[résolu]un spyware a détruit l'option affichage (résolu)

cjulie91 · le 14 mai 2005

voila le scan log de ad-aware il a trouvé 13 object dont 12 qui sont coolwebsearch et 1 qui s'appelle tracking cookie + 16 negligeable objects MRU list. je l'ai ai supprimer

Ad-Aware SE Build 1.05

Logfile Created on:samedi 14 mai 2005 20:07:40

Created with Ad-Aware SE Personal, free for private use.

Using definitions file:SE1R45 13.05.2005

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

CoolWebSearch(TAC index:10):12 total references

MRU List(TAC index:0):16 total references

Tracking Cookie(TAC index:3):1 total references

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings

===========================

Set : Search for negligible risk entries

Set : Safe mode (always request confirmation)

Set : Scan active processes

Set : Scan registry

Set : Deep-scan registry

Set : Scan my IE Favorites for banned URLs

Set : Scan my Hosts file

Extended Ad-Aware SE Settings

===========================

Set : Unload recognized processes & modules during scan

Set : Scan registry for all users instead of current user only

Set : Always try to unload modules before deletion

Set : During removal, unload Explorer and IE if necessary

Set : Let Windows remove files in use at next reboot

Set : Delete quarantined objects after restoring

Set : Include basic Ad-Aware settings in log file

Set : Include additional Ad-Aware settings in log file

Set : Include reference summary in log file

Set : Include alternate data stream details in log file

Set : Play sound at scan completion if scan locates critical objects

05-14-2005 20:07:40 - Scan started. (Full System Scan)

MRU List Object Recognized!

Location: : C:\Documents and Settings\Julie\recent

Description : list of recently opened documents

MRU List Object Recognized!

Location: : software\microsoft\direct3d\mostrecentapplication

Description : most recent application to use microsoft direct3d

MRU List Object Recognized!

Location: : software\microsoft\direct3d\mostrecentapplication

Description : most recent application to use microsoft direct X

MRU List Object Recognized!

Location: : software\microsoft\directdraw\mostrecentapplication

Description : most recent application to use microsoft directdraw

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\internet explorer

Description : last download directory used in microsoft internet explorer

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\internet explorer\typedurls

Description : list of recently entered addresses in microsoft internet explorer

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\mediaplayer\preferences

Description : last playlist index loaded in microsoft windows media player

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\mediaplayer\preferences

Description : last playlist loaded in microsoft windows media player

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\microsoft management console\recent file list

Description : list of recent snap-ins used in the microsoft management console

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\search assistant\acmru

Description : list of recent search terms used with the search assistant

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\windows\currentversion\applets\regedit

Description : last key accessed using the microsoft registry editor

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru

Description : list of recent programs opened

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru

Description : list of recently saved files, stored according to file extension

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\windows\currentversion\explorer\recentdocs

Description : list of recent documents opened

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\windows\currentversion\explorer\runmru

Description : mru list for items opened in start | run

MRU List Object Recognized!

Location: : S-1-5-21-839522115-1659004503-725345543-1003\software\microsoft\windows media\wmsdk\general

Description : windows media sdk

Listing running processes

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]

FilePath : \SystemRoot\System32\

ProcessID : 548

ThreadCreationTime : 05-14-2005 13:38:13

BasePriority : Normal

#:2 [csrss.exe]

FilePath : \??\C:\WINDOWS\system32\

ProcessID : 632

ThreadCreationTime : 05-14-2005 14:00:03

BasePriority : Normal

#:3 [winlogon.exe]

FilePath : \??\C:\WINDOWS\system32\

ProcessID : 656

ThreadCreationTime : 05-14-2005 14:00:04

BasePriority : High

#:4 [services.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 700

ThreadCreationTime : 05-14-2005 14:00:06

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Système d'exploitation Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Applications Services et Contrôleur

InternalName : services.exe

OriginalFilename : services.exe

#:5 [lsass.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 712

ThreadCreationTime : 05-14-2005 14:00:06

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : LSA Shell (Export Version)

InternalName : lsass.exe

OriginalFilename : lsass.exe

#:6 [svchost.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 896

ThreadCreationTime : 05-14-2005 14:00:10

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:7 [svchost.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 920

ThreadCreationTime : 05-14-2005 14:00:10

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:8 [svchost.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1008

ThreadCreationTime : 05-14-2005 14:00:11

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:9 [svchost.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1032

