Gameztar publicité - rapport Hijack This

[benramon]

bonsoir,

 

je me suis choppé quelques pub ! la principale est gameztar ou alor des fenetres pour des jeux vidéos ou autres ..

 

 

voila le rapport Hijack this

 

 

merci d'avance !

 

 

 

 

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 0:21:33, on 24/12/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18349)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Synaptics\SynTP\SynTPStart.exe

C:\Program Files\Launch Manager\HotkeyApp.exe

C:\Program Files\Launch Manager\WisKeyState.exe

C:\Program Files\Launch Manager\OSD.exe

C:\Program Files\Launch Manager\OSDCtrl.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\pdfforge Toolbar\SearchSettings.exe

C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\System32\mobsync.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

C:\Program Files\HijackThis\HijackThis.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\conime.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll

O1 - Hosts: ::1 localhost

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Automated Content Enhancer - {1D74E9DD-8987-448b-B2CB-67FFF2B8A932} - C:\Program Files\Automated Content Enhancer\4.1.0.5260\ACEIEAddOn.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Content Management Wizard - {B72681C0-A222-4b21-A0E2-53A5A5CA3D41} - C:\Program Files\Content Management Wizard\1.1.0.1990\CMWIE.dll

O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll

O2 - BHO: Textual Content Provider - {CAC89FF9-34A9-4431-8CFE-292A47F843BC} - C:\Program Files\Textual Content Provider\1.1.0.1810\TCPIE.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll

O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll

O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [startCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [synTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe

O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"

O4 - HKLM\..\Run: [WisKeyState] "C:\Program Files\Launch Manager\WisKeyState.exe"

O4 - HKLM\..\Run: [LMgrVolOSD] "C:\Program Files\Launch Manager\OSD.exe"

O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [FSCRecovery] c:\Program Files\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe

O4 - HKLM\..\Run: [NPCTray] C:\Program Files\Norman\npc\bin\npc_tray.exe /LOAD

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [searchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"

O4 - HKLM\..\Run: [bitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [internet Today Task] "C:\Program Files\Internet Today\1.1.0.1260\InternetToday.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Policies\Explorer\Run: [Windows Printing Driver] doskeys.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.4.1.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Service Google Update (gupdate1c9bf93b7a18579) (gupdate1c9bf93b7a18579) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

O23 - Service: lxbl_device - - C:\Windows\system32\lxblcoms.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: Norman NJeeves - Unknown owner - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE (file missing)

O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe

 

--

End of file - 10026 bytes

[Apollo]

Bonsoir,

 

 

1) Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

 

Ou ici: http://eric71.geekstogo.com/tools/ToolBarSD.exe

 

• Lance l'installation du programme en exécutant le fichier téléchargé.
  
• Double-clique sur le raccourci de Toolbar-S&D.
  
• --> Sous VISTA: clic droit Exécuter en temps qu'administrateur.
  
• Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
  
• Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
  Poste le rapport généré. (C:\TB.txt)
  

 

--------------------------------------------------------------

2) Relance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée".

 

--> Sous VISTA: clic droit Exécuter en temps qu'administrateur.

Ne ferme pas la fenêtre lors de la suppression !

Un rapport sera généré, poste son contenu dans ta réponse.

 

NB: Si ton Bureau ne réapparaissait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.

Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."

Tape explorer puis valide.

 

--------------------------

3) Télécharger ATF Cleaner par Atribune.

• Installe-le sur le bureau. (A conserver car très utile après chaque séance de surf)
   
  Double-clique ATF-Cleaner.exe afin de lancer le programme.
  --> Sous Vista/Seven: Clic droit/exécuter en temps qu'administrateur.
   
  Sous l'onglet Main, choisis : Select All
  Cliquer sur le bouton Empty Selected
  

Si tu utilises le navigateur Firefox :

• Clique Firefox au haut et choisis : Select All
  Cliquer le bouton Empty Selected
  NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.
  

Si tu utilises le navigateur Opera :

• Clique Opera au haut et choisis : Select All
  Cliquer le bouton Empty Selected
  NOTE : Si tu veux conserver tes mots de passe sauvegardés, cliquer No à l'invite.
  

Clique Exit, du menu principal, afin de fermer le programme.

Pour obtenir du Support technique, double-clique l'adresse électronique située au bas de chacun des menus.

