Analyse rapport

veropoupoune · le 20 mars 2009

Bonjour à tous,

J'expérimente depuis quelques temps un ralentissement significatif de mon PC. J'ai commencé par appliquer les recommendations basiques (nettoyage du disque, defrag,..) mais le pb persiste. Je me demande donc si mon PC n'est pas infecté bien que mon antivirus (McAfee) est à jour.

Je poste donc un rapport HijackThis en vous demandant votre aide quand à son interprétation

Par avance, je vous remercie pour votre support.

Bien cordialement,

Véronique

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:17:36, on 19/03/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\Program Files\McAfee\MSK\MskSrver.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe

C:\Program Files\Analog Devices\SoundMAX\SMTray.exe

C:\Program Files\Microsoft Hardware\Mouse\point32.exe

C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe

C:\Program Files\Logitech\QuickCam10\QuickCam10.exe

C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe

C:\Program Files\Microsoft Hardware\Keyboard\type32.exe

C:\Program Files\Fichiers communs\AOL\1154272819\ee\AOLSoftware.exe

C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Logitech\QuickCam10\COCIManager.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\winrar\WinRAR.exe

C:\DOCUME~1\VRONIQ~1\LOCALS~1\Temp\Rar$EX00.187\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mana.pf/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.search.yahoo.com/search?fr=mcafee&p=%s

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: (no name) - {008DB894-99ED-445D-8547-0E7C9808898D} - C:\WINDOWS\mslagent\4b_1,0,1,2_mslagent.dll (file missing)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe

O4 - HKLM\..\Run: [storageGuard] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [statusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto

O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe

O4 - HKLM\..\Run: [POINTER] point32.exe

O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [iPHSend] C:\Program Files\Fichiers communs\AOL\IPHSend\IPHSend.exe

O4 - HKLM\..\Run: [intelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1154272819\ee\AOLSoftware.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [McAfee Backup] "C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} (EGEGAUTH Class) - http://akamai.downloadv3.com/binaries/P2EC..._1022_FR_XP.cab

O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_FR_XP.cab

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/39.20/uploader2.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://fare83.spaces.live.com//PhotoUpload/MsnPUpld.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1108897364750

O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} -

O16 - DPF: {FC9C7D52-C99A-494A-AA79-4A25098F659C} (GVDLoad Control) - http://www.casinoglamour.com/dload/gvdload.cab

O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe

O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe

O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--

End of file - 12033 bytes

Gof · le 20 mars 2009

Bonsoir veropoupoune

Rien d'inquiétant réellement à première vue. Quelques éléments infectieux cependant, et un reste de Norton qui peut occasionner des ralentissements.

Relance un scan HijackThis

Clique sur Do a system scan only et coche les lignes ci-dessous :

O2 - BHO: (no name) - {008DB894-99ED-445D-8547-0E7C9808898D} - C:\WINDOWS\mslagent\4b_1,0,1,2_mslagent.dll (file missing)
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} -

http://akamai.downloadv3.com/binaries/IA/nethv32_FR_XP.cab
O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} (EGEGAUTH Class) - http://akamai.downloadv3.com/binaries/P2EC..._1022_FR_XP.cab
O16 - DPF: {FC9C7D52-C99A-494A-AA79-4A25098F659C} (GVDLoad Control) - http://www.casinoglamour.com/dload/gvdload.cab

Ferme toutes les fenêtres sauf HijackThis et Fix Checked.

Supprime le répertoire suivant : C:\WINDOWS\mslagent

Attention au nom de répertoire, ne te trompe pas.

Télécharge l'utilitaire de désinstallation Norton, et suis les instructions. Tu le trouveras sur le lien suivant : ici.

A l'issue, fais ceci je te prie : Télécharge Malwarebytes' Anti-Malware (MBAM)

Double clique sur le fichier téléchargé pour lancer le processus d'installation.
Dans l'onglet "mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
Branche tes supports amovibles (clés USB, lecteurs MP3, cartes Flash, etc.) sans les ouvrir.
Sélectionne "Exécuter un examen complet"
Clique sur "Rechercher"
L'analyse démarre.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.
Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

A ce rapport, joins un nouveau rapport HijackThis.

A bientôt.

veropoupoune · le 25 mars 2009

Bonsoir Gof !

Merci pour ta réponse.

Je vais m'atteler à la mise en oeuvre de tes préconisations dès que possible (je pense malheureusement plutôt en fin de semaine) et je reviens vers toi avec un nouveau rapport.

