1 coup de main svp!

black wolf · le 19 juin 2006

salut a ts !

ça fait un certain temps que mon ordi me met p2esocks introuvable alors j ai je ter un oeil

a votre forum et j ai fais tt ce qu il fallait et donc voila !

merci beaucoup et a plus !

Logfile of HijackThis v1.99.1

Scan saved at 18:33:40, on 19/06/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\QuickTime\qttask.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\Wanadoo\TaskBarIcon.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\Documents and Settings\quentin\Mes documents\Mes eBooks\telechargement divers\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://fr.xfire.com/xf/register.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=

O4 - HKCU\..\Run: [instant Access] rundll32.exe p2esocks_1048.dll,InstantAccess

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)

O16 - DPF: {0E79192A-C52C-4260-920F-639AC2296203} - http://scripts.downloadv3.com/binaries/P2E..._1048_FR_XP.cab

O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab

O16 - DPF: {3AEA6239-7D97-4B70-A342-A824B55E5A5B} (Adam Class) - http://htmldialer.parisvoyeur.com/CABSPOLY...,3,8/fr/Eve.cab

O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://jeuxvideo.wanadoo.fr/components/Metaboli.ocx

O16 - DPF: {9EB4F647-FE4A-42F9-9F5C-B8FB28DD02F9} - http://scripts.dlv4.com/binaries/IA/sysia32svc_FR_XP.cab

O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/...svc32_FR_XP.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {C32EE4CB-E99F-4147-BFAE-67FF3B6F8076} (Romeo Class) - http://htmldialer.parisvoyeur.com/CABSPOLY...fr/Juliette.cab

O16 - DPF: {F4653484-F38C-455F-BB15-1175E527754E} (VideoProducer Class) - http://www.jointheorgy.com/static/class/we...ie6/webcam2.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

Modifié le 19 juin 2006 par black wolf

LoGiC · le 19 juin 2006

Salut black wolf

tout d'abord, un petit bonjour ça ne mange pas de pain !

ensuite as tu suivi la procédure pré-hijackthis >>-=Pré-Nettoyage d'un P.C infecté=-

ensuite postes le rapport qui en découlera a la suite de ce topic et un conseillé en sécurité te dira quoi faire

@+

regis56 · le 19 juin 2006

Bonsoir black wolf et bienvenue sur le forum zeb-sécu !

Salut guronsan !

j ai fais tt ce qu il fallait

=> veut dire par là que tu as déjà fait le pré-nettoyage ?

Si oui fais ceci STP

Télécharge la version d'essai d'Ewido Anti-Malware ici :

http://www.ewido.net/fr/

..et installe le (Important: pendant l'installation, sur la page "Additional Options" décoche les deux options "Install background guard" et "Install scan via context menu").

Démarre Ewido avec l'icône qui se trouve sur ton Bureau. Clique sur mise à jour, attendre la fin de cette mise à jour puis, ferme le programme.

Redémarre en mode Sans Échec : au redémarrage, tapote immédiatement la touche F8; tu verras un écran avec choix de démarrages apparaître. Utilisant les flèches du clavier, choisis "Mode Sans Échec" et valide avec "Entrée". Choisis ton compte usuel, et non Administrateur.

Du mode Sans Échec, relance Ewido et clique sur Scanner puis sur Scan complet du système.

Si des fichiers infectés sont trouvés, garde l'option par défaut Supprimer (avec la ligne "Créer des copies de sauvegarde cryptées dans la quarantaine" cochée), et coche "Effectuer cette action avec toutes les infections".

A la fin du scan, sauvegarde le rapport (Fichier/Enregistrer sous...) sur le Bureau.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Redémarre en mode Normal. Je te fais passer un autre outil :

Télécharge Blacklight (de F-Secure) et sauvegarde le sur ton Bureau.

Double-clique blbeta.exe et accepte la licence; laisse [X]scan through Windows Explorer activé; clique Scan puis Next

Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).

Copie et colle le contenu de ce rapport dans ta prochaine réponse. NE PAS choisir l'option "Rename" de suite : nous devons analyser le rapport, car des fichiers légitimes peuvent être présents, tel wbemtest.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~

Prière de poster les rapports suivant dans ta prochaine réponse :

1) Ewido

2) BlackLight

3) Nouveau rapport HijackThis!

