débordement de la mémoire tampon

[baret]

Bonsoir à tous

depuis aujourd'hui au démarrage de mon pc McAfee me signale qu'il a bloqué une application dans windows /system32/services.exe

qui est responsable d'un débordement de mémoire tampon

est ce que je me suis chope un virus? et comment faire pour m'en débarasser

merci par avance

suis sous windows xp sp2

baret

je mets le rapport hijackthis

Logfile of HijackThis v1.99.1

Scan saved at 22:59:56, on 21/07/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe

C:\Program Files\SiteAdvisor\6261\SAService.exe

C:\WINDOWS\System32\snmp.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Raxco\PerfectDisk\PDSched.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\McAfee.com\Agent\mcagent.exe

c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\RFA Platinum\rfagent.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe

C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe

C:\Program Files\Pando Networks\Pando\Pando.exe

C:\Program Files\SiteAdvisor\6261\SiteAdv.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcvsshld.exe

C:\PROGRA~1\Mouse\Amoumain.exe

C:\WINDOWS\Domino.exe

C:\WINDOWS\ZSSnp211.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe

C:\Program Files\Nikon\PictureProject\NkbMonitor.exe

C:\Program Files\Google\Google Updater\GoogleUpdater.exe

C:\Program Files\Club-Internet\Lanceur\lanceur.exe

c:\PROGRA~1\mcafee\msc\mcshell.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.msn.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;2

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll

O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Program Files\Pando Networks\Pando\PandoIEPlugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [intelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [rfagent] "C:\Program Files\RFA Platinum\rfagent.exe"

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe

O4 - HKLM\..\Run: [ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe

O4 - HKLM\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized

O4 - HKLM\..\Run: [siteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"

O4 - HKLM\..\Run: [C:\PROGRA~1\McAfee\VIRUSS~1\mcvsshld.exe] C:\PROGRA~1\McAfee\VIRUSS~1\mcvsshld.exe

O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\Mouse\Amoumain.exe

O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe

O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe

O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"

O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1036

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector

O4 - HKCU\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe

O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe

O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe

O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe

O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...90/mcinsctl.cab

O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gr.spaces.live.com/PhotoUpload/MsnPUpld.cab

O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-1.1.cab

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab

O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/41/install/gtdownde.cab

O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll

O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe

O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe

O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe

O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

Modifié le 22 juillet 2008 par baret

[Apollo]

Bonjour,

 

Rien de frappant dans ce log mais tu devrais mettre une version plus récente de Hijackthis.

HijackThisV2

 

Fais une analyse avec MalwareBytes après l'avoir configuré comme le préconise Malekal:

http://www.malekal.com/tutorial_MalwareBytes_AntiMalware.php

 

Fais une analyse complète en sélectionnant tous les disques ou partitions.

Supprime ce qu'il trouve puis prends le rapport qui se trouve dans "Rapports/Logs".

 

Poste ce rapport stp.

@+

[baret]

Merci de m'avoir répondu et de me rassurer un peu

dès que je rentre à la maison je fais les manipulations que tu m'as indiqué et je te tiens au courant

[baret]

Apollo.01

j'ai passé MalwareBytes hier soir il m'a trouvé 32 fichiers infectés

je me suis envoyé le rapport au bureau mais apparement je ne l'ai pas reçu aussi dès mon retour à la maison je le mettrai en ligne

ceci dit après avoir supprimer et redemarrer j'ai toujours mcafee qui m'indique avoir bloqué services.exe dans windows/system32 qui a tenter un débordement de mémoire tampon

j'ai également fait un rapport hijackthis avec la dernière version V2

je dois donc avoir encore une bestiole qui est responsable de la tentative d'un débordement de mémoire tampon

merci pour votre aide

[Apollo]

Rends-toi sur VirusTotal et fais analyser le fichier.

 

windows /system32/services.exe

 

Si virus total te dit que le fichier a déjà été analysé, refais une nouvelle; à la fin, cliquer sur Formaté et copier/coller le résultat ici.

Mais ce fichier est légitime...

 

J'attends ton log Hijackthis.

