Program Files\Ahead\InCD\InCD.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISBMgr.exe]

--a------ 2004-02-20 13:12 32768 C:\Program Files\Sony\ISB Utility\ISBMgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

C:\WINDOWS\system32\dumprep 0 -k

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]

--a------ 2005-06-08 13:44 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]

--a--c--- 2005-06-08 14:24 458752 C:\Program Files\Logitech\Video\ISStart.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]

--a------ 2005-06-08 14:14 217088 C:\Program Files\Logitech\Video\LogiTray.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]

--a------ 2005-07-19 16:32 221184 C:\WINDOWS\system32\LVCOMSX.EXE

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon]

--a------ 2002-03-14 15:46 45056 C:\WINDOWS\system32\ico.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]

--a------ 2004-08-05 13:00 59392 C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]

--------- 2001-07-09 09:50 155648 C:\WINDOWS\system32\\NeroCheck.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

--a------ 2005-06-09 08:56 6746112 C:\WINDOWS\system32\NvCpl.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

--a------ 2005-06-29 06:33 114688 C:\WINDOWS\system32\igfxpers.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]

--a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]

--a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2007-06-29 05:24 286720 C:\Program Files\QuickTime\QTTask.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

--a------ 2005-06-29 05:25 14720000 C:\WINDOWS\RTHDCPL.EXE

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SonyPowerCfg]

--a------ 2005-05-15 04:51 184320 C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]

--a------ 2005-06-03 06:16 81920 C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2007-09-25 00:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

-ra------ 2006-03-30 16:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Update 2]

--a------ 2005-01-14 12:43 151552 C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=

"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=

"C:\\WINDOWS\\system32\\dpvsetup.exe"=

"C:\\Program Files\\Media Player Classic\\mplayerc.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

"C:\\WINDOWS\\system32\\rundll32.exe"=

"C:\\Program Files\\Messenger\\msmsgs.exe"=

"C:\\WINDOWS\\system32\\sessmgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3587:TCP"= 3587:TCP:*:Disabled:Groupement homologue Windows

"3540:UDP"= 3540:UDP:Protocole PNRP (Peer Name Resolution Protocol)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

 

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce0be9c4-7e27-11da-9edb-0014a42c6c99}]

\Shell\AutoRun\command - G:\LaunchU3.exe

 

.

Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

"2007-10-24 14:15:56 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

"2007-10-28 09:31:19 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"

- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE

.

**************************************************************************

 

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-03-02 10:00:12

Windows 5.1.2600 Service Pack 2 NTFS

 

Balayage processus cachés ...

 

Balayage caché autostart entries ...

 

Balayage des fichiers cachés ...

 

Scan terminé avec succès

Les fichiers cachés: 0

 

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_Task.exe

C:\WINDOWS\system32\igfxext.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe

C:\WINDOWS\system32\cscript.exe

.

**************************************************************************

.

Temps d'accomplissement: 2008-03-02 10:04:39 - machine was rebooted

ComboFix-quarantined-files.txt 2008-03-02 09:04:33

.

2007-10-24 21:33:17 --- E O F ---

[angelique]

bon ton probleme a l'air d'etre resolu en definitive , un peu de nettoyage::

 

• desinstalle ComboFix de cette maniere, copie\colle la ligne ci dessous dans executer et clic ok ou tape "enter":

 

ComboFix /u

 

• telecharge sur ton bureau >> - AtfCleaner --> http://www.atribune.org/ccount/click.php?id=1

 

ATF Cleaner

Double-clique ATF-Cleaner.exe afin de lancer le programme.

Sous l'onglet Main, choisis : Select All

Clique sur le bouton Empty Selected, patiente le temps du nettoyage

Si tu utilises le navigateur Firefox :

Clique Firefox au haut et choisis : Select All

Clique le bouton Empty Selected

NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.

Si tu utilises le navigateur Opera :

Clique Opera au haut et choisis : Select All

Clique le bouton Empty Selected

NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.

Clique Exit, du menu prinicipal, afin de fermer le programme.

 

• Télécharge ewido anti-spyware micro scanner << http://downloads.ewido.net/ewido_micro.exe >> sur ton bureau.

• Double-clique sur le fichier ewido_micro.exe pour l'exécuter.
  
• Le programme va demander dès son lancement un accès internet pour se mettre à jour, accepte.
  
• Puis, un nouvel écran apparaît, assure toi que toutes les cases soient cochées.
  
• Clique sur Start Scan et laisse l'outil travailler.
  
• Quand l'outil à fini, clique sur save report et sauvegarde le rapport sur ton bureau.
  
• Poste le dans ta prochaine réponse.
  

