probléme de pc merci apollo

[tesnim]

bonjour?

je veux interpretter le rapport hijacks this et je demande de conseils je suspects un probléme mais je peux pas l'identifier

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:17:16, on 12/02/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\IdiomaX\Translation Suite 4.0\TrasWord.exe

C:\Program Files\IdiomaX\Translation Suite 4.0\TrdLaunch.exe

C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\wuauclt.exe

C:\PROGRA~1\Systran\4_0\Premium\SYSTRA~1.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\infonet-services\Local Settings\Temporary Internet Files\Content.IE5\T3FPV1BC\IE7-WindowsXP-x86-fra[1].exe

d:\57466bb0dfd30ee37238213cd6f26388\update\iesetup.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\mrt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.HP.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = Mecafilter-2007

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Barre de Traduction IdiomaX - {477A7A3C-8B11-4B02-ADD1-7A01C4D00FA2} - C:\Program Files\Fichiers communs\IdiomaX Shared\Cat 6.0\TrdIEAddIn.dll

O3 - Toolbar: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [idiomaX Office] C:\Program Files\IdiomaX\Translation Suite 4.0\IdxOffice.exe

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

O4 - Global Startup: Assistant de traduction IdiomaX.lnk = C:\Program Files\IdiomaX\Translation Suite 4.0\TrasWord.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Traducteur du Courrier électronique.lnk = C:\Program Files\IdiomaX\Translation Suite 4.0\TrdLaunch.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Montrer/Cacher la Barre de Traduction - {FE768A8F-9F88-4511-B28B-552ED2F6B500} - C:\Program Files\Fichiers communs\IdiomaX Shared\Cat 6.0\TrdIEAddIn.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=26688

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p...obat/nos/gp.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/...ash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: 3AB296C5 - Unknown owner - C:\WINDOWS\system32\2FBC303.EXE (file missing)

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: hpdj3600 - Unknown owner - C:\DOCUME~1\INFONE~1\LOCALS~1\Temp\hpdj3600.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

 

--

End of file - 10658 bytes

Modifié le 23 février 2009 par tesnim

[Apollo]

Le problème qui est visible comme le nez au milieu de la figure est que tu as deux antivirus; donc ça crée des conflits.

 

De plus, ce sont deux nullités notoires; je te conseille de les virer et de remplacer par Antivir.

 

Pour Avast! tu dois désactiver le bouclier résident ou faire la manip en mode sans échec:

 

 

 

Nettoyeur pour Avast!

 

http://www.avast.com/fre/avast-uninstall-utility.html

 

Symantec/Norton

 

Remover Norton

 

**********************

Tutos:

 

http://www.vista-xp.fr/forum/topic227.html

 

http://www.libellules.ch/tuto_antivir.php

 

Procédure:

 

Télécharger l'exécutable d'Antivir.

 

Antivir version française

 

Page de téléchargements Avira

 

 

Désinstaller Avast par Ajouter/Supprimer des programmes.

 

En cas de problème de désinstallation: http://www.avast.com/fre/avast-uninstall-utility.html

 

Installer Antivir et le configurer comme expliqué dans le tutoriel. (Ne pas oublier de cocher la case de recherche de Rootkits -> très important).

Fais un clic droit sur l'icône d'Antivir dans la barre des tâches et choisis Configure Antivir

Dans la fenêtre, coche la case Expert Mode

Juste en dessous, clique sur le menu Scanner

Sur le panneau de droite, coche la case Recherche de Rootkits au démarrage de la recherche.

 

 

 

Fais les mises à jour.

 

Lancer une analyse complète de l'ordinateur.