ThreadCreationTime : 05-14-2005 14:00:12

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:10 [spoolsv.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 1124

ThreadCreationTime : 05-14-2005 14:00:13

BasePriority : Normal

FileVersion : 5.1.2600.0 (XPClient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Spooler SubSystem App

InternalName : spoolsv.exe

OriginalFilename : spoolsv.exe

#:11 [alg.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1280

ThreadCreationTime : 05-14-2005 14:00:14

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Application Layer Gateway Service

InternalName : ALG.exe

OriginalFilename : ALG.exe

#:12 [aswupdsv.exe]

FilePath : C:\Program Files\Alwil Software\Avast4\

ProcessID : 1344

ThreadCreationTime : 05-14-2005 14:00:15

BasePriority : Normal

#:13 [ashserv.exe]

FilePath : C:\Program Files\Alwil Software\Avast4\

ProcessID : 1364

ThreadCreationTime : 05-14-2005 14:00:16

BasePriority : High

FileVersion : 4, 6, 622, 0

ProductVersion : 4, 6, 0, 0

ProductName : avast! Antivirus

FileDescription : avast! antivirus service

InternalName : aswServ

OriginalFilename : aswServ.exe

#:14 [mdm.exe]

FilePath : C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\

ProcessID : 1412

ThreadCreationTime : 05-14-2005 14:00:17

BasePriority : Normal

FileVersion : 7.00.9064.9150

ProductVersion : 7.00.9064.9150

ProductName : Microsoft Development Environment

CompanyName : Microsoft Corporation

FileDescription : Machine Debug Manager

InternalName : mdm.exe

OriginalFilename : mdm.exe

#:15 [nvsvc32.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1440

ThreadCreationTime : 05-14-2005 14:00:17

BasePriority : Normal

FileVersion : 6.14.10.5214

ProductVersion : 6.14.10.5214

ProductName : NVIDIA Driver Helper Service, Version 52.14

CompanyName : NVIDIA Corporation

FileDescription : NVIDIA Driver Helper Service, Version 52.14

InternalName : NVSVC

OriginalFilename : nvsvc32.exe

#:16 [smagent.exe]

FilePath : C:\Program Files\Analog Devices\SoundMAX\

ProcessID : 1472

ThreadCreationTime : 05-14-2005 14:00:18

BasePriority : Normal

FileVersion : 3, 2, 6, 0

ProductVersion : 3, 2, 6, 0

ProductName : SoundMAX service agent

CompanyName : Analog Devices, Inc.

FileDescription : SoundMAX service agent component

InternalName : SMAgent

OriginalFilename : SMAgent.exe

#:17 [wdfmgr.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1508

ThreadCreationTime : 05-14-2005 14:00:18

BasePriority : Normal

FileVersion : 5.2.3790.1230 built by: DNSRV(bld4act)

ProductVersion : 5.2.3790.1230

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Windows User Mode Driver Manager

InternalName : WdfMgr

OriginalFilename : WdfMgr.exe

#:18 [smtray.exe]

FilePath : C:\Program Files\Analog Devices\SoundMAX\

ProcessID : 436

ThreadCreationTime : 05-14-2005 14:00:38

BasePriority : Normal

FileVersion : 3, 2, 17, 0

ProductVersion : 3, 2, 0, 0

ProductName : SoundMAX Integrated Digital Audio

CompanyName : Analog Devices, Inc.

FileDescription : SoundMAX System Tray

InternalName : SMTray

OriginalFilename : SMTray.exe

#:19 [cma.exe]

FilePath : C:\Program Files\desksite\bin\

ProcessID : 500

ThreadCreationTime : 05-14-2005 14:00:42

BasePriority : Normal

FileVersion : 3.00.0042

ProductVersion : 3.00.0042

ProductName : Content Management Agent

CompanyName : DeskSite, Inc.