4) Le rapport qui se trouve ici : C:\egd.txt

Bon courage, et @+

Modifié le 19 juin 2006 par regis56

black wolf · le 20 juin 2006

re salut !!

merci pour votre aide (quelle boulot !)

j ai suivi les instructions mais je n ai pas trouver le rapport dabs : C:\egd.txt

j espere que ça ne pose pas de probleme (j espere surtout que je n ai pas à tout refaire !!)

bon voila les autres rapports

Ewido :

---------------------------------------------------------

ewido anti-spyware - Scan Report

---------------------------------------------------------

+ Created at: 10:14:43 20/06/2006

+ Scan result:

C:\WINDOWS\system32\webcam2.dll -> Adware.Webcam : No action taken.

C:\WINDOWS\system32\sysia32svc.dll -> Dialer.EGroup.u : No action taken.

HKU\S-1-5-21-3530628298-3592574427-4211936202-1006\Software\EGDHTML -> Dialer.Generic : No action taken.

C:\Documents and Settings\quentin\Local Settings\Temporary Internet Files\Content.IE5\R6SNJTGH\SystemDoctor2006FreeInstall_fr[1].cab/USDR6V_0001_D08M1005NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.l : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@247realmedia[2].txt -> TrackingCookie.247realmedia : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@247realmedia[1].txt -> TrackingCookie.247realmedia : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@2o7[2].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@redcats.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@sfr.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@2o7[2].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@boonty.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@redcats.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@ads.addynamix[1].txt -> TrackingCookie.Addynamix : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@adjuggler[2].txt -> TrackingCookie.Adjuggler : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@rotator.adjuggler[2].txt -> TrackingCookie.Adjuggler : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@adtech[2].txt -> TrackingCookie.Adtech : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@adtech[2].txt -> TrackingCookie.Adtech : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@www.adtrak[1].txt -> TrackingCookie.Adtrak : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@advertising[2].txt -> TrackingCookie.Advertising : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@advertising[1].txt -> TrackingCookie.Advertising : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@bfast[2].txt -> TrackingCookie.Bfast : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@bluestreak[1].txt -> TrackingCookie.Bluestreak : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@bluestreak[1].txt -> TrackingCookie.Bluestreak : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@burstnet[1].txt -> TrackingCookie.Burstnet : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@casalemedia[2].txt -> TrackingCookie.Casalemedia : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@as.casalemedia[2].txt -> TrackingCookie.Casalemedia : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@casalemedia[1].txt -> TrackingCookie.Casalemedia : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@casinopays[2].txt -> TrackingCookie.Casinopays : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@crbanner.casinopays[2].txt -> TrackingCookie.Casinopays : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@casinopays[2].txt -> TrackingCookie.Casinopays : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@crbanner.casinopays[2].txt -> TrackingCookie.Casinopays : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@casinotropez[1].txt -> TrackingCookie.Casinotropez : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@www.casinotropez[2].txt -> TrackingCookie.Casinotropez : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@casinotropez[2].txt -> TrackingCookie.Casinotropez : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@promo.casinotropez[1].txt -> TrackingCookie.Casinotropez : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@www.casinotropez[1].txt -> TrackingCookie.Casinotropez : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@banner.clubdicecasino[1].txt -> TrackingCookie.Clubdicecasino : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@clubdicecasino[2].txt -> TrackingCookie.Clubdicecasino : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@banner.clubdicecasino[2].txt -> TrackingCookie.Clubdicecasino : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@clubdicecasino[1].txt -> TrackingCookie.Clubdicecasino : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@www.clubdicecasino[1].txt -> TrackingCookie.Clubdicecasino : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@com[2].txt -> TrackingCookie.Com : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@com[2].txt -> TrackingCookie.Com : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@fl01.ct2.comclick[2].txt -> TrackingCookie.Comclick : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@e-2dj6wjliend5kap.stats.esomniture[2].txt -> TrackingCookie.Esomniture : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@e-2dj6wjliqhcjeco.stats.esomniture[2].txt -> TrackingCookie.Esomniture : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@estat[1].txt -> TrackingCookie.Estat : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@estat[1].txt -> TrackingCookie.Estat : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@as-eu.falkag[2].txt -> TrackingCookie.Falkag : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@as-eu.falkag[2].txt -> TrackingCookie.Falkag : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@as-us.falkag[1].txt -> TrackingCookie.Falkag : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@as1.falkag[1].txt -> TrackingCookie.Falkag : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@fastclick[1].txt -> TrackingCookie.Fastclick : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@fastclick[1].txt -> TrackingCookie.Fastclick : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@media.fastclick[1].txt -> TrackingCookie.Fastclick : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@findwhat[1].txt -> TrackingCookie.Findwhat : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@ehg-playboy.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@ehg-shoppersdrugmart.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@hitbox[2].txt -> TrackingCookie.