 

Poster le rapport ici svp. (Le rapport apparait à la fin de l'analyse: le copier/coller ici)

 

 

@++

[tesnim]

bonsoir, voici le rapport de l'analyse du antivir mais j'arrive pas à faire la mise à jour

 

 

Avira AntiVir Personal

Report file date: jeudi 12 février 2009 19:47

 

Scanning for 1038808 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 3) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: INFONET

 

Version information:

BUILD.DAT : 8.2.0.337 16934 Bytes 20/11/29 13:05:00

AVSCAN.EXE : 8.1.4.10 315649 Bytes 20/11/29 08:21:26

AVSCAN.DLL : 8.1.4.0 40705 Bytes 21/05/29 07:56:40

LUKE.DLL : 8.1.4.5 164097 Bytes 08/06/29 12:44:19

LUKERES.DLL : 8.1.4.0 12033 Bytes 21/05/29 07:58:52

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/29 11:30:36

ANTIVIR1.VDF : 7.1.0.56 411136 Bytes 11/11/29 16:57:13

ANTIVIR2.VDF : 7.1.0.89 221184 Bytes 18/11/29 16:16:47

ANTIVIR3.VDF : 7.1.0.97 45056 Bytes 19/11/29 16:38:59

Engineversion : 8.2.0.31

AEVDF.DLL : 8.1.0.6 102772 Bytes 14/10/29 10:05:56

AESCRIPT.DLL : 8.1.1.15 332156 Bytes 13/11/29 14:00:07

AESCN.DLL : 8.1.1.5 123251 Bytes 09/11/29 15:06:41

AERDL.DLL : 8.1.1.3 438645 Bytes 06/11/29 13:58:38

AEPACK.DLL : 8.1.3.4 393591 Bytes 13/11/29 09:41:39

AEOFFICE.DLL : 8.1.0.30 196986 Bytes 09/11/29 15:06:41

AEHEUR.DLL : 8.1.0.71 1487222 Bytes 09/11/29 15:06:41

AEHELP.DLL : 8.1.1.3 119157 Bytes 09/11/29 15:06:41

AEGEN.DLL : 8.1.1.0 319859 Bytes 09/11/29 15:06:41

AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/29 10:05:56

AECORE.DLL : 8.1.4.1 172405 Bytes 09/11/29 15:06:41

AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/29 10:05:56

AVWINLL.DLL : 1.0.0.12 15105 Bytes 06/07/29 08:40:05

AVPREF.DLL : 8.0.2.0 38657 Bytes 11/05/29 09:28:01

AVREP.DLL : 8.0.0.2 98344 Bytes 28/07/29 12:02:15

AVREG.DLL : 8.0.0.1 33537 Bytes 04/05/29 11:26:40

AVARKT.DLL : 1.0.0.23 307457 Bytes 05/02/29 08:29:23

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 08/06/29 12:27:49

SQLITE3.DLL : 3.3.17.1 339968 Bytes 14/01/29 17:28:02

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 08/06/29 12:49:40

NETNT.DLL : 8.0.0.1 7937 Bytes 17/01/29 12:05:10

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 08/06/29 13:48:07

RCTEXT.DLL : 8.0.52.0 86273 Bytes 23/06/29 13:34:37

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, D:, E:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: jeudi 12 février 2009 19:47

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'iexplore.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'SPUVolumeWatcher.exe' - '1' Module(s) have been scanned

Scan process 'TrdLaunch.exe' - '1' Module(s) have been scanned

Scan process 'TrasWord.exe' - '1' Module(s) have been scanned

Scan process 'msmsgs.exe' - '1' Module(s) have been scanned

Scan process 'SuperCopier2.exe' - '1' Module(s) have been scanned

Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'igfxpers.exe' - '1' Module(s) have been scanned

Scan process 'hkcmd.exe' - '1' Module(s) have been scanned

Scan process 'igfxtray.exe' - '1' Module(s) have been scanned

Scan process 'hpotdd01.exe' - '1' Module(s) have been scanned

Scan process 'hpztsb08.exe' - '1' Module(s) have been scanned

Scan process 'hpwuSchd.exe' - '1' Module(s) have been scanned

Scan process 'winampa.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'MDM.EXE' - '1' Module(s) have been scanned

Scan process 'jqs.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'ashServ.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

38 processes with 38 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

Boot sector 'E:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '73' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

Begin scan in 'D:\'

