Aller au contenu
  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

Backdoor.Win32 sdbot.gen


sdr

Messages recommandés

Bonjour à tous,

 

J'ai le problème suivant : quand j'utilise sybot il trouve le trojan Backdoor Win32 SdBot.gen, mon anti virus est à jour "Avast", windows egalement, je suis aller dans la base des registres ou il indique la clé suivante : loecal/software/microsoft/windows/current version/run/cscrs value, quand je la supprine , elle revient j'ai fait la manip en mode sans echec elle disparait et quand je reviens en mode normal elle est là.....J'ai scanné avec l'anti virus il ne trouve rien adware se egalement , j'ai essayé pest patrol,il trouve pas et pourtant elle réapparait avec spybot....

 

POUVEZ VOUS M'AIDER SVP

Lien vers le commentaire
Partager sur d’autres sites

Bonjour à tous,

 

Je déplace le rapport HijackThis que sdr a posté dans le sujet épinglé :

Bonjour,

 

J'ai suivi vos conseils et je vous joins ci-dessous les éléments

 

Rapport HIJACKTHIS

 

Logfile of HijackThis v1.99.1

Scan saved at 19:41:39, on 31/10/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.exe

C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe

C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe

C:\WINDOWS\uvchost.exe

C:\Program Files\HIJACKTHIS VF\hijackthis vf.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://freebox.free.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://freebox.free.fr/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

F2 - REG:system.ini: Shell=Explorer.exe uvchost.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - H:\Money\System\mnyside.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Dit] Dit.exe

O4 - HKLM\..\Run: [Remote_Agent] C:\Program Files\Medion\PowerVCR II\RemoteAgent.exe

O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\Qurb\QSP-3.0.311.7\QOELoader.exe"

O4 - HKLM\..\Run: [bDMCon] C:\progra~1\softwin\bitdef~1\bdmcon.exe

O4 - HKLM\..\Run: [bDOESRV] C:\Program Files\Softwin\BitDefender8\\bdoesrv.exe

O4 - HKLM\..\Run: [bDNewsAgent] C:\progra~1\softwin\bitdef~1\bdnagent.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"

O4 - HKCU\..\Run: [CSCRS Value] cscrs.exe

O4 - HKCU\..\RunServices: [CSCRS Value] cscrs.exe

O4 - Startup: Organizer.lnk = C:\Program Files\Micro Application\Agenda et Contacts\Organiseur.exe

O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: Personnaliser - C:\Program Files\PROMT98\promtie4\options.htm

O8 - Extra context menu item: Rechercher sur Internet - C:\Program Files\PROMT98\promtie4\search.htm

O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Traduire - C:\Program Files\PROMT98\promtie4\translat.htm

O8 - Extra context menu item: Traduire dans WebView - C:\Program Files\PROMT98\promtie4\webview.htm

O8 - Extra context menu item: Traduire la page - C:\Program Files\PROMT98\promtie4\page.htm

O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm

O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm

O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm

O9 - Extra 'Tools' menuitem: Personnalisez traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - H:\Money\System\mnyside.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O14 - IERESET.INF: START_PAGE_URL=http://freebox.free.fr/

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1120130826031

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1120134058843

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE

O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

O23 - Service: GhostStartService - Symantec Corporation - H:\NORTON~1\GHOSTS~2.EXE

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

 

Rapport Antivir

 

 

Creation date of the report file: lundi 31 octobre 2005 19:49

 

AntiVir®/XP (2000 + NT) PersonalEdition Classic

Build 1111 of 18.10.2005

Mainprogram 6.32.00.50 of 13.10.2005

VDF file 6.32.11.9 (0) of 31.10.2005

 

 

This program is for PERSONAL USE only.

Any other use is PROHIBITED.

Informations regarding commercial versions of AntiVir may be obtained from:

www.hbedv.com.

 

 

Scanning for 239758 virus strains and unwanted programs.

 

Licensed for: AntiVir Personal Edition

Serial number: 0000149991-WURGE-0001

 

Please enter the workstation and

contact name with phone number in this form:

 

Name ___________________________________________

 

Street ___________________________________________

 

Town ___________________________________________

 

Phone/Fax ___________________________________________

 

Email ___________________________________________

 

Platform: Windows NT Workstation

Windows version: 5.1 Build 2600 (Service Pack 2)

Username: serge

Computername: G

Processor: Pentium

Working memory: 785908 KB free

 

Version information:

AVWIN.DLL : 6.32.00.50 561192 13.10.2005 16:32:14

AVEWIN32.DLL : 6.32.0.57 954880 14.10.2005 15:08:24

AVGNT.EXE : 6.32.00.02 180327 14.10.2005 12:32:02

AVGUARD.EXE : 6.32.00.12 208424 17.10.2005 08:35:12

GUARDMSG.DLL : 6.30.00.02 94248 01.02.2005 11:24:10

AVGCMSG.DLL : 6.32.00.01 295029 13.10.2005 16:32:14

AVGNTDW.SYS : 6.31.00.01 32896 29.04.2005 08:07:16

AVPACK32.DLL : 6.32.00.02 319528 18.10.2005 11:57:30

AVGETVER.DLL : 6.30.00.00 24576 28.01.2005 18:10:20

AVSHLEXT.DLL : 6.30.00.01 40960 28.01.2005 18:10:22

AVSched32.EXE : 6.32.00.01 110632 20.09.2005 14:16:24

AVSched32.DLL : 6.30.00.00 122880 01.02.2005 11:24:10

AVREG.DLL : 6.31.00.05 41000 07.09.2005 16:34:50

AVRep.DLL : 6.32.00.120 1454120 31.10.2005 18:28:12

INETUPD.EXE : 6.32.00.52 262203 17.10.2005 15:46:14

INETUPD.DLL : 6.32.00.52 143360 17.10.2005 15:46:14

CTL3D32.DLL : 2.31.000 27136 30.08.2002 13:00:00

MFC42.DLL : 6.02.4131.0 1028096 20.08.2004 00:09:30

MSVCRT.DLL : 7.0.2600.2180 (xpsp_sp2_rtm.0408

MSVCRT.DLL : 7.0.2600.2180 343040 20.08.2004 00:09:34

CTL3DV2.DLL : 2.31.001 27632 01.04.2005 14:17:44

 

Configuration file:

 

Name of configuration file: C:\Program Files\AVPersonal\AVWIN.INI

Name of report file: C:\Program Files\AVPersonal\LOGFILES\AVWIN.LOG

Start path: C:\Program Files\AVPersonal

Command line:

Start mode: unknown

 

Mode of report file:

[ ] Do not create report

[X] Overwrite report

[ ] Append new report

 

Data in report file:

[X] Infected files

[ ] Infected files with paths

[ ] All scanned files

[ ] Full information

 

Abridge report file:

[ ] Abridge report file

 

Warnings in report:

[X] Access denied/file locked

[X] Wrong file size in directory

[X] Wrong creation time in directory

[ ] COM file is too large

[X] Invalid start address

[X] Invalid EXE header

[X] Possibly damaged

 

Summary report:

[X] Create summary report

Output file: AVWIN.ACT

Maximum number of entries: 100

 

Where to search:

[X] Memory

[X] Boot record of selected drives

[ ] Report unknown boot sectors

[X] All files

[ ] Program files

 

Response in case of a detection:

[X] Repair with prompt

[ ] Repair without prompt

[ ] Delete with prompt

[ ] Delete without prompt

[ ] Write in report file only

[X] Acoustic alarm

 

Response in case of destroyed files:

[X] Delete with prompt

[ ] Delete without prompt

[ ] Ignore

 

Response in case of destroyed files:

[X] No change

[ ] Current system time

[ ] Correct date

 

Drag&drop settings:

[X] Scan subdirectories

 

Profile settings:

[X] Scan subdirectories

 

Archive options

[X] Search archive

[X] Archive types to leave out

1002 1001 1000

 

Miscellaneous options:

Temporary path: %TEMP% -> C:\DOCUME~1\serge\LOCALS~1\Temp

[X] Overwrite infected files

[ ] Detect idle time

[X] Allow interruptions of scan

[ ] Load AVWin®/NT Guard on System start

 

General settings:

[X] Save options on exiting AntiVir

Priority: medium

 

Drives:

A: Floppy drive

C: Hard disk

D: Hard disk

E: Hard disk

F: Hard disk

G: Hard disk

H: Hard disk

I: Hard disk

J: Hard disk

K: Hard disk

L: Hard disk

M: CD-ROM

N: CD-ROM

O: Floppy drive

P: Floppy drive

Q: Floppy drive

R: Floppy drive

T: CD-ROM

 

Start of scan: lundi 31 octobre 2005 19:49

 

Memory test OK

Master boot record of hard disk HD0 OK

Master boot record of hard disk HD1 OK

Master boot record of hard disk HD2

The record could not be read!

Error code: 0x0015

Master boot record of hard disk HD3

The record could not be read!

Error code: 0x0015

Master boot record of hard disk HD4

The record could not be read!

Error code: 0x0015

Master boot record of hard disk HD5

The record could not be read!