 

-------------------------------

4) Télécharge Malwarebytes' Anti-Malware (MBAM)

 

Ce logiciel est à garder.

 

Uniquement en cas de problème de mise à jour:

 

Télécharger mises à jour MBAM

 

Exécute le fichier après l'installation de MBAM

 

Connecter les supports amovibles (clés usb etc.) avant de lancer l'analyse.

 

• Double clique sur le fichier téléchargé pour lancer le processus d'installation.
  
• Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
  
• Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
  
• Sélectionne "Exécuter un examen complet"
  
• Clique sur "Rechercher"
  
• L'analyse démarre, le scan est relativement long, c'est normal.
  
• A la fin de l'analyse, un message s'affiche :

  L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.

  Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
  
• Ferme tes navigateurs.
  
• Si des malwares ont été détectés, clique sur Afficher les résultats.
  Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
  
• MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.
  

Si MBAM demande à redémarrer le pc, fais-le.

 

!!! Ne pas vider la quarantaine de MBAM sans avis !!! (en cas de faux-positifs toujours possibles.)

 

Poste également un nouveau log Hijackthis stp.

 

@++

[benramon]

merci pour ta reponse rapide

j'ai fait tout ce que tu ma dit

 

voici les differents rapports que tu m'a demandé :

 

RAPPORT TOOLBAR SD

 

 

-----------\\ ToolBar S&D 1.2.9 XP/Vista

 

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1

X86-based PC ( Multiprocessor Free : AMD Turion X2 Ultra Dual-Core Mobile ZM-82 )

BIOS : Ver 1.00PARTTBL

USER : Administrateur ( Administrator )

BOOT : Normal boot

Antivirus : Norman Security Suite ver. 7.00 7.00 (Not Activated)

C:\ (Local Disk) - NTFS - Total:94 Go (Free:10 Go)

D:\ (Local Disk) - NTFS - Total:195 Go (Free:74 Go)

E:\ (CD or DVD)

F:\ (CD or DVD)

G:\ (USB) - FAT - Total:967 Mo (Free:0 Go)

 

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )

Option : [2] ( jeu. 24/12/2009|21:27 )

 

[ UAC => 1 ]

 

-----------\\ Recherche de Fichiers / Dossiers ...

 

 

-----------\\ [..\Internet Explorer\Main]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Local Page"="C:\\Windows\\system32\\blank.htm"

"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"'>http://go.microsoft.com/fwlink/?LinkId=54896"'>http://go.microsoft.com/fwlink/?LinkId=54896"

"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"'>http://go.microsoft.com/fwlink/?LinkId=69157"

"Url"="http://go.microsoft.com/fwlink/?LinkId=75720"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.msn.com/"

"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"

"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"

"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

 

 

--------------------\\ Recherche d'autres infections

 

 

Aucune autre infection trouvée !

 

[ UAC => 1 ]

 

 

1 - "C:\ToolBar SD\TB_1.txt" - jeu. 24/12/2009|16:12 - Option : [1]

2 - "C:\ToolBar SD\TB_2.txt" - jeu. 24/12/2009|16:15 - Option : [2]

3 - "C:\ToolBar SD\TB_3.txt" - jeu. 24/12/2009|21:20 - Option : [1]

4 - "C:\ToolBar SD\TB_4.txt" - jeu. 24/12/2009|21:27 - Option : [2]

 

-----------\\ Fin du rapport a 21:27:49,49

 

 

 

 

 

RAPPORT MBAM

 

 

Malwarebytes' Anti-Malware 1.42

Version de la base de données: 3424

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000

 

24/12/2009 20:33:44

mbam-log-2009-12-24 (20-33-43).txt

 

Type de recherche: Examen complet (C:\|D:\|G:\|I:\|)

Eléments examinés: 423046

Temps écoulé: 2 hour(s), 29 minute(s), 38 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 9

Clé(s) du Registre infectée(s): 29

Valeur(s) du Registre infectée(s): 4

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 35

Fichier(s) infecté(s): 90

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

C:\Program Files\Web Search Operator\4.1.0.1990\lri.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Web Search Operator\4.1.0.1990\WSOCommon.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\components\WSOFFAddOn.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\ACECommon.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\lri.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\components\ACEFFAddOn.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\CPACommon.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\lri.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\components\CPAFFAddOn.dll (Adware.Agent) -> Delete on reboot.