• Nb, clique sur Remove infections
  

• effectue un scan antivir, conserve le rapport et paste le avec un nouveau rapport HJT

[lsdefiste]

• desinstalle ComboFix

 

impossible d'effacer ComboFix, windows me dit qu'il ne le trouve pas

[angelique]

**supprime alors c:\qoobox , ComboFix sur ton bureau , c:\ComboFix

[lsdefiste]

en attendant que mon scan antivir se termine, voici le rapprot ewido:

 

__________________________________________________

ewido anti-spyware online scanner

http://www.ewido.net

__________________________________________________

 

 

Name: TrackingCookie.Smartadserver

Path: :mozilla.16:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Smartadserver

Path: :mozilla.17:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Smartadserver

Path: :mozilla.18:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Smartadserver

Path: :mozilla.22:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Smartadserver

Path: :mozilla.23:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Adviva

Path: :mozilla.25:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Doubleclick

Path: :mozilla.45:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Tradedoubler

Path: :mozilla.46:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Tradedoubler

Path: :mozilla.48:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Tradedoubler

Path: :mozilla.49:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Bluestreak

Path: :mozilla.87:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Atdmt

Path: :mozilla.138:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.2o7

Path: :mozilla.150:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.2o7

Path: :mozilla.152:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Adrevolver

Path: :mozilla.153:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Advertising

Path: :mozilla.160:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Advertising

Path: :mozilla.162:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Advertising

Path: :mozilla.163:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Advertising

Path: :mozilla.164:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Serving-sys

Path: :mozilla.198:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Serving-sys

Path: :mozilla.199:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Serving-sys

Path: :mozilla.200:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Serving-sys

Path: :mozilla.201:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Serving-sys

Path: :mozilla.202:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Serving-sys

Path: :mozilla.203:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Serving-sys

Path: :mozilla.204:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Overture

Path: :mozilla.233:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Overture

Path: :mozilla.234:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Overture

Path: :mozilla.235:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Mediaplex

Path: :mozilla.261:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Estat

Path: :mozilla.263:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Yieldmanager

Path: :mozilla.301:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Yieldmanager

Path: :mozilla.303:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Yieldmanager

Path: :mozilla.304:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Yieldmanager

Path: :mozilla.305:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Statcounter

Path: :mozilla.370:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Liveperson

Path: :mozilla.373:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

Name: TrackingCookie.Tracking101

Path: :mozilla.374:C:\Documents and Settings\Marcus_LeGéanaute\Application Data\Mozilla\Firefox\Profiles\p003adh8.default\cookies.txt

Risk: Medium

 

[lsdefiste]

J'ai fais un scan Antivir mais le rapport faisait 24Mo, alors j'ai recommencé en changeant le type de rapport.

13ko, c'est plus humain.

 

la différence entre les 2 scan est le nombre de warning. Une quarantaine en moins.

 

Voici le rapport Antivir:

 

 

 

AntiVir PersonalEdition Classic

Report file date: dimanche 2 mars 2008 14:39

 

Scanning for 1129035 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: SYSTEM

Computer name: LEGÉANAUTE

 

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 19:13:10

ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 22:29:41

ANTIVIR2.VDF : 7.0.2.181 1993728 Bytes 24/02/2008 21:52:09

ANTIVIR3.VDF : 7.0.2.215 117248 Bytes 29/02/2008 22:32:07

AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 29/02/2008 22:32:08

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.6.0.3 360488 Bytes 18/01/2008 21:20:08

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: D:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: dimanche 2 mars 2008 14:39

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'Ymsgr_tray.exe' - '1' Module(s) have been scanned

Scan process 'SSScsiSV.exe' - '1' Module(s) have been scanned

Scan process 'avgas.exe' - '1' Module(s) have been scanned

Scan process 'SSAAD.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'VzRs.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned

Scan process 'igfxext.exe' - '1' Module(s) have been scanned

Scan process 'VESMgr.exe' - '1' Module(s) have been scanned

Scan process 'tcpsvcs.exe' - '1' Module(s) have been scanned

Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned

Scan process 'PhotoshopElementsDeviceConnect.exe' - '1' Module(s) have been scanned

Scan process 'sqlservr.exe' - '1' Module(s) have been scanned

Scan process 'guard.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'AAWTray.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'aawservice.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned

Scan process 'EvtEng.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

37 processes with 37 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[NOTE] No virus was found!

Master boot sector HD1

[NOTE] No virus was found!

[WARNING] The boot sector file could not be read!

[WARNING] Error code: 0x0015

 

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'D:\'

[NOTE] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '18' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <VAIO>

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

Begin scan in 'D:\' <VAIO>

 

 

End of the scan: dimanche 2 mars 2008 15:41

Used time: 1:02:14 min

 

The scan has been done completely.

 

8313 Scanning directories

329747 Files were scanned

0 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

0 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

329747 Files not concerned

6887 Archives were scanned

2 Warnings

10 Notes

 

 

et celui du HJT:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:16:50, on 02/03/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Yahoo!\Messenger\ypager.exe

C:\Program Files\InterVideo\WinDVD\WinDVD.exe

C:\Program Files\Dictionnaire\dict.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://televisionsurpc.neuf.fr/index.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [ssAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - .DEFAULT User Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe (User 'Default user')

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Transfert par Image Converter 2 - C:\Program Files\Sony\Image Converter 2\menu.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/

O15 - Trusted Zone: *.sony-europe.com

O15 - Trusted Zone: *.sonystyle-europe.com

O15 - Trusted Zone: *.vaio-link.com

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe

O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe

O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe

O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe

O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe

O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe

 

--

End of file - 7265 bytes

 

je crois que l'on en a vu la fin, ou c'est plutôt un espoir.

 

A+

[angelique]

Pour moi c'est OK , édite ton 1er message et met [resolu] dans le titre.

[lsdefiste]

édite ton 1er message et met [resolu] dans le titre.

 

comment j'édite mon premier message?

[angelique]

en utilisant l'onglet "editer" en dessous de ton 1er sujet