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{02B96897-1D63-4716-AE62-77B6FB161273}\{2B99B412-A945-49B1-A4A1-0023EE8FFAFB}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{02B96897-1D63-4716-AE62-77B6FB161273}\{2B99B412-A945-49B1-A4A1-0023EE8FFAFB}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49d67962.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{02B96897-1D63-4716-AE62-77B6FB161273}\{36BD124F-12C9-4576-AB36-C8666A26D8C8}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{02B96897-1D63-4716-AE62-77B6FB161273}\{36BD124F-12C9-4576-AB36-C8666A26D8C8}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49ca7a55.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{02B96897-1D63-4716-AE62-77B6FB161273}\{547B027C-FDF1-444A-AEBA-F5AE0B8FA7EA}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{02B96897-1D63-4716-AE62-77B6FB161273}\{547B027C-FDF1-444A-AEBA-F5AE0B8FA7EA}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c87a5e.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{02B96897-1D63-4716-AE62-77B6FB161273}\{BB29FA4C-537D-470E-98C1-BBE334D2D823}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{02B96897-1D63-4716-AE62-77B6FB161273}\{BB29FA4C-537D-470E-98C1-BBE334D2D823}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49d67a8a.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{272D734F-7251-46DA-ACE8-DDE6D9D9B165}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{272D734F-7251-46DA-ACE8-DDE6D9D9B165}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49cb7a82.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{2D608375-C475-49F7-976F-DD8FE6CBC534}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{2D608375-C475-49F7-976F-DD8FE6CBC534}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49d87a86.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{3FB61A42-D84D-4951-8677-4A9B6B4EA5F7}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{3FB61A42-D84D-4951-8677-4A9B6B4EA5F7}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49da7a8a.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{556763FD-CF56-42ED-9B51-9DC4798F9CAB}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{556763FD-CF56-42ED-9B51-9DC4798F9CAB}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c97a93.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{5AA5FB80-E80A-4510-98A1-ABD25E34C338}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{5AA5FB80-E80A-4510-98A1-ABD25E34C338}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49d57a95.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{61B3B98A-62FA-477C-9D2E-EEF11A0C0B4F}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{61B3B98A-62FA-477C-9D2E-EEF11A0C0B4F}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c57a9a.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{83885180-035A-45FF-AB3A-903BB5C0F879}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{83885180-035A-45FF-AB3A-903BB5C0F879}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c77a9f.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{848B2D5B-CE4A-471A-8DD6-C9382CD18A80}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{848B2D5B-CE4A-471A-8DD6-C9382CD18A80}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c87aa3.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{90697A32-C18F-4F7D-B63D-63C0F0EE69A0}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{90697A32-C18F-4F7D-B63D-63C0F0EE69A0}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c47aa7.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{C176F7B1-5FBC-42A8-BCBF-270B7879F13F}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{C176F7B1-5FBC-42A8-BCBF-270B7879F13F}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c57ab5.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{D0DE56D8-D0AF-4DEC-925B-5FA75A88DCC6}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{D0DE56D8-D0AF-4DEC-925B-5FA75A88DCC6}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c47ab9.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{E1193CD5-30BF-4DDB-AF8B-FB383FA0A5BB}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{E1193CD5-30BF-4DDB-AF8B-FB383FA0A5BB}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c57abd.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{E581F2CF-6809-4AD8-BF14-5BFCBA08251C}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{E581F2CF-6809-4AD8-BF14-5BFCBA08251C}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c97ac0.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{F6506381-A8AF-4CC9-BF7B-AE1AF9E8EC86}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{F6506381-A8AF-4CC9-BF7B-AE1AF9E8EC86}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49ca7ac4.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{FAF0C2A3-1ABA-4710-AFA4-31B14DF2E0AD}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{4762BB03-C4A6-42D9-828A-83BD4DB67B3B}\{FAF0C2A3-1ABA-4710-AFA4-31B14DF2E0AD}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49d57ac7.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{792B206C-010F-444D-A5B4-6B881F1AF955}\{09E4E7BA-3B62-4CE4-82B9-2CA1809BB3BC}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{792B206C-010F-444D-A5B4-6B881F1AF955}\{09E4E7BA-3B62-4CE4-82B9-2CA1809BB3BC}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49cd7abd.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{792B206C-010F-444D-A5B4-6B881F1AF955}\{623F152D-4DBB-4D70-B847-186EDD4AA6C4}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{792B206C-010F-444D-A5B4-6B881F1AF955}\{623F152D-4DBB-4D70-B847-186EDD4AA6C4}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c67ac8.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{792B206C-010F-444D-A5B4-6B881F1AF955}\{B349337C-9B21-4ABA-88F2-AEE4E62CDD50}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{792B206C-010F-444D-A5B4-6B881F1AF955}\{B349337C-9B21-4ABA-88F2-AEE4E62CDD50}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c77ad9.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{517F817F-DBAD-456A-964B-A81E43DC37B7}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{517F817F-DBAD-456A-964B-A81E43DC37B7}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c57ad4.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{763BC1C4-617B-4629-8EB7-075C7E812BFA}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{763BC1C4-617B-4629-8EB7-075C7E812BFA}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49ca7ad9.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{9D069C01-4895-4B38-92D6-BF95473EF626}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{9D069C01-4895-4B38-92D6-BF95473EF626}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49d87adf.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{9FB4CE36-B662-4B6A-AD68-53C9C42E11D7}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{9FB4CE36-B662-4B6A-AD68-53C9C42E11D7}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49da7ae3.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{BFC559AA-7CC1-49D2-98C0-2FEBD5FC26C8}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{BFC559AA-7CC1-49D2-98C0-2FEBD5FC26C8}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49da7af3.qua'!