 

Clé(s) du Registre infectée(s):

HKEY_CLASSES_ROOT\explorerbar.cmw (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{f5b8c69c-9b45-4a6a-9380-df225c546ae7} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{629cd6c2-e4c5-4554-aeb8-12e4e2cd40ff} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{b72681c0-a222-4b21-a0e2-53a5a5ca3d41} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b72681c0-a222-4b21-a0e2-53a5a5ca3d41} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b72681c0-a222-4b21-a0e2-53a5a5ca3d41} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\explorerbar.cmw.1 (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\explorerbar.tcp (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{2a743834-05f4-4ed4-8a1c-41332b10ac0c} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{1081d532-7de4-40bd-b912-388fa6b27c78} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{cac89ff9-34a9-4431-8cfe-292a47f843bc} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cac89ff9-34a9-4431-8cfe-292a47f843bc} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cac89ff9-34a9-4431-8cfe-292a47f843bc} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\explorerbar.tcp.1 (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{1d74e9dd-8987-448b-b2cb-67fff2b8a932} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{565dd573-549e-4da9-8cd7-6ae3df25339a} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d74e9dd-8987-448b-b2cb-67fff2b8a932} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1d74e9dd-8987-448b-b2cb-67fff2b8a932} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{3de88beb-f271-484a-ba71-01d30f439f0c} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{50ad41d2-b1f0-47cc-9ea7-395355eaeebd} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{8ceb185e-81a5-46d3-bc20-c555d605afbd} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{a72522ba-9ff3-4c83-abc6-9b476728a396} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{c5762628-ae15-4ca6-96c4-b00dd17f3419} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{d062e03e-65ca-49e4-9b15-31938ba98922} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{ac5ab953-ed25-4f9c-87f0-b086b0178ffa} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{42c7c39f-3128-4a17-bdb7-91c46032b5b9} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{eb4a577d-bcad-4b1c-8af2-9a74b8dd3431} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\SOFTWARE\Internet Today (Adware.DoubleD) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{8141440e-08f0-4339-9959-5c31c6a69f23} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{e63605fc-d583-4c81-867f-9457bdb3ea1b} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{e889f097-b0be-471b-89ad-b86b6f04b506} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\internet today task (Adware.Agent) -> Quarantined and deleted successfully.

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

C:\Program Files\Internet Today (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Internet Today\1.1.0.1260 (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator (Adware.Agent) -> Delete on reboot.

C:\Program Files\Web Search Operator\4.1.0.1990 (Adware.Agent) -> Delete on reboot.

C:\Program Files\Web Search Operator\4.1.0.1990\Data (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\FF (Adware.Agent) -> Delete on reboot.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\chrome (Adware.Agent) -> Delete on reboot.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\chrome\content (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\components (Adware.Agent) -> Delete on reboot.

C:\Program Files\Textual Content Provider (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810 (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810\data (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer (Adware.Agent) -> Delete on reboot.

C:\Program Files\Automated Content Enhancer\4.1.0.5260 (Adware.Agent) -> Delete on reboot.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\Data (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF (Adware.Agent) -> Delete on reboot.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\chrome (Adware.Agent) -> Delete on reboot.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\chrome\content (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\components (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer\4.1.0.1850 (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\Data (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\chrome (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\chrome\content (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\components (Adware.Agent) -> Delete on reboot.

C:\Program Files\Content Management Wizard (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Content Management Wizard\1.1.0.1990 (Adware.Agent) -> Quarantined and deleted successfully.

C:\Users\Administrateur\Local Settings\Application Data\Textual Content Provider (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Administrateur\Local Settings\Application Data\Textual Content Provider\1.1.0.1810 (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Administrateur\Local Settings\Application Data\Textual Content Provider\1.1.0.1810\Data (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Administrateur\Local Settings\Application Data\Web Search Operator (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Administrateur\Local Settings\Application Data\Web Search Operator\4.1.0.1990 (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Benji\Local Settings\Application Data\Web Search Operator (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Benji\Local Settings\Application Data\Web Search Operator\4.1.0.1990 (Adware.DoubleD) -> Quarantined and deleted successfully.