Error code: 0x0015

Boot record of drive C: OK

 

 

Access denied! Error during file opening!

Error code: 0x0002

C:\

 

WARNING! Access error/file locked!

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery

BackdoorWinSdBotgen.zip

ArchiveType: ZIP

NOTE! The whole archive is password protected

Access denied! Error during file opening!

Error code: 0x0002

C:\Documents and Settings\All Users\Documents\Mes images\Échantillons d'images

 

WARNING! Access error/file locked!

C:\Documents and Settings\NetworkService

NTUSER.DAT

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

ntuser.dat.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows

UsrClass.dat

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

UsrClass.dat.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\serge

ntuser.dat

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

ntuser.dat.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\serge\Bureau\em

Nod 32 Antivirus Pwds&Crack 2Packs.zip

ArchiveType: ZIP

--> NOD 32_Antivirus+unames&pwds\nodwnten.exe

ArchiveType: RAR SFX (self extracting)

--> DISK1\data1.dat

ArchiveType: RAR

--> nms32.dll

NOTE! Invalid compressed data

--> NOD 32_Antivirus+unames&pwds\nodwntit.exe

ArchiveType: RAR SFX (self extracting)

--> DISK1\data1.dat

ArchiveType: RAR

--> nms32.dll

NOTE! Invalid compressed data

--> NOD 32_Antivirus+unames&pwds\Password_vecchie_Nod\NOD32.AntiVirus.v1.342.WinNT2kXP.zip

ArchiveType: ZIP

--> NOD32.AntiVirus.v1.342.WinNT2kXP-UnderPl\u-nne13a.zip

ArchiveType: ZIP

--> setup.part1.rar

ArchiveType: RAR

--> DISK1\data1.dat

ArchiveType: RAR

--> nms32.dll

NOTE! Invalid compressed data

--> NOD32.AntiVirus.v1.342.WinNT2kXP-UnderPl\u-nne13b.zip

ArchiveType: ZIP

--> setup.part2.rar

ArchiveType: RAR

NOTE! The archive is created by multiple volumes

C:\Documents and Settings\serge\Local Settings\Application Data\Microsoft\Windows

UsrClass.dat

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

UsrClass.dat.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

Access denied! Error during file opening!

Error code: 0x0002

C:\Documents and Settings\serge\Mes documents\Mes fichiers reçus

 

WARNING! Access error/file locked!

Access denied! Error during file opening!

Error code: 0x0002

C:\Program Files\eMule

 

WARNING! Access error/file locked!

C:\Program Files\Free.fr\Dialer

Dialer.exe

[DETECTION] Contains signature of the dial-up program DIAL/Generic

WAS DELETED!

Access denied! Error during file opening!

Error code: 0x0002

C:\Program Files\hp deskjet 970c series

 

WARNING! Access error/file locked!

Access denied! Error during file opening!

Error code: 0x0002

C:\Program Files\Movie Maker

 

WARNING! Access error/file locked!

Access denied! Error during file opening!

Error code: 0x0002

C:\Program Files\Windows Media Player

 

WARNING! Access error/file locked!

C:\Program Files\WinRAR

rarnew.dat

ArchiveType: RAR

NOTE! The archive is created by multiple volumes

Access denied! Error during file opening!

Error code: 0x0002

C:\Rues de Paris

 

WARNING! Access error/file locked!

Error! Could not change directory: System Volume Information

C:\WINDOWS\AU_Temp\AU_Down\engine

engv_nt386.zip

ArchiveType: ZIP

NOTE! No files to extract.

C:\WINDOWS\system32\config

default

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

default.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SAM

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SAM.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SECURITY

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SECURITY.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

software

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

software.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

system

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

system.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

 

End of scan: lundi 31 octobre 2005 20:34

Time taken: 44:46 min

 

 

3443 directories were scanned

76372 files were scanned

27 warning messages were issued

1 file was deleted

0 files were repaired

1 detection

 

Egalement rapport spybot

 

Backdoor.Win32.SdBot.gen: Réglages (Valeur du registre, nothing done)

HKEY_USERS\S-1-5-21-1078081533-1482476501-725345543-1004\Software\Microsoft\Windows\CurrentVersion\RunServices\CSCRS Value

 

MediaPlex: Cookie traceur (Firefox: default) (Cookie, nothing done)

 

 

 

--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

 

2005-05-31 blindman.exe (1.0.0.1)

2005-05-31 SpybotSD.exe (1.4.0.3)

2005-05-31 TeaTimer.exe (1.4.0.2)

2005-10-28 unins000.exe (51.41.0.0)

2005-05-31 Update.exe (1.4.0.0)

2005-05-31 advcheck.dll (1.0.2.0)