D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{F51E6FD3-14A4-40B1-B294-D3A50F7DDC78}.qbd

[0] Archive type: HIDDEN

--> FIL\\\?\D:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\{C804420B-E614-418A-9720-2F4F39ADE877}\{F51E6FD3-14A4-40B1-B294-D3A50F7DDC78}.qbd

[DETECTION] Contains recognition pattern of the W32/Sohanad.R Windows virus

[NOTE] The file was moved to '49c97afb.qua'!

Begin scan in 'E:\'

 

 

End of the scan: jeudi 12 février 2009 20:40

Used time: 53:13 Minute(s)

 

The scan has been done completely.

 

4073 Scanning directories

245624 Files were scanned

28 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

28 files were moved to quarantine

0 files were renamed

1 Files cannot be scanned

245595 Files not concerned

1365 Archives were scanned

1 Warnings

28 Notes

[tesnim]

Bonjour, je suis inquiéte sur l'état de mon ordi voici le raport Hijack this aprés installation d'antivi

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:21:57, on 13/02/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\Explorer.EXE

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\IdiomaX\Translation Suite 4.0\TrasWord.exe

C:\Program Files\IdiomaX\Translation Suite 4.0\TrdLaunch.exe

C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

c:\program files\avira\antivir personaledition classic\avcenter.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.HP.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = Mecafilter-2007

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Barre de Traduction IdiomaX - {477A7A3C-8B11-4B02-ADD1-7A01C4D00FA2} - C:\Program Files\Fichiers communs\IdiomaX Shared\Cat 6.0\TrdIEAddIn.dll

O3 - Toolbar: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [idiomaX Office] C:\Program Files\IdiomaX\Translation Suite 4.0\IdxOffice.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

O4 - Global Startup: Assistant de traduction IdiomaX.lnk = C:\Program Files\IdiomaX\Translation Suite 4.0\TrasWord.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Traducteur du Courrier électronique.lnk = C:\Program Files\IdiomaX\Translation Suite 4.0\TrdLaunch.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Montrer/Cacher la Barre de Traduction - {FE768A8F-9F88-4511-B28B-552ED2F6B500} - C:\Program Files\Fichiers communs\IdiomaX Shared\Cat 6.0\TrdIEAddIn.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=26688

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p...obat/nos/gp.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/...ash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: 3AB296C5 - Unknown owner - C:\WINDOWS\system32\2FBC303.EXE (file missing)

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: hpdj3600 - Unknown owner - C:\DOCUME~1\INFONE~1\LOCALS~1\Temp\hpdj3600.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

 

--

End of file - 9579 bytes

[Thanos]

salut tesnim,

 

Tu as déjà posté un topic ici >> http://forum.zebulon.fr/probleme-de-pc-t159107.html

stp: n'ouvre pas d'autre discussion pour le même problème

Je vois que tu a posté le rapport d'Antivir ici >> http://forum.zebulon.fr/rapport-de-l-analy...ir-t159118.html

ça complique les choses pour Apollo car il faut jongler sur plusieurs posts pour trouver les infos!