 

Fichier(s) infecté(s):

C:\Program Files\Content Management Wizard\1.1.0.1990\CMWIE.dll (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810\TCPIE.dll (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\ACEIEAddOn.dll (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\CPAIEAddOn.dll (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\ACEpx.exe (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\WSOpx.exe (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810\tcppx.exe (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Program Files\Content Management Wizard\1.1.0.1990\cmwpx.exe (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\CPApx.exe (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Benji\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2}\mvbup.exe (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Benji\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2}\productinfo.dll (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Benji\AppData\Local\Temp\nsj7F50.tmp\uninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Users\Benji\Documents\PROGRAMMES\VEGAS 7.0\Sony Vegas 7 + DVD Architect 4 + keygen\DVD Architect 4.0.125\Sony DVD Architect v4.0 Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Users\Benji\Documents\PROGRAMMES\VEGAS 7.0\Sony Vegas 7 + DVD Architect 4 + keygen\Vegas 7.0a\Sony Vegas v7.0a Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

I:\PROGRAMMES\FICHIERS INSTALLATION\VEGAS 7.0\Sony Vegas 7 + DVD Architect 4 + keygen\DVD Architect 4.0.125\Sony DVD Architect v4.0 Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

I:\PROGRAMMES\FICHIERS INSTALLATION\VEGAS 7.0\Sony Vegas 7 + DVD Architect 4 + keygen\Vegas 7.0a\Sony Vegas v7.0a Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

I:\PROGRAMMES\Programmes-Etudiants\MainConcept\MainconceptSonyVegas\Keygen pour ID-Ordi (ne pas generate).exe (Trojan.Downloader) -> Quarantined and deleted successfully.

I:\PROGRAMMES\Programmes-Etudiants\1 sonyvegasv5.0\le + complet keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

I:\PROGRAMMES\Programmes-Etudiants\1 sonyvegasv5.0\Vegas5_Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Program Files\Internet Today\1.1.0.1260\InternetToday.ico (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Internet Today\1.1.0.1260\InternetToday.skf (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Internet Today\1.1.0.1260\mfc80.dll (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Internet Today\1.1.0.1260\Microsoft.VC80.MFC.manifest (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Internet Today\1.1.0.1260\SkinCrafterDll.dll (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Internet Today\1.1.0.1260\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Internet Today\1.1.0.1260\unins000.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\lri.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Web Search Operator\4.1.0.1990\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\unins000.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\WSO.dll (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\WSOCommon.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Web Search Operator\4.1.0.1990\Data\config.md (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\chrome.manifest (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\install.rdf (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\chrome\WSOAddOn.jar (Adware.Agent) -> Delete on reboot.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\chrome\content\WSOAddOn.js (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\chrome\content\WSOAddOn.xul (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\components\WSOFFAddOn.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\components\WSOFFAddOn.xpt (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Web Search Operator\4.1.0.1990\FF\components\WSOFFHelperComponent.js (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810\unins000.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810\data\pxtmpdata.mx (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810\data\TP_Config.mx (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810\data\TP_Data.mx (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810\data\TP_DomainExcludeList.mx (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810\data\TP_DomainInterval.mx (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Textual Content Provider\1.1.0.1810\data\TP_KeywordInterval.mx (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\ACECommon.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\lri.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\unins000.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\Data\config.md (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\chrome.manifest (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\install.rdf (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\chrome\ACEAddOn.jar (Adware.Agent) -> Delete on reboot.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\chrome\content\ACEAddOn.js (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\chrome\content\ACEAddOn.xul (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\components\ACEFFAddOn.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\components\ACEFFAddOn.xpt (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Automated Content Enhancer\4.1.0.5260\FF\components\ACEFFHelperComponent.js (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\CPACommon.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\lri.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\unins000.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\Data\config.md (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\chrome.manifest (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\install.rdf (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\chrome\CPAAddOn.jar (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\chrome\content\CPAAddOn.js (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\chrome\content\CPAAddOn.xul (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\components\CPAFFAddOn.dll (Adware.Agent) -> Delete on reboot.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\components\CPAFFAddOn.xpt (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Customized Platform Advancer\4.1.0.1850\FF\components\CPAFFHelperComponent.js (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Content Management Wizard\1.1.0.1990\cmwsh.dll (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Content Management Wizard\1.1.0.1990\config.mx (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Content Management Wizard\1.1.0.1990\data.mx (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Content Management Wizard\1.1.0.1990\exclude.mx (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Content Management Wizard\1.1.0.1990\LRI.dll (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Content Management Wizard\1.1.0.1990\MatchingData.zd5 (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Content Management Wizard\1.1.0.1990\pxtmpdata.mx (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Content Management Wizard\1.1.0.1990\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Content Management Wizard\1.1.0.1990\unins000.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Users\Administrateur\Local Settings\Application Data\Textual Content Provider\1.1.0.1810\Data\TP_Config.mx (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Administrateur\Local Settings\Application Data\Textual Content Provider\1.1.0.1810\Data\TP_Data.mx (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Administrateur\Local Settings\Application Data\Textual Content Provider\1.1.0.1810\Data\TP_DomainExcludeList.mx (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Administrateur\Local Settings\Application Data\Textual Content Provider\1.1.0.1810\Data\TP_DomainInterval.mx (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Administrateur\Local Settings\Application Data\Web Search Operator\4.1.0.1990\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Benji\Local Settings\Application Data\Web Search Operator\4.1.0.1990\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.