A très bientôt et un petit rayon de soleil des tropiques !

Véronique

veropoupoune · le 30 mars 2009

Bonjour Gof,

J'ai donc suivi à la lettre tes recommendations ce week-end. Voici les deux rapports :

- le rapport MBAM après suppression des malwares détectés,

- le nouveau rapport Hijackthis !

Merci encore pour ton support.

Cordialement,

Véronique

________________MBAM______________________

Malwarebytes' Anti-Malware 1.35

Version de la base de données: 1916

Windows 5.1.2600 Service Pack 3

29/03/2009 17:22:20

mbam-log-2009-03-29 (17-22-20).txt

Type de recherche: Examen complet (C:\|D:\|F:\|G:\|)

Eléments examinés: 183362

Temps écoulé: 57 minute(s), 28 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 7

Valeur(s) du Registre infectée(s): 1

Elément(s) de données du Registre infecté(s): 2

Dossier(s) infecté(s): 67

Fichier(s) infecté(s): 50

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

HKEY_CLASSES_ROOT\egauth.egegauth (Adware.EGDAccess) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\egauth.egegauth.1 (Adware.EGDAccess) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\mslagent.3 (Adware.EGDAccess) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\mslagent.3.1 (Adware.EGDAccess) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\navipromo.egnaviscoring (Adware.EGDAccess) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\navipromo.egnaviscoring.1 (Adware.EGDAccess) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/system32/eglivecam_1028.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\eglivecam_1028.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):

C:\Program Files\Instant Access (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\Center (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\Center\Icons (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\DesktopIcons (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\img (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\members (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\h (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\h\sid (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\t (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\t\sid (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ti (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ti\tour0 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ti\tour0\co (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ti\tour0\co\fc (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ti\tour0\co\fc\pi (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\members (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\h (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\h\sid (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\t (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\t\sid (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ti (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ti\tour0 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ti\tour0\co (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ti\tour0\co\fc (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ti\tour0\co\fc\pi (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\Common (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\ExitTraffic (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\img (Adware.EGDAccess) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):

C:\Program Files\Instant Access\Center\.upd (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\Center\InstantAccess.upd (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\Center\KooAccess.upd (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\Center\tray1.ico (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\Center\Icons\KooAccess.lnk (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\DesktopIcons\KooAccess.lnk (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\members\index.htm (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\h\sid\41f9013125263d2c7a88a5edb5bf901f (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\4632771568\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\t\sid\41f9013125263d2c7a88a5edb5bf901f (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\box1.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\box3.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee1.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee10.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee11.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee12.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee13.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee14.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee15.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee16.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee17.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee18.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee19.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee2.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee3.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee4.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee5.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee6.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee7.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee8.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\tawnee9.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\top.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\img\view.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\members\index.htm (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\h\sid\5ff0ddb7cd677c2c48b43cec39519a23 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7645986289\res\34534\pr\rev\ci\ti\tour0\co\fc\jo\join0\pi\front\tt\cf\ln\pt\t\sid\5ff0ddb7cd677c2c48b43cec39519a23 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\Common\hits.php (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\Common\module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\Common\show_module.php (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\ExitTraffic\exit.php (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\img\hits_img.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\img\p2e.ico (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\img\p2e_1_2.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\img\p2e_2_2.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\img\p2e_go_2.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\Instant Access\P2E\7690309565\img\p2e_logo_2.bmp (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Bureau\Instant Access.lnk (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\WINDOWS\tmlpcert2005 (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\eglivecam_1028.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mseggrpid.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.

________________________________HIJACKTHIS_________________________

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:37:02, on 29/03/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\Program Files\McAfee\MSK\MskSrver.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe

C:\Program Files\Analog Devices\SoundMAX\SMTray.exe

C:\Program Files\Microsoft Hardware\Mouse\point32.exe

C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe

C:\Program Files\Logitech\QuickCam10\QuickCam10.exe

C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe

C:\Program Files\Microsoft Hardware\Keyboard\type32.exe

C:\Program Files\Fichiers communs\AOL\1154272819\ee\AOLSoftware.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Logitech\QuickCam10\COCIManager.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\system32\wuauclt.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\winrar\WinRAR.exe

C:\DOCUME~1\VRONIQ~1\LOCALS~1\Temp\Rar$EX00.406\HijackThis.exe