2005-05-31 aports.dll (2.1.0.0)

2005-05-31 borlndmm.dll (7.0.4.453)

2005-05-31 delphimm.dll (7.0.4.453)

2005-05-31 SDHelper.dll (1.4.0.0)

2005-05-31 Tools.dll (2.0.0.2)

2005-05-31 UnzDll.dll (1.73.1.1)

2005-05-31 ZipDll.dll (1.73.2.0)

2005-10-28 Includes\Cookies.sbi (*)

2005-10-28 Includes\Dialer.sbi (*)

2005-10-28 Includes\Hijackers.sbi (*)

2005-10-28 Includes\Keyloggers.sbi (*)

2005-10-28 Includes\Malware.sbi (*)

2005-10-28 Includes\PUPS.sbi (*)

2005-10-28 Includes\Revision.sbi (*)

2005-10-28 Includes\Security.sbi (*)

2005-10-28 Includes\Spybots.sbi (*)

2005-02-17 Includes\Tracks.uti

2005-10-28 Includes\Trojans.sbi (*)

 

NB : Concernant le rapport Spybot j'ai essayé de supprimer la clé dans la base des registres, elle revient même après l'avoir fait en mode sans echec, j'ai testé avec adware se , il ne voit rien, j'ai essayé Pest Patrol idem et pour finir CounterSpy il trouve pas.....J'ai testé egalement avec les antivirus suivants : Bitdefender, Kapersky, Nod 32, Avast et rien.......

SI VOUS POUVEZ M'APPORTER VOTRE AIDE ELLE SERA LA BIENVENU? J'AI BESOIN DE CONSEILS.....

 

MERCI

 

email : [email protected]

Lien vers le commentaire
Partager sur d’autres sites

Encore ce post de sdr dans la discussion épinglée !

 

Bonjour,

 

Je viens de prendre connaissance de ta réponse, effectivement je l'ai fait en mode sans echec...

voici donc le nouveau en mode normal

 

Logfile of HijackThis v1.99.1

Scan saved at 12:02:28, on 01/11/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe

C:\WINDOWS\uvchost.exe

C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe

C:\Program Files\Micro Application\Agenda et Contacts\Organiseur.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\Program Files\HIJACKTHIS VF\hijackthis vf.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://freebox.free.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://freebox.free.fr/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

F2 - REG:system.ini: Shell=Explorer.exe uvchost.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - H:\Money\System\mnyside.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Dit] Dit.exe

O4 - HKLM\..\Run: [Remote_Agent] C:\Program Files\Medion\PowerVCR II\RemoteAgent.exe

O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\Qurb\QSP-3.0.311.7\QOELoader.exe"

O4 - HKLM\..\Run: [bDMCon] C:\progra~1\softwin\bitdef~1\bdmcon.exe

O4 - HKLM\..\Run: [bDOESRV] C:\Program Files\Softwin\BitDefender8\\bdoesrv.exe

O4 - HKLM\..\Run: [bDNewsAgent] C:\progra~1\softwin\bitdef~1\bdnagent.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"

O4 - HKCU\..\Run: [CSCRS Value] cscrs.exe

O4 - HKCU\..\RunServices: [CSCRS Value] cscrs.exe

O4 - Startup: Organizer.lnk = C:\Program Files\Micro Application\Agenda et Contacts\Organiseur.exe

O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: Personnaliser - C:\Program Files\PROMT98\promtie4\options.htm

O8 - Extra context menu item: Rechercher sur Internet - C:\Program Files\PROMT98\promtie4\search.htm

O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Traduire - C:\Program Files\PROMT98\promtie4\translat.htm

O8 - Extra context menu item: Traduire dans WebView - C:\Program Files\PROMT98\promtie4\webview.htm

O8 - Extra context menu item: Traduire la page - C:\Program Files\PROMT98\promtie4\page.htm

O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm

O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm

O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm

O9 - Extra 'Tools' menuitem: Personnalisez traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - H:\Money\System\mnyside.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O14 - IERESET.INF: START_PAGE_URL=http://freebox.free.fr/

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1120130826031

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1120134058843

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE

O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

O23 - Service: GhostStartService - Symantec Corporation - H:\NORTON~1\GHOSTS~2.EXE

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

 

MERCI POUR L'AIDE QUE VOUS POUVEZ M'APPORTER C'EST URGENT......

 

J'ai clické sur le lien que tu as mis , je n'arrive pas à y aller il dit qu'il y a une erreur!!!!!

cela vient peut être de mon ordi .......

 

merci

sdr

Lien vers le commentaire
Partager sur d’autres sites

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...