C:\Users\Benji\Local Settings\Application Data\Web Search Operator\4.1.0.1990\rstatus.md (Adware.DoubleD) -> Quarantined and deleted successfully.

 

 

 

 

 

 

 

 

 

RAPPORT HIJACKTHIS

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:36:49, on 24/12/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18349)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Windows\RtHDVCpl.exe

C:\Program Files\Synaptics\SynTP\SynTPStart.exe

C:\Program Files\Launch Manager\HotkeyApp.exe

c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Launch Manager\WisKeyState.exe

C:\Program Files\Launch Manager\OSD.exe

C:\Program Files\Launch Manager\OSDCtrl.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\System32\mobsync.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe

C:\Windows\System32\wsqmcons.exe

C:\Windows\system32\conime.exe

C:\Program Files\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O1 - Hosts: ::1 localhost

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll

O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [startCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [synTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe

O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"

O4 - HKLM\..\Run: [WisKeyState] "C:\Program Files\Launch Manager\WisKeyState.exe"

O4 - HKLM\..\Run: [LMgrVolOSD] "C:\Program Files\Launch Manager\OSD.exe"

O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [FSCRecovery] c:\Program Files\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe

O4 - HKLM\..\Run: [NPCTray] C:\Program Files\Norman\npc\bin\npc_tray.exe /LOAD

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"

O4 - HKLM\..\Run: [bitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)

O13 - Gopher Prefix:

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.4.1.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Service Google Update (gupdate1c9bf93b7a18579) (gupdate1c9bf93b7a18579) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

O23 - Service: lxbl_device - - C:\Windows\system32\lxblcoms.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: Norman NJeeves - Unknown owner - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE (file missing)

O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe

 

--

End of file - 9049 bytes

 

 

 

 

 

 

 

 

voila en esperant que j'ai fait tout correctement

[Apollo]

Bonjour,

 

Happy XMas

 

Pour moi c'est bon.

Fais les mises à jours nécessaires: http://theknitter-apollo.xooit.com/p17644.htm

 

-------------------

Installe Explorer 8 , beaucoup plus sécurisé qu'IE6 ou IE7, même si Firefox ou un autre navigateur est utilisé.

 

Après installation d'IE8:

 

Pour éviter des problèmes de compatibilité de certains sites web avec IE8, cliquer sur "Page" au-dessus de la page web puis sur Paramètres d'affichage de compatibilité.

 

Cocher la case "Afficher tous les sites web dans Affichage de compatibilité". Fermer.

 

-------------------------

Installer le SP2 pour Vista

 

Que faire si le SP2 refuse de s'installer

 

Bonne journée.

 

@++

[benramon]

un grand merci pour la resolution rapide !

 

tout semple propre !

 

plus de pubs intempestives ni rien !

 

un tres joyeux Noel a toi et a toute l'equipe !

 

a++

[benramon]

mmm c'aurait été trop beau....

 

je viens de voir que la page http://www.byteseeker.com/ vien encore m'emmerder lorsque je lance Mozilla ..

 

comment puis je l'enlever celui la ?

