log hijack

[Marko7]

salut régis je viens de terminer la procédure

je te fais part des nouveaux rapports

 

RAPPORT EWIDO:

 

---------------------------------------------------------

ewido anti-spyware - Scan Report

---------------------------------------------------------

 

+ Created at: 10:39:26 20/06/2006

 

+ Scan result:

 

 

 

E:\Mes documents\Mes fichiers reçus\divers\eMule.Pack.2004...[www.pIngOo-Land.biz]..9.eMule.+.Codes.Hack.+.Serial.+.Config.parfaite.by.GoldBerg.rar/eMule Pack 2004 [www.pIngOo-Land.biz] 9 eMule + Codes Hack + Serial + Config parfaite by GoldBerg\Server Met Autoupdater.zip/Server Met Autoupdater/URL2FILE.exe -> Not-A-Virus.Downloader.Win32.Url2File.a : Cleaned.

C:\WINDOWS\Downloaded Program Files\USDR6V_0001_D08M1005NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.l : Cleaned.

C:\Documents and Settings\Martine DEZE\Cookies\martine deze@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Martine DEZE\Cookies\martine deze@msnuk.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Marco DEZE\Cookies\marco deze@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.

C:\Documents and Settings\Marco DEZE\Cookies\marco deze@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.

C:\Documents and Settings\Pascal DEZE\Cookies\pascal deze@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.

C:\Documents and Settings\Marco DEZE\Cookies\marco deze@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.

C:\Documents and Settings\Pascal DEZE\Cookies\pascal deze@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.

C:\Documents and Settings\Pascal DEZE\Cookies\pascal deze@e-2dj6wjlyegcjwlq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.

C:\Documents and Settings\Marco DEZE\Cookies\marco deze@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.

C:\Documents and Settings\Pascal DEZE\Cookies\pascal deze@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.

C:\Documents and Settings\Pascal DEZE\Cookies\pascal deze@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.

C:\Documents and Settings\Pascal DEZE\Cookies\pascal deze@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned.

C:\Documents and Settings\Pascal DEZE\Cookies\pascal deze@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.

C:\Documents and Settings\Pascal DEZE\Cookies\pascal deze@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.

C:\Documents and Settings\Marco DEZE\Cookies\marco deze@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Cleaned.

C:\Documents and Settings\Pascal DEZE\Cookies\pascal deze@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned.

C:\Documents and Settings\Pascal DEZE\Cookies\pascal deze@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.

C:\Documents and Settings\Marco DEZE\Cookies\marco deze@weborama[1].txt -> TrackingCookie.Weborama : Cleaned.

C:\Documents and Settings\Pascal DEZE\Cookies\pascal deze@weborama[1].txt -> TrackingCookie.Weborama : Cleaned.

 

 

::Report end

 

 

 

 

RAPPORT HIJACK:

Logfile of HijackThis v1.99.1

Scan saved at 11:05:59, on 20/06/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\SECURI~1\av_fw\backweb\8520111\Program\SERVIC~1.EXE

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\mHotkey.exe

C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe

C:\Program Files\Apoint2K\Apoint.exe

C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE

C:\Program Files\Securitoo\av_fw\backweb\8520111\program\fsbwsys.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe

C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

C:\Program Files\Apoint2K\Apntex.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\slserv.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE

C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe

C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE

C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe

C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Securitoo\av_fw\FSGUI\fsguiexe.exe

C:\WINDOWS\system32\winlogon.exe

C:\Program Files\Securitoo\av_fw\backweb\8520111\Program\fspex.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.wanadoo.fr/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Burn4Free Toolbar Helper - {F8E5CA21-C27B-43e7-B2BE-4CA93C9F9A1F} - C:\Program Files\Burn4Free Toolbar\v2.0.0.4\Burn4Free_Toolbar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Burn4Free Toolbar - {70DE7956-479D-4eb7-8641-2B45774C350E} - C:\Program Files\Burn4Free Toolbar\v2.0.0.4\Burn4Free_Toolbar.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll

O4 - HKLM\..\Run: [CHotkey] mHotkey.exe

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash

O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW

O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /reboot

O4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"

O4 - HKLM\..\Run: [FSASWREG] "C:\Program Files\Securitoo\av_fw\Anti-Spyware\fsaswreg.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1098086073234

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: Securitoo Antivirus Firewall (BackWeb Plug-in - 8520111) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\8520111\Program\SERVIC~1.EXE

O23 - Service: Client de licence CA (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe

O23 - Service: Serveur de licence CA (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe

O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\8520111\program\fsbwsys.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE

O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

 

 

 

QUELQUES PETITES PRECISIONS:

-lors de l'installation d'Ewido,je n'ai pas eu de page "additional options" du coup je n'ai pas pu cocher les options install background guard et install scan via context menu

-au moment du rédemarrage en mode sans échec je n'ai pas suspendu ma protection anti-virus car je n'était pas sur de moi (j'utilise securitoo anti-virus et securitoo anti spyware

-lors du scan ewido, je n'ai pas trouver la case "créer des copies de sauvegarde cryptées dans la quarantaine" donc je ne sais pas si elle a été cochée ou non

-enfin quand j'ai repassé regseeker j'ai n'ai supprimé que les lignes vertes j'ai laissé toutes les rouges car je ne sais pas a quoi elles correspondent

 

 

concernant le pc il va beaucoup mieux mais il me semble qu'il reste encore des infections car il est quand meme moins véloce qu'avant.c'est tout de meme très satisfaisant

j'ai 65 processus en cours et mon uc est enfin revenu a 0%

 

je fait un scan en ligne a plus

encore merci

[regis56]

Bonjour Marko7 !

 

Quand tu aura fais le scan chez Panda

 

Va voir ce tuto pour faire le ménage dans tes services ca va accélérer un peu le système.

http://www.zebulon.fr/articles/services_1.php

 

Sinon depuis combien de temps à tu fais une défrag ?

Un bon défragmenteur contig

http://telechargement.zebulon.fr/234-contig.html

A utiliser avec

http://telechargement.zebulon.fr/235-power...menter-gui.html

 

A plus !