@+

Modifié le 23 juillet 2008 par Apollo.01

[baret]

re Apollo.01

comme convenu je te copie les logs demandés :

résultat de malwarebytes :

Malwarebytes' Anti-Malware 1.22

Version de la base de données: 979

Windows 5.1.2600 Service Pack 2

 

00:18:25 23/07/2008

mbam-log-7-23-2008 (00-18-14).txt

 

Type de recherche: Examen complet (C:\|G:\|)

Eléments examinés: 435911

Temps écoulé: 4 hour(s), 32 minute(s), 20 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 2

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 39

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

C:\Documents and Settings\Gilles\Mes documents\ALPluginIE-1.0.2.2-setup.exe (Rogue.Installer) -> No action taken.

C:\Documents and Settings\Gilles\Mes documents\01zoomphoto\ALPluginIE-1.0.2.3-setup.exe (Rogue.Installer) -> No action taken.

C:\Documents and Settings\Gilles\Mes documents\01zoomphoto\everest ultimate3-0-1\Ultimate-kg.exe (Trojan.Downloader) -> No action taken.

C:\Documents and Settings\Gilles\Mes documents\everest 06\everest_ultimate_edition\keygen.exe (Trojan.Downloader) -> No action taken.

C:\Documents and Settings\Gilles\Mes documents\Maj souris génius\3b.exe (Rogue.Installer) -> No action taken.

C:\Program Files\Wanadoo\gr\ALPluginIE-1.0.1.6-setup.exe (Rogue.Installer) -> No action taken.

C:\Program Files\Wanadoo\gr\ALPluginIE-1.0.1.9-setup.exe (Rogue.Installer) -> No action taken.

C:\Program Files\Wanadoo\gr\ALPluginIE-1.0.2.1-setup.exe (Rogue.Installer) -> No action taken.

C:\Program Files\Wanadoo\gr\ALPluginIE-1.0.2.3-setup.exe (Rogue.Installer) -> No action taken.

C:\Program Files\Wanadoo\gr\File_6[1].09\File lock 6.09\keygen.exe (Trojan.Downloader) -> No action taken.

C:\Program Files\Wanadoo\gr\Greece[1].Aquarium.3D.Incl.Keygen\KeyGen [ Greece Aquarium 3D Screensaver ].exe (Trojan.Downloader) -> No action taken.

C:\Program Files\Wanadoo\gr\Keygen Nero 6\Keygen.exe (Trojan.Agent) -> No action taken.

C:\Program Files\WinRAR\Unipatch.exe (Trojan.Downloader) -> No action taken.

G:\Document Gilles 12-06-06\everest 06\everest_ultimate_edition\keygen.exe (Trojan.Downloader) -> No action taken.

G:\fichier à detruire si ok\Document Gilles 12-06-06\ALPluginIE-1.0.2.2-setup.exe (Rogue.Installer) -> No action taken.

G:\gr\ALPluginIE-1.0.1.6-setup.exe (Rogue.Installer) -> No action taken.

G:\gr\ALPluginIE-1.0.1.9-setup.exe (Rogue.Installer) -> No action taken.

G:\gr\ALPluginIE-1.0.2.1-setup.exe (Rogue.Installer) -> No action taken.

G:\gr\ALPluginIE-1.0.2.3-setup.exe (Rogue.Installer) -> No action taken.

G:\gr\File_6[1].09\File lock 6.09\keygen.exe (Trojan.Downloader) -> No action taken.

G:\gr\Greece[1].Aquarium.3D.Incl.Keygen\KeyGen [ Greece Aquarium 3D Screensaver ].exe (Trojan.Downloader) -> No action taken.

G:\gr\Générateur de clés\Générateur de clés\générateur de clé\MS_Windows_XP_SP_2_And_Office_KeyGen.exe (Malware.Tool) -> No action taken.

G:\gr\Générateur de clés\Générateur de clés\générateur de clé\XP SP1 Keychanger SP2 Keygen and Product Key Viewer\MS Windows XP SP 2 And Office KeyGen.exe (Malware.Tool) -> No action taken.

G:\gr\Keygen Nero 6\Keygen.exe (Trojan.Agent) -> No action taken.

G:\guillaume\NFSU Most Wanted fr\keygen.exe (Trojan.Downloader) -> No action taken.

G:\Portable Gilles aout 2006\téléchargement\ALPluginIE-1.0.2.1-setup.exe (Rogue.Installer) -> No action taken.

G:\programmes\001downloadaccelerator\quarkx keygen\Quark_Xpress_7_Keygen.exe (Trojan.Downloader) -> No action taken.