 

Pour répondre, utilise le bouton "Répondre" qui se trouve entre "Flash" et "Nouveau" en bas de page stp.

Cette discussion sera close et un Modérateur regroupera les infos sur le premier post je pense

 

Edit: Merci @ Gof pour le split message à supprimer!

Modifié le 13 février 2009 par Thanos

[tesnim]

Bonsoir,

Aprés l'installation du antivir qu'est ce que je peux faire encore pour protéger mon ordinnateur?

[Apollo]

Bonsoir, salut Thanos

 

Pour les mises à jour, ce doit être un problème de serveurs surchargés; réessaie plus tard.

 

Ou fais comme ceci

 

Il a viré pas mal de saletés (28!)

 

Pour protéger mieux ton pc:

Kerio

http://www.vista-xp.fr/forum/post80.html#80

 

Puis fais ceci stp:

 

Télécharge Malwarebytes' Anti-Malware (MBAM)

 

Si le lien ne fonctionne pas, télécharger ICI

 

 

Ce logiciel est à garder, il rendra encore de grands services!

 

En cas de problème de mise à jour:

 

Télécharger mises à jour MBAM

Mises à jour + récentes pour MBAM

 

 

Exécute le fichier après l'installation de MBAM

 

Connecter les supports amovibles (clés usb etc.) avant de lancer l'analyse.

 

• Double clique sur le fichier téléchargé pour lancer le processus d'installation.
  
• Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
  
• Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
  
• Sélectionne "Exécuter un examen complet"
  
• Clique sur "Rechercher"
  
• L'analyse démarre, le scan est relativement long, c'est normal.
  
• A la fin de l'analyse, un message s'affiche :

  L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.

  Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
  
• Ferme tes navigateurs.
  
• Si des malwares ont été détectés, clique sur Afficher les résultats.
  Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
  
• MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.
  

Si MBAM demande à être redémarré, redémarre le pc.

 

Poste un nouveau log Hijackthis après le redémarrage de la machine stp.

 

@++

[tesnim]

[bonsoir, merci pour votre aide , j'ai suivie tout les étapes et voici les rapports

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:07:15, on 14/02/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe

C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\IdiomaX\Translation Suite 4.0\TrasWord.exe

C:\Program Files\IdiomaX\Translation Suite 4.0\TrdLaunch.exe

C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe

C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.HP.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = Mecafilter-2007

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Barre de Traduction IdiomaX - {477A7A3C-8B11-4B02-ADD1-7A01C4D00FA2} - C:\Program Files\Fichiers communs\IdiomaX Shared\Cat 6.0\TrdIEAddIn.dll

O3 - Toolbar: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [idiomaX Office] C:\Program Files\IdiomaX\Translation Suite 4.0\IdxOffice.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe

O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

O4 - Global Startup: Assistant de traduction IdiomaX.lnk = C:\Program Files\IdiomaX\Translation Suite 4.0\TrasWord.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Traducteur du Courrier électronique.lnk = C:\Program Files\IdiomaX\Translation Suite 4.0\TrdLaunch.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Montrer/Cacher la Barre de Traduction - {FE768A8F-9F88-4511-B28B-552ED2F6B500} - C:\Program Files\Fichiers communs\IdiomaX Shared\Cat 6.0\TrdIEAddIn.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=26688

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p...obat/nos/gp.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/...ash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: 3AB296C5 - Unknown owner - C:\WINDOWS\system32\2FBC303.EXE (file missing)

O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: hpdj3600 - Unknown owner - C:\DOCUME~1\INFONE~1\LOCALS~1\Temp\hpdj3600.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe

 

--

End of file - 10118 bytes

et le rapport du Malwar

Malwarebytes' Anti-Malware 1.34

Version de la base de données: 1760

Windows 5.1.2600 Service Pack 3

 

14/02/2009 00:03:50

mbam-log-2009-02-14 (00-03-50).txt

 

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|)

Eléments examinés: 111612

Temps écoulé: 34 minute(s), 4 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

(Aucun élément nuisible détecté)

alors aprés tout ca qu'est ce que je peux faire encore ?