InternalName : CMA

LegalCopyright : 1999, 2000, 2001

LegalTrademarks : DeskSite, Content Management Agent

OriginalFilename : CMA.exe

#:20 [cnxmon.exe]

FilePath : C:\PROGRA~1\Wanadoo\

ProcessID : 516

ThreadCreationTime : 05-14-2005 14:00:43

BasePriority : Normal

FileVersion : 1, 0, 0, 1

ProductVersion : 1, 0, 0, 1

ProductName : Application CnxMon

FileDescription : Application MFC CnxMon

InternalName : CnxMon

OriginalFilename : CnxMon.EXE

#:21 [dragdiag.exe]

FilePath : C:\Program Files\Thomson\SpeedTouch USB\

ProcessID : 568

ThreadCreationTime : 05-14-2005 14:00:46

BasePriority : Normal

FileVersion : 301.0.0.12

ProductVersion : 301.0.0.12

ProductName : SpeedTouch USB

CompanyName : THOMSON Telecom Belgium

FileDescription : SpeedTouch Statistics

LegalTrademarks : SpeedTouch

#:22 [ashwebsv.exe]

FilePath : C:\Program Files\Alwil Software\Avast4\

ProcessID : 716

ThreadCreationTime : 05-14-2005 14:00:48

BasePriority : Normal

#:23 [taskbaricon.exe]

FilePath : C:\PROGRA~1\Wanadoo\

ProcessID : 880

ThreadCreationTime : 05-14-2005 14:00:48

BasePriority : Normal

#:24 [msnappau.exe]

FilePath : C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\

ProcessID : 1016

ThreadCreationTime : 05-14-2005 14:00:50

BasePriority : Normal

#:25 [gcasserv.exe]

FilePath : C:\Program Files\Microsoft AntiSpyware\

ProcessID : 1076

ThreadCreationTime : 05-14-2005 14:00:52

BasePriority : Idle

FileVersion : 1.00.0509

ProductVersion : 1.00.0509

ProductName : Microsoft AntiSpyware (Beta 1)

CompanyName : Microsoft Corporation

FileDescription : Microsoft AntiSpyware Service

InternalName : gcasServ

LegalTrademarks : Microsoft® and Windows® are registered trademarks of Microsoft Corporation. SpyNet is a trademark of Microsoft Corporation.

OriginalFilename : gcasServ.exe

#:26 [ashdisp.exe]

FilePath : C:\PROGRA~1\ALWILS~1\Avast4\

ProcessID : 1396

ThreadCreationTime : 05-14-2005 14:00:53

BasePriority : Normal

FileVersion : 4, 6, 622, 0

ProductVersion : 4, 6, 0, 0

ProductName : avast! Antivirus

FileDescription : avast! service GUI component

InternalName : aswDisp

OriginalFilename : aswDisp.exe

#:27 [msmsgs.exe]

FilePath : C:\Program Files\Messenger\

ProcessID : 1656

ThreadCreationTime : 05-14-2005 14:00:55

BasePriority : Normal

FileVersion : 4.7.2010

ProductVersion : Version 4.7

ProductName : Messenger

CompanyName : Microsoft Corporation

FileDescription : Messenger

InternalName : msmsgs

LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.

OriginalFilename : msmsgs.exe

#:28 [rundll32.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1588

ThreadCreationTime : 05-14-2005 14:00:55

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Système d'exploitation Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Exécuter une DLL en tant qu'application

InternalName : rundll

OriginalFilename : RUNDLL.EXE

#:29 [cursorxp.exe]

FilePath : C:\Program Files\CursorXP\

ProcessID : 1724

ThreadCreationTime : 05-14-2005 14:00:56

BasePriority : High

#:30 [ashmaisv.exe]

FilePath : C:\Program Files\Alwil Software\Avast4\

ProcessID : 1764

ThreadCreationTime : 05-14-2005 14:00:59

BasePriority : Normal

#:31 [dslmon.exe]

FilePath : C:\Program Files\SAGEM\SAGEM F@st 800-840\

ProcessID : 2076

ThreadCreationTime : 05-14-2005 14:01:01

BasePriority : Normal

FileVersion : 1, 0, 0, 1

ProductVersion : 1, 0, 0, 1

ProductName : DSLMON Application

FileDescription : ADIMON MFC Application

InternalName : DSLMON

OriginalFilename : ADIMON.EXE

#:32 [gcasdtserv.exe]

FilePath : C:\Program Files\Microsoft AntiSpyware\

ProcessID : 2140

ThreadCreationTime : 05-14-2005 14:01:04

BasePriority : Normal

FileVersion : 1.00.0509

ProductVersion : 1.00.0509

ProductName : Microsoft AntiSpyware (Beta 1)

CompanyName : Microsoft Corporation

FileDescription : Microsoft AntiSpyware Data Service

InternalName : gcasDtServ

LegalTrademarks : Microsoft® and Windows® are registered trademarks of Microsoft Corporation. SpyNet is a trademark of Microsoft Corporation.