[Apollo]

ESET ONLINE SCANNER

 

Télécharge ESET Online Scanner sur ton Bureau en cliquant sur ce logo:

• Double-clique sur le fichier esetsmartinstaller_enu.exe présent sur ton Bureau pour installer le scanner. Attention: si tu disposes de Windows VISTA, clique droit sur esetsmartinstaller_enu.exe puis sélectionne "exécuter en tant qu'administrateur"
  
• Accepte la licence en cochant la case "YES, i accept the terms of use", puis clique sur le bouton "Start"
  
• Une fois le scanner installé, configure-le en décochant la case "Remove found threats" et en cochant la case "Scan archives"
  
  
• Lance la recherche antivirale en cliquant sur le bouton "Start": l'outil se met à jour puis lance le scan: une barre de progression indique où en est la recherche
  
• Quand le scan est terminé, si des virus ont été détectés, clique sur la ligne "List of found threats":
  
  
• Une nouvelle fenêtre aparaît: clique sur "Export to text file" et enregistre le rapport sur ton Bureau en le nommant logESET.txt
  
• Clique sur le bouton "Back" pour retourner à l'interface précédente, puis coche la case "Uninstall application on close"
  
  
• Clique enfin sur le bouton "Finish" puis ferme la fenêtre du scanner
  
• Ouvre le fichier logESET sur ton Bureau et copie-colle son contenu dans ta prochaine réponse
  

 

Nota : ce scan peut être très long et prendre plusieurs heures.

 

Can: oGu.

[benramon]

voila ce qu'il a trouvé :

 

 

 

C:\Users\Benji\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2}\Setup.exe probably a variant of Win32/Injector.AML trojan

C:\Users\Benji\Documents\PROGRAMMES\Illustrator keygen.zip probably a variant of Win32/Agent trojan

[Apollo]

Bonjour,

 

Télécharge OTM de OldTimer sur ton Bureau en cliquant sur ce lien:

 

OTM

 

Ou ici: http://ottools.noahdfear.net/OTM.exe

 

• Double-clique sur OTM.exe pour le lancer (l'extension .exe peut ne pas apparaître)
   
  ---> sous VISTA: clic droit: exécuter en temps qu'administrateur.
   
  
• Copie l'entièreté du code ci-dessous (depuis :Processes)
  

  :Processes
  
  explorer.exe
  
  :Files
  
  C:\Users\Benji\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2}\Setup.exe 
  C:\Users\Benji\Documents\PROGRAMMES\Illustrator keygen.zip 
  
  :Reg
  
  :Commands
  [purity]
  [emptytemp]
  [reboot]

  
   
  

• Colle ce code dans la partie jaune de OtMoveIt3 intitulée:
  "Paste Instructions for Items to be Moved"
   
  
• Clique sur le bouton Moveit! pour lancer le nettoyage:
   
  
• Copie-colle dans ta prochaine réponse tout ce qui se trouve dans la fenêtre Results
  --> Un rapport sera généré dans le dossier C:\ _OTMoveIt\MovedFiles avec la date et l'heure du passage de l'outil (mmddyyyy_hhmmss.log)
  
• Ferme OTM en cliquant sur Exit:
  

Note : Si un fichier ou un dossier ne peut être supprimé directement, l'outil peut demander un redémarrage pour terminer le processus. Clique alors sur "Yes" pour accepter.

 

*** L'outil va terminer son travail après le redémarrage du pc puis fournira son rapport; copie/colle le dans ta réponse stp.

 

@++

[benramon]

All processes killed

========== PROCESSES ==========

No active process named explorer.exe was found!

========== FILES ==========

File/Folder C:\Users\Benji\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2}\Setup.exe not found.

File/Folder C:\Users\Benji\Documents\PROGRAMMES\Illustrator keygen.zip not found.

========== REGISTRY ==========

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrateur

->Temp folder emptied: 33651 bytes

->Temporary Internet Files folder emptied: 196062 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 0 bytes

->Google Chrome cache emptied: 7392927 bytes

 

User: All Users

 

User: Benji

->Temp folder emptied: 2457598139 bytes

->Temporary Internet Files folder emptied: 221586547 bytes

->Java cache emptied: 44654907 bytes

->FireFox cache emptied: 55337655 bytes

->Google Chrome cache emptied: 819568 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

Windows Temp folder emptied: 2912 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 84420 bytes

%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 743 bytes

RecycleBin emptied: 452096 bytes

 

Total Files Cleaned = 2.659,00 mb

 

 

OTM by OldTimer - Version 3.1.4.0 log created on 12282009_011706

 

Files moved on Reboot...

 

Registry entries deleted on Reboot...