[Apollo]

Re,

 

Remplace Adobe Reader ou Acrobat par Foxit Reader

 

Attention: décocher la case proposant Ask Toolbar, c'est un malware!

 

Le langage français est disponible dans l'interface du logiciel.

 

 

Mets également le Flash Player à jour.

 

NB:: Pense à décocher les cases proposant la toolbar Google.

 

 

Ta console Java n'est pas à jour; pour corriger cela, va chez Java Sun et télécharge la dernière version. Installe-la de suite.

 

En cas de problèmes chez Sun, tu peux aller télécharger la dernière version chez File Hippo

 

*** Utilise ensuite ceci: crée un nouveau dossier sur le bureau ou dans "mes documents"; nomme-le JavaRa.

 

Enregistre ce fichier compressé (zip) dans le dossier nouvellement créé : http://raproducts.org/click/click.php?id=1

 

Patiente le temps de téléchargement.

 

Clic droit/extraire ici.

 

Double clique sur l'icône "soleil" et n'utilise que le bouton "Remove Older Versions".

--> Pour Vista: clic droit/exécuter en temps qu'administrateur <--

 

Ca va virer les versions obsolètes et libérer de l'espace disque.

 

Poste le rapport sauvé sur le C:\ stp. (ou dans le dossier JavaRa)

 

 

Après ça tu pourras faire un nouveau log et aller demander une optimisation sur le forum Sécurité/optimisation.

 

Le pc semble clean.

 

Vérification après les mises à jour ci-dessus:

 

Fais un scan en ligne avec Kaspersky.

 

TUTO: http://www.vista-xp.fr/forum/topic109.html

 

• Fais un scan en ligne Kaspersky
  
• Clique sur Accept
  
• Patiente le temps d'installation du Webscanner.
  
• Les bases de mises à jour vont s'installer, patiente un moment
  
• Clique sur Next.
  
• Clique sur My Computer, le scan se met en route; attends la fin du scan sans fermer la fenêtre sinon il s'arrêtera.
  

 

A la fin du scan, si des objets infectés sont découverts, clique sur Save report as... Choisis bureau et nomme le rapport "rapport Kaspersky" et dans le champ d'enregistrement, choisis "fichiers texte" enregistre alors le rapport.

 

Copie/colle l'entièreté du fichier texte ouvert, par clic droit dessus, sélectionner tout/copier.

 

Colle ce rapport dans ta réponse sur le forum.

 

Il faudra virer les outils quand tu n'auras plus besoin de Hijackthis:

 

Pour désinstaller les outils utilisés:

 

Télécharger ToolsCleaner! de A.Rothstein pour enlever les programmes utilisés pendant la procédure.

http://pc-system.fr/TC/ToolsCleaner2.exe

* Enregistrer ToolsCleaner2.exe sur le Bureau.

Sous Vista,Clic-droit > Exécuter en tant qu' Administrateur

* Double-cliquer dessus, puis cliquer sur Recherche --> Le programme va chercher les utilitaires installés

------> Il se peut que la fenêtre devienne blanche pendant le scan, c'est normal !

* Copier-coller le contenu du rapport qui apparait dans la fenêtre blanche.

 

Lorsque la recherche est terminée ToolsCleaner affiche une liste des différents outils trouvés, cliquez sur "Suppression" afin de les supprimer.

Fermez le programme en cliquant sur "Quitter ".

 

Postez le rapport qui se trouve ici >>> C:\TCleaner.txt

 

Fais tout ça dans l'ordre, plus rien ne presse

 

@++

[tesnim]

bonjour, j'arive pas à installer ou mettre à jour flashplayer je suis arreter à cette étape