OriginalFilename : gcasDtServ.exe

#:33 [explorer.exe]

FilePath : C:\WINDOWS\

ProcessID : 996

ThreadCreationTime : 05-14-2005 14:19:52

BasePriority : Normal

FileVersion : 6.00.2600.0000 (xpclient.010817-1148)

ProductVersion : 6.00.2600.0000

ProductName : Système d'exploitation Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Explorateur Windows

InternalName : explorer

OriginalFilename : EXPLORER.EXE

#:34 [ctfmon.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 2648

ThreadCreationTime : 05-14-2005 14:26:14

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : CTF Loader

InternalName : CTFMON

OriginalFilename : CTFMON.EXE

#:35 [espacewanadoo.exe]

FilePath : C:\Program Files\Wanadoo\

ProcessID : 3732

ThreadCreationTime : 05-14-2005 15:07:33

BasePriority : Normal

FileVersion : 5.7 (248)

ProductVersion : 5.7 (248)

ProductName : Kit de Connexion et de Services

CompanyName : France Télécom R&D

FileDescription : Espace Client

InternalName : EspaceClient

OriginalFilename : EspaceClient.exe

#:36 [comcomp.exe]

FilePath : C:\Program Files\Wanadoo\

ProcessID : 3788

ThreadCreationTime : 05-14-2005 15:07:35

BasePriority : Normal

FileVersion : 9.0 (517)

ProductVersion : 9.0 (517)

ProductName : Kit de Connexion et de Services

CompanyName : France Télécom R&D

FileDescription : Module de communication

InternalName : ComComp

OriginalFilename : ComComp.exe

#:37 [watch.exe]

FilePath : C:\Program Files\Wanadoo\

ProcessID : 1692

ThreadCreationTime : 05-14-2005 15:07:37

BasePriority : Normal

FileVersion : 9.0 (102)

ProductVersion : 9.0 (102)

ProductName : Kit de Connexion et de Services

CompanyName : France Télécom R&D

FileDescription : Surveillance des modifications

InternalName : Watch

OriginalFilename : Watch.exe

#:38 [iexplore.exe]

FilePath : C:\Program Files\Internet Explorer\

ProcessID : 248

ThreadCreationTime : 05-14-2005 15:08:21

BasePriority : Normal

FileVersion : 6.00.2600.0000 (xpclient.010817-1148)

ProductVersion : 6.00.2600.0000

ProductName : Système d'exploitation Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Internet Explorer

InternalName : iexplore

OriginalFilename : IEXPLORE.EXE

#:39 [smssu.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 3316

ThreadCreationTime : 05-14-2005 18:02:15

BasePriority : Normal

#:40 [smssu.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 3204

ThreadCreationTime : 05-14-2005 18:02:15

BasePriority : Normal

#:41 [tmntsrv32.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 636

ThreadCreationTime : 05-14-2005 18:02:19

BasePriority : Normal

#:42 [tmntsrv32.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 3280

ThreadCreationTime : 05-14-2005 18:02:19

BasePriority : Normal

#:43 [ad-aware.exe]

FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\

ProcessID : 3216

ThreadCreationTime : 05-14-2005 18:06:42

BasePriority : Normal

FileVersion : 6.2.0.206

ProductVersion : VI.Second Edition

ProductName : Lavasoft Ad-Aware SE

CompanyName : Lavasoft Sweden

FileDescription : Ad-Aware SE Core application

InternalName : Ad-Aware.exe

OriginalFilename : Ad-Aware.exe

Memory scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 16

Started registry scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

CoolWebSearch Object Recognized!

Type : Regkey

Data :

Category : Malware

Comment :

Rootkey : HKEY_CLASSES_ROOT

Object : interface\{b1e68d42-02c4-465b-8368-5ed9b732e22d}

CoolWebSearch Object Recognized!

Type : RegValue

Data :

Category : Malware

Comment :

Rootkey : HKEY_CLASSES_ROOT

Object : interface\{b1e68d42-02c4-465b-8368-5ed9b732e22d}

Value :

CoolWebSearch Object Recognized!

Type : Regkey

Data :

Category : Malware

Comment :

Rootkey : HKEY_CLASSES_ROOT

Object : interface\{0b6ef17e-18e5-4449-86ea-64c82d596eae}

CoolWebSearch Object Recognized!