G:\programmes\anydvd\anydvd 6.1.2.5\AnyDVD v6.1.2.5_Fr_by_narvallo_76\a6125\Patch\keygen.exe (Trojan.Downloader) -> No action taken.

G:\programmes\CloneDVD\CloneDVD\CloneDVD2Keygen.exe (Trojan.Downloader) -> No action taken.

G:\programmes\Everest\everest 3.50.761\EU 3.x - KeyGen.exe (Trojan.Downloader) -> No action taken.

G:\programmes\flashget\Le_t_l_chargeur\FlashGet 1.73\FG 1.73\keygen\keygen.exe (Trojan.Downloader) -> No action taken.

G:\programmes\genuine\Pack.Validation.WGA.Definitif-JiGWaReZ\Windows XP Keygen.exe (Malware.Tool) -> No action taken.

G:\programmes\kitwz\KdwbyDr.Jn\Kit du warezien\Gravure.Image\nerosoftware\Keygen\Nero.Burning.ROM.7.exe (Trojan.Downloader) -> No action taken.

G:\programmes\Nero\nero lite 7.5.9.0\nero7.5.9.0_fra_lite\keygen2.exe (Trojan.Downloader) -> No action taken.

G:\programmes\QuarkXPress\Quark XPress Passport v7.0\Keygen\Quark_Xpress_7_Keygen.exe (Trojan.Downloader) -> No action taken.

G:\programmes\QuarkXPress\QuarkXPress 7.0+ keygen\serial + keygen\serial + keygen\PARADOX\Quark_Xpress_7_Keygen.exe (Trojan.Downloader) -> No action taken.

G:\programmes\Sony Vegas\vegas7.0d Fr+Keygen\Keygen\keygen.exe (Trojan.Downloader) -> No action taken.

G:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP427\A0061941.exe (Spyware.OnlineGames) -> No action taken.

G:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP427\A0061953.exe (Trojan.Downloader) -> No action taken.

hijackthis 202 :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:24:22, on 23/07/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe

C:\Program Files\McAfee\VirusScan\McShield.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe

C:\Program Files\SiteAdvisor\6261\SAService.exe

C:\WINDOWS\System32\snmp.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Raxco\PerfectDisk\PDSched.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\McAfee.com\Agent\mcagent.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\RFA Platinum\rfagent.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe

C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe

C:\Program Files\SiteAdvisor\6261\SiteAdv.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcvsshld.exe

C:\PROGRA~1\Mouse\Amoumain.exe

C:\WINDOWS\Domino.exe

C:\WINDOWS\ZSSnp211.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe

C:\Program Files\Nikon\PictureProject\NkbMonitor.exe

C:\Program Files\Google\Google Updater\GoogleUpdater.exe

C:\Program Files\Club-Internet\Lanceur\lanceur.exe

C:\Documents and Settings\Gilles\Bureau\prog anti malwares\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.msn.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;2

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll

O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Program Files\Pando Networks\Pando\PandoIEPlugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [intelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [rfagent] "C:\Program Files\RFA Platinum\rfagent.exe"

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe

O4 - HKLM\..\Run: [ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe

O4 - HKLM\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized

O4 - HKLM\..\Run: [siteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"

O4 - HKLM\..\Run: [C:\PROGRA~1\McAfee\VIRUSS~1\mcvsshld.exe] C:\PROGRA~1\McAfee\VIRUSS~1\mcvsshld.exe

O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\Mouse\Amoumain.exe

O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe

O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe

O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey

O4 - HKLM\..\Run: [adobe reader speed launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"

O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1036

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [picasa media detector] C:\Program Files\Picasa2\PicasaMediaDetector

O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\Program Files\Druide\Antidote\Gestionnaire Antidote.exe

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe

O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe

O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe

O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)

O15 - Trusted Zone: http://*.mcafee.com

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...90/mcinsctl.cab

O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://gr.spaces.live.com/PhotoUpload/MsnPUpld.cab

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab

O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/41/install/gtdownde.cab

O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab

O16 - DPF: {ef791a6b-fc12-4c68-99ef-fb9e207a39e6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...343/mcfscan.cab

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe

O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe

O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe

O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

 

--

End of file - 14429 bytes

log de virustotal:

Fichier services.exe reçu le 2008.07.23 18:34:52 (CET)

