nouveau rapport hijackthis

[frederic.garcia11]

j'ai désinstallé flashget et suivi la procédure de Tornado.

Voici les deux rapports

Ewido:

Résultats du scan:

 

G:\Documents and Settings\FREDO 2\Cookies\fredo 2@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyer et sauvegarder

G:\Documents and Settings\FREDO 2\Cookies\fredo 2@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyer et sauvegarder

G:\Documents and Settings\FREDO 2\Cookies\fredo 2@casalemedia[2].txt -> TrackingCookie.Casalemedia : Nettoyer et sauvegarder

G:\Documents and Settings\FREDO 2\Cookies\fredo 2@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Nettoyer et sauvegarder

G:\Documents and Settings\FREDO 2\Cookies\fredo 2@weborama[2].txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder

G:\Documents and Settings\FREDO 2\Cookies\fredo 2@wreport.weborama[1].txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder

G:\Documents and Settings\FREDO 2\Cookies\fredo 2@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder

H:\RECYCLER\NPROTECT\00000001.ZIP/nocd_patch_crack.exe -> Trojan.BHO.b : Nettoyer et sauvegarder

H:\RECYCLER\NPROTECT\00000002/fstraffic v2.01 (for microsoft flight simulator).exe -> Worm.Bagle.fc : Nettoyer et sauvegarder

H:\RECYCLER\NPROTECT\00000003/fstraffic v2.01 by pc.exe -> Worm.Bagle.fc : Nettoyer et sauvegarder

H:\RECYCLER\NPROTECT\00000004.ZIP/voice buddy 3.0 crack.exe -> Trojan.Small : Nettoyer et sauvegarder

 

HIJACKTHIS:

Running processes:

G:\WINDOWS\System32\smss.exe

G:\WINDOWS\system32\csrss.exe

G:\WINDOWS\system32\winlogon.exe

G:\WINDOWS\system32\services.exe

G:\WINDOWS\system32\lsass.exe

G:\WINDOWS\system32\Ati2evxx.exe

G:\WINDOWS\system32\svchost.exe

G:\WINDOWS\system32\svchost.exe

G:\WINDOWS\System32\svchost.exe

G:\WINDOWS\system32\svchost.exe

G:\WINDOWS\system32\spoolsv.exe

G:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

G:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

G:\WINDOWS\system32\CTsvcCDA.exe

G:\Program Files\ewido anti-malware\ewidoctrl.exe

G:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE

G:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

G:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

G:\WINDOWS\system32\wdfmgr.exe

G:\WINDOWS\system32\ZoneLabs\vsmon.exe

G:\WINDOWS\system32\Ati2evxx.exe

G:\WINDOWS\Explorer.EXE

G:\WINDOWS\system32\MsPMSPSv.exe

G:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

G:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

G:\Program Files\MessengerPlus! 3\MsgPlus.exe

G:\Program Files\WinZip\WZQKPICK.EXE

G:\WINDOWS\System32\alg.exe

G:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

G:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

G:\Program Files\AntiVir PersonalEdition Classic\sched.exe

G:\Program Files\HIJACKThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Ultimate Edition 2.0

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - G:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - g:\program files\google\googletoolbar2.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - G:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar2.dll

O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - G:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [AVG7_CC] G:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [AVG7_EMC] G:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O4 - HKLM\..\Run: [Zone Labs Client] G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [MessengerPlus3] "G:\Program Files\MessengerPlus! 3\MsgPlus.exe"

O4 - HKLM\..\Run: [avgnt] "G:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [spySweeper] "G:\Program Files\SpySweeper\SpySweeper.exe" /0

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = G:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: WinZip Quick Pick.lnk = G:\Program Files\WinZip\WZQKPICK.EXE

O8 - Extra context menu item: &Google Search - res://g:\program files\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://g:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://g:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://g:\program files\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://G:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Imprimer - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://G:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Similar Pages - res://g:\program files\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://g:\program files\google\GoogleToolbar2.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "G:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - G:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - G:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - G:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: ewido security suite control - ewido networks - G:\Program Files\ewido anti-malware\ewidoctrl.exe

O23 - Service: GhostStartService - Symantec Corporation - G:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE

O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - G:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

O23 - Service: Speed Disk service - Symantec Corporation - G:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - G:\WINDOWS\system32\ZoneLabs\vsmon.exe

 

Merci encore et A+

[naheulbeuk]

salut, t'as des symptomes quelconques ? faut vider ta corbeille régulièrement...

 

sinon ton LOG HJT est clean....

 

fais un scan panda en ligne :

ici

et post moi le rapport de ce scan ici une fois terminé !

 

A+