Type : RegValue

Data :

Category : Malware

Comment :

Rootkey : HKEY_CLASSES_ROOT

Object : interface\{0b6ef17e-18e5-4449-86ea-64c82d596eae}

Value :

CoolWebSearch Object Recognized!

Type : Regkey

Data :

Category : Malware

Comment :

Rootkey : HKEY_CLASSES_ROOT

Object : clsid\{b599c57e-113a-4488-a5e9-bc552c4f1152}

CoolWebSearch Object Recognized!

Type : Regkey

Data :

Category : Malware

Comment :

Rootkey : HKEY_CLASSES_ROOT

Object : clsid\{1d27210e-2da2-41e2-a103-b5fd9d6a798b}

CoolWebSearch Object Recognized!

Type : Regkey

Data :

Category : Malware

Comment :

Rootkey : HKEY_CLASSES_ROOT

Object : clsid\{145e6fb1-1256-44ed-a336-8bba43373be6}

CoolWebSearch Object Recognized!

Type : RegValue

Data :

Category : Malware

Comment :

Rootkey : HKEY_CLASSES_ROOT

Object : clsid\{145e6fb1-1256-44ed-a336-8bba43373be6}

Value : InprocServer32

Registry Scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 8

Objects found so far: 24

Started deep registry scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 24

Started Tracking Cookie scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : julie@bluestreak[2].txt

Category : Data Miner

Comment : Hits:18

Value : Cookie:julie@bluestreak.com/

Expires : 05-12-2015 16:00:40

LastSync : Hits:18

UseCount : 0

Tracking cookie scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 1

Objects found so far: 25

Deep scanning and examining files (C:)

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 25

Deep scanning and examining files (E:)

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for E:\

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 25

Scanning Hosts file......

Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

1 entries scanned.

New critical objects:0

Objects found so far: 25

Performing conditional scans...

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

CoolWebSearch Object Recognized!

Type : RegValue

Data :

Category : Malware

Comment :

Rootkey : HKEY_CURRENT_USER

Object : software\microsoft\internet explorer\main

Value : Search Bar

CoolWebSearch Object Recognized!

Type : RegValue

Data :

Category : Malware

Comment :

Rootkey : HKEY_CURRENT_USER

Object : software\microsoft\windows\currentversion\policies\system

Value : NoDispAppearancePage

CoolWebSearch Object Recognized!

Type : RegValue

Data :

Category : Malware

Comment :

Rootkey : HKEY_CURRENT_USER

Object : software\microsoft\windows\currentversion\policies\system

Value : WallpaperStyle

CoolWebSearch Object Recognized!

Type : File

Data : hosts

Category : Malware

Comment :

Object : C:\WINDOWS\

Conditional scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 4

Objects found so far: 29

20:13:34 Scan Complete

Summary Of This Scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Total scanning time:00:05:54.140

Objects scanned:99235

Objects identified:13

Objects ignored:0

New critical objects:13

cjulie91 · le 14 mai 2005

en supprimant les fichiers déctecter par ad aware jcrois que g suppromer internet explorer. j'ai du utilisé msn explorer pour revenir sur le site

megataupe · le 14 mai 2005

Bien, ça avance. Si tu as fini le scan de Spybot, tu lances Hijackthis et tu envoies le rapport.

cjulie91 · le 14 mai 2005

voila j'ai fais spy boy ( il a encore détecté wwwcoolweb) et voila le scan log fait par hijackthis :

Logfile of HijackThis v1.99.1

Scan saved at 20:34:55, on 05/14/2005

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\Program Files\Analog Devices\SoundMAX\SMTray.exe

C:\Program Files\desksite\bin\cma.exe

C:\PROGRA~1\Wanadoo\CnxMon.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\PROGRA~1\Wanadoo\TaskbarIcon.exe

C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe

C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\System32\RUNDLL32.EXE

C:\Program Files\CursorXP\CursorXP.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Wanadoo\EspaceWanadoo.exe

C:\Program Files\Wanadoo\ComComp.exe

C:\Program Files\Wanadoo\Watch.exe

C:\WINDOWS\System32\SMSSU.EXE

C:\WINDOWS\System32\Tmntsrv32.EXE

C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Documents and Settings\Julie\Mes documents\anti spyware 60j d'essai\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: XMLDP Class - {60371670-81B9-4d06-9C42-4DEC1AABE62B} - C:\WINDOWS\xmllib.dll