Antivirus Version Dernière mise à jour Résultat

AhnLab-V3 2008.7.24.0 2008.07.23 -

AntiVir 7.8.1.11 2008.07.23 -

Authentium 5.1.0.4 2008.07.23 -

Avast 4.8.1195.0 2008.07.23 -

AVG 8.0.0.130 2008.07.23 -

BitDefender 7.2 2008.07.23 -

CAT-QuickHeal 9.50 2008.07.22 -

ClamAV 0.93.1 2008.07.23 -

DrWeb 4.44.0.09170 2008.07.23 -

eSafe 7.0.17.0 2008.07.23 -

eTrust-Vet 31.6.5976 2008.07.23 -

Ewido 4.0 2008.07.23 -

F-Prot 4.4.4.56 2008.07.22 -

F-Secure 7.60.13501.0 2008.07.23 -

Fortinet 3.14.0.0 2008.07.23 -

GData 2.0.7306.1023 2008.07.23 -

Ikarus T3.1.1.34.0 2008.07.23 -

Kaspersky 7.0.0.125 2008.07.23 -

McAfee 5345 2008.07.23 -

Microsoft 1.3704 2008.07.23 -

NOD32v2 3292 2008.07.23 -

Norman 5.80.02 2008.07.23 -

Panda 9.0.0.4 2008.07.23 -

PCTools 4.4.2.0 2008.07.22 -

Prevx1 V2 2008.07.23 -

Rising 20.54.22.00 2008.07.23 -

Sophos 4.31.0 2008.07.23 -

Sunbelt 3.1.1536.1 2008.07.18 -

Symantec 10 2008.07.23 -

TheHacker 6.2.96.387 2008.07.23 -

TrendMicro 8.700.0.1004 2008.07.23 -

VBA32 3.12.8.1 2008.07.23 -

VIRobot 2008.7.23.1307 2008.07.23 -

VirusBuster 4.5.11.0 2008.07.23 -

Webwasher-Gateway 6.6.2 2008.07.23 -

Information additionnelle

File size: 108544 bytes

MD5...: 732e0b1abaace15d80ec19056b0a2af9

SHA1..: 7aadfc1c733f85d06e6b09886f83f3f189e268e4

SHA256: d751d18991b74409a183847ecc99079897de25a1b40993e65e7132184865cab3

SHA512: 5d1f98d48985f9ea50f20f554a5bd51f3fb14214de5c22d61522f7e2fb7b031b<br>b66460836120a67d8074788b1fe47fcab6635189d55f28bc0f6601ce005a13a3

PEiD..: -

PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x100b5cc<br>timedatestamp.....: 0x41107eb3 (Wed Aug 04 06:14:11 2004)<br>machinetype.......: 0x14c (I386)<br><br>( 3 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0x18f55 0x19000 6.27 8ff2bbf546e1ef8832de2fa905a7a4e4<br>.data 0x1a000 0xa14 0xa00 2.05 fd6fc84823efda2858a97fe8e6dd8f76<br>.rsrc 0x1b000 0x8b8 0xa00 3.79 a42d45f05d2e70211c3682cefccbc0e1<br><br>( 10 imports ) <br>> msvcrt.dll: wcsrchr, time, _except_handler3, memmove, wcschr, _c_exit, _exit, _XcptFilter, _cexit, _wcsicmp, exit, __initenv, __getmainargs, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _controlfp, wcslen, wcsncmp, _wtol, wcscpy, _itow, _wcsnicmp, wcscat, _initterm, wcsncpy, wcscspn, _ultow<br>> ADVAPI32.dll: RegOpenKeyW, ConvertSidToStringSidW, LogonUserExW, LsaStorePrivateData, LsaLookupNames, LsaQueryInformationPolicy, OpenThreadToken, RegNotifyChangeKeyValue, InitializeSecurityDescriptor, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, SetServiceStatus, SystemFunction029, SystemFunction005, CheckTokenMembership, FreeSid, AllocateAndInitializeSid, SetSecurityDescriptorOwner, GetSecurityDescriptorDacl, GetLengthSid, CopySid, InitializeAcl, AddAce, SetSecurityDescriptorDacl, LsaOpenPolicy, LsaLookupSids, LsaFreeMemory, LsaClose, ImpersonateLoggedOnUser, CreateProcessAsUserW, GetTokenInformation, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, InitiateSystemShutdownW, RevertToSelf<br>> KERNEL32.dll: TerminateProcess, SetProcessShutdownParameters, lstrcmpiW, FormatMessageW, ExitThread, ReleaseMutex, DelayLoadFailureHook, RaiseException, GetExitCodeThread, SetErrorMode, SetUnhandledExceptionFilter, LoadLibraryA, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcess, UnhandledExceptionFilter, GetModuleHandleA, CreateMutexW, LocalAlloc, LocalFree, Sleep, LeaveCriticalSection, EnterCriticalSection, SetLastError, CloseHandle, CreateThread, GetLastError, CreateProcessW, ExpandEnvironmentStringsW, InitializeCriticalSection, HeapAlloc, HeapFree, SetConsoleCtrlHandler, WaitForSingleObject, HeapCreate, FreeLibrary, GetProcAddress, GetModuleHandleExW, InterlockedCompareExchange, CreateNamedPipeW, ReadFile, CancelIo, GetOverlappedResult, WaitForMultipleObjects, ConnectNamedPipe, TransactNamedPipe, WriteFile, GetTickCount, GetSystemTimeAsFileTime, GetModuleHandleW, GetComputerNameW, CreateEventW, SetEvent, ResetEvent, DeviceIoControl, CreateFileW, ResumeThread, GetCurrentProcessId, LoadLibraryW, GetDriveTypeW, OpenEventW, GetCurrentThread<br>> USER32.dll: wsprintfW, BroadcastSystemMessageW, MessageBoxW, LoadStringW, RegisterServicesProcess<br>> RPCRT4.dll: RpcServerRegisterAuthInfoW, RpcBindingFree, RpcEpResolveBinding, RpcBindingFromStringBindingW, RpcStringBindingComposeW, NdrClientCall2, RpcAsyncCompleteCall, RpcAsyncInitializeHandle, NdrAsyncServerCall, NdrAsyncClientCall, RpcMgmtStopServerListening, RpcMgmtWaitServerListen, NdrServerCall2, I_RpcBindingIsClientLocal, RpcRevertToSelf, I_RpcMapWin32Status, RpcImpersonateClient, RpcStringBindingParseW, RpcStringFreeW, RpcBindingToStringBindingW, RpcServerRegisterIfEx, RpcServerUseProtseqEpW, RpcServerRegisterIf, RpcServerListen, RpcServerUnregisterIf<br>> ntdll.dll: RtlCreateAcl, NtCreateKey, NtQueryValueKey, NtSetValueKey, NtDeleteValueKey, NtEnumerateKey, NtQuerySecurityObject, RtlFreeHeap, NtOpenKey, NtDeleteKey, RtlSetControlSecurityDescriptor, RtlValidSecurityDescriptor, RtlLengthSecurityDescriptor, NtPrivilegeObjectAuditAlarm, NtPrivilegeCheck, NtOpenThreadToken, NtAccessCheckAndAuditAlarm, NtSetInformationThread, NtAdjustPrivilegesToken, NtDuplicateToken, NtOpenProcessToken, NtQueryInformationToken, RtlQuerySecurityObject, RtlAddAccessAllowedAce, RtlValidRelativeSecurityDescriptor, RtlMapGenericMask, RtlCopyUnicodeString, NtSetInformationFile, NtQueryInformationFile, RtlAppendUnicodeStringToString, RtlAppendUnicodeToString, NtWaitForSingleObject, NtQueryDirectoryFile, NtDeleteFile, NtSetInformationProcess, RtlUnhandledExceptionFilter, NtSetEvent, RtlGetAce, RtlQueryInformationAcl, RtlGetDaclSecurityDescriptor, RtlAllocateHeap, RtlCreateSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlConvertSharedToExclusive, RtlConvertExclusiveToShared, RtlRegisterWait, RtlGetNtProductType, RtlEqualUnicodeString, RtlLengthSid, RtlCopySid, RtlUnicodeStringToAnsiString, RtlInitAnsiString, RtlAnsiStringToUnicodeString, RtlNewSecurityObject, RtlAddAce, RtlSetOwnerSecurityDescriptor, RtlSetGroupSecurityDescriptor, RtlSetSaclSecurityDescriptor, RtlSubAuthorityCountSid, NtOpenDirectoryObject, NtQueryDirectoryObject, RtlCompareUnicodeString, NtLoadDriver, NtUnloadDriver, RtlExpandEnvironmentStrings_U, RtlAdjustPrivilege, NtFlushKey, NtOpenFile, RtlDosPathNameToNtPathName_U, NtOpenSymbolicLinkObject, NtQuerySymbolicLinkObject, RtlFreeUnicodeString, RtlAreAllAccessesGranted, NtDeleteObjectAuditAlarm, NtCloseObjectAuditAlarm, RtlQueueWorkItem, RtlCopyLuid, RtlDeregisterWait, RtlReleaseResource, RtlAcquireResourceExclusive, RtlAcquireResourceShared, RtlInitializeResource, RtlDeleteSecurityObject, RtlLockBootStatusData, RtlGetSetBootStatusData, RtlUnlockBootStatusData, NtInitializeRegistry, NtQueryKey, NtClose, RtlInitUnicodeString, NtSetSystemEnvironmentValue, RtlNtStatusToDosError, NtShutdownSystem, RtlSetSecurityObject, RtlMakeSelfRelativeSD, RtlInitializeSid, RtlLengthRequiredSid, RtlSubAuthoritySid, NtSetSecurityObject<br>> USERENV.dll: UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW, DestroyEnvironmentBlock<br>> SCESRV.dll: ScesrvInitializeServer, ScesrvTerminateServer<br>> umpnpmgr.dll: RegisterScmCallback, PNP_SetActiveService, PNP_GetDeviceRegProp, PNP_GetDeviceListSize, PNP_GetDeviceList, PNP_HwProfFlags, RegisterServiceNotification, DeleteServicePlugPlayRegKeys<br>> NCObjAPI.DLL: WmiSetAndCommitObject, WmiEventSourceConnect, WmiCreateObjectWithFormat<br><br>( 0 exports ) <br>

 

je te renouvelle mes remerciements pour ton aide

[Apollo]

Bonjour,

 

As-tu appliqué l'opération de neutralisation des objets infectés après l'analyse MBAM? Le rapport dit que non.

EDIT: regarde dans la quarantaine si les infections s'y trouvent.

 

Si tu ne l'as pas fait, refais une analyse rapide avec MBAM et poste le rapport après la neutralisation des vermines

 

Effectivement il y a quelques belles bébêtes.

 

Dois-je te dire que l'emploi de cracks et de Keygen et autres P2P sont des distributeurs gratuits de malwares?

 

N'y vois aucune morale de ma part mais je me dois faire ce travail d'information.

 

@+ tard.

Modifié le 23 juillet 2008 par Apollo.01

[baret]

merci de ta réponse rapide

je n'avais pas pris le log le plus récent le voilà :

Malwarebytes' Anti-Malware 1.22

Version de la base de données: 979

Windows 5.1.2600 Service Pack 2

 

00:18:39 23/07/2008

mbam-log-7-23-2008 (00-18-39).txt

 

Type de recherche: Examen complet (C:\|G:\|)

Eléments examinés: 435911

Temps écoulé: 4 hour(s), 32 minute(s), 20 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 2

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 39

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

C:\Documents and Settings\Gilles\Mes documents\ALPluginIE-1.0.2.2-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Documents and Settings\Gilles\Mes documents\01zoomphoto\ALPluginIE-1.0.2.3-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Documents and Settings\Gilles\Mes documents\01zoomphoto\everest ultimate3-0-1\Ultimate-kg.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Gilles\Mes documents\everest 06\everest_ultimate_edition\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Gilles\Mes documents\Maj souris génius\3b.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Program Files\Wanadoo\gr\ALPluginIE-1.0.1.6-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Program Files\Wanadoo\gr\ALPluginIE-1.0.1.9-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Program Files\Wanadoo\gr\ALPluginIE-1.0.2.1-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Program Files\Wanadoo\gr\ALPluginIE-1.0.2.3-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Program Files\Wanadoo\gr\File_6[1].09\File lock 6.09\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Program Files\Wanadoo\gr\Greece[1].Aquarium.3D.Incl.Keygen\KeyGen [ Greece Aquarium 3D Screensaver ].exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Program Files\Wanadoo\gr\Keygen Nero 6\Keygen.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\WinRAR\Unipatch.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\Document Gilles 12-06-06\everest 06\everest_ultimate_edition\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\fichier à detruire si ok\Document Gilles 12-06-06\ALPluginIE-1.0.2.2-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

G:\gr\ALPluginIE-1.0.1.6-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

G:\gr\ALPluginIE-1.0.1.9-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

G:\gr\ALPluginIE-1.0.2.1-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

G:\gr\ALPluginIE-1.0.2.3-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

G:\gr\File_6[1].09\File lock 6.09\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\gr\Greece[1].Aquarium.3D.Incl.Keygen\KeyGen [ Greece Aquarium 3D Screensaver ].exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\gr\Générateur de clés\Générateur de clés\générateur de clé\MS_Windows_XP_SP_2_And_Office_KeyGen.exe (Malware.Tool) -> Quarantined and deleted successfully.

G:\gr\Générateur de clés\Générateur de clés\générateur de clé\XP SP1 Keychanger SP2 Keygen and Product Key Viewer\MS Windows XP SP 2 And Office KeyGen.exe (Malware.Tool) -> Quarantined and deleted successfully.

G:\gr\Keygen Nero 6\Keygen.exe (Trojan.Agent) -> Quarantined and deleted successfully.

G:\guillaume\NFSU Most Wanted fr\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\Portable Gilles aout 2006\téléchargement\ALPluginIE-1.0.2.1-setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

G:\programmes\001downloadaccelerator\quarkx keygen\Quark_Xpress_7_Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\programmes\anydvd\anydvd 6.1.2.5\AnyDVD v6.1.2.5_Fr_by_narvallo_76\a6125\Patch\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\programmes\CloneDVD\CloneDVD\CloneDVD2Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\programmes\Everest\everest 3.50.761\EU 3.x - KeyGen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\programmes\flashget\Le_t_l_chargeur\FlashGet 1.73\FG 1.73\keygen\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\programmes\genuine\Pack.Validation.WGA.Definitif-JiGWaReZ\Windows XP Keygen.exe (Malware.Tool) -> Quarantined and deleted successfully.

G:\programmes\kitwz\KdwbyDr.Jn\Kit du warezien\Gravure.Image\nerosoftware\Keygen\Nero.Burning.ROM.7.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\programmes\Nero\nero lite 7.5.9.0\nero7.5.9.0_fra_lite\keygen2.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\programmes\QuarkXPress\Quark XPress Passport v7.0\Keygen\Quark_Xpress_7_Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\programmes\QuarkXPress\QuarkXPress 7.0+ keygen\serial + keygen\serial + keygen\PARADOX\Quark_Xpress_7_Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\programmes\Sony Vegas\vegas7.0d Fr+Keygen\Keygen\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

G:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP427\A0061941.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.

G:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP427\A0061953.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

 

merci pour tes recommandations

c'est un peu une erreur de jeunesse que d'aller du coté obscur

mais je crois que d'attraper des bestioles ça calme l'envie de continuer

[Apollo]

Ouaip, ça refroidit légèrement hein...

 

Je réexamine ton log HJT et reviens pour te parler de mises à jours de programmes.

 

@toute.

[Apollo]

Désactive le teatimer de Spybot en passant par les options de Spybot: une fois dans le logiciel, il faut aller dans le menu "Mode" => coche "Mode avancé" => "Outils"(en bas de page)=> "Résident" => et tu décoches cette case: "Résident Teatimer" . Tu ne dois plus voir l'icône du Teatimer dans la barre de tâches!

Ne fais pas l'impasse sur cette étape, car ca peut faire échouer la procédure de désinfection !

 

Relance Hijackthis "do a system scan only" et coche les cases devant ces lignes:

 

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start

04- HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe

04- HKLM\..\Run: [adobe reader speed launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)

 

Ferme tous les programmes ouverts et clique sur Fix Checked.

 

Réactive le Tea Timer si tu l'estimes nécessaire.

 

Désinstalle complètement Adobe Reader 8.xx et remplace la par la version 9 que tu trouveras ici:

http://www.adobe.com/fr/products/acrobat/readstep2.html --> décoche la barre Google. Celle-ci n'est pas infectieuse mais c'est une habitude à prendre de ne pas télécharger tout ce qui est proposé avec certains programmes...

Ceci dit tu as aussi le choix d'installer un programme identique mais beaucoup plus léger qu'Adobe Reader: Foxit Reader: http://www.foxitsoftware.com/downloads/ Le langage français est disponible dans les mises à jour depuis l'interface du programme.

 

@++