O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Desksite CMA] C:\Program Files\desksite\bin\cma.exe

O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe

O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"

O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe

O4 - HKCU\..\Run: [sMSSU] C:\WINDOWS\System32\SMSSU.EXE

O4 - HKCU\..\Run: [Tmntsrv32] C:\WINDOWS\System32\Tmntsrv32.EXE

O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: Bloquer ce serveur... - C:\Program Files\Avant Browser\AddAllToADBlackList.htm

O8 - Extra context menu item: Bloquer cette publicité... - C:\Program Files\Avant Browser\AddToADBlackList.htm

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Ouvrir tous les liens de la page... - C:\Program Files\Avant Browser\OpenAllLinks.htm

O8 - Extra context menu item: Rechercher sur le Web... - C:\Program Files\Avant Browser\Search.htm

O8 - Extra context menu item: Surligner - C:\Program Files\Avant Browser\Highlight.htm

O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure...teleir_cert.cab

O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{C292D0A6-A954-4C24-A3F6-53C2AB3D486D}: NameServer = 80.10.246.1 80.10.246.132

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

cjulie91 · le 14 mai 2005

d'après toi combien de temps ca va prendre pour virer tout ca ? en plus j'ai supprimer internet exporer ca me stress....!!!

queruak · le 14 mai 2005

Bonsoir à tous,

D'abord tu te calmes,et le reste sera facile !

Pas de panique !!!

J'aurais besoin d'un autre rapport:

Fais ceci:

Télécharge ce fichier

http://www.silentrunners.org/Silent%20Runners.zip

Une fois téléchargé,tu le dézippes dans un dossier dédié.

Puis tu double cliques sur ce fichier,il va travailler,patiente jusqu'à l'affichage d'un méssage.

Un log est généré dans le meme dossier,colle le log ici.

Ne fais rien,tu attends mes instructions !!!

cjulie91 · le 14 mai 2005

voila ce que dit le fichierque tu m'as demander de telecharger :

"Silent Runners.vbs", revision 36, http://www.silentrunners.org/

Operating System: Windows XP

Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:

---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]

"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit" [MS]

"CursorXP" = "C:\Program Files\CursorXP\CursorXP.exe" [" "]

"SMSSU" = "C:\WINDOWS\System32\SMSSU.EXE" [null data]

"Tmntsrv32" = "C:\WINDOWS\System32\Tmntsrv32.EXE" [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"Smapp" = "C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" ["Analog Devices, Inc."]

"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS]

"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]

"NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]

"Desksite CMA" = "C:\Program Files\desksite\bin\cma.exe" ["DeskSite, Inc."]

"WooCnxMon" = "C:\PROGRA~1\Wanadoo\CnxMon.exe" [empty string]

"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]

"WOOWATCH" = "C:\PROGRA~1\Wanadoo\Watch.exe" ["France Télécom R&D"]

"WOOTASKBARICON" = "C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [null data]

"msnappau" = ""C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"" [MS]

"gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]

"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{60371670-81B9-4d06-9C42-4DEC1AABE62B}\(Default) = "XMLDP Class" [from CLSID]

-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\xmllib.dll" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"

-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"

-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]

"{6D0E6651-1CD8-11d6-92C4-0003479E4848}" = "NVIDIA NT4 Multimon Control Panel Extension"

-> {CLSID}\InProcServer32\(Default) = "nvnt4cpl.dll" ["NVIDIA Corporation"]

"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Explorateur de bureau"

-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"

-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]

"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"

-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]

"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"

-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]

"{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"

-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]

"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\

INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"

-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

INFECTION WARNING! explorer.exe\Debugger = "C:\WINDOWS\explorer32dbg.exe" [file not found]

INFECTION WARNING! iexplore.exe\Debugger = "C:\WINDOWS\iexplore_dbg.exe" [file not found]

queruak · le 14 mai 2005

Re,

Le rapport n'est pas complet,tu n'as pas patienté assez !!!!

cjulie91 · le 14 mai 2005

ah excuse moi je le refais

cjulie91 · le 14 mai 2005

en fait il s'est affiché tout de suite jpensais que ct bon

Connexion

Pas encore inscrit ?

[résolu]un spyware a détruit l'option affichage (résolu)

Messages recommandés

cjulie91

cjulie91

megataupe

cjulie91

cjulie91

queruak

cjulie91

queruak

cjulie91

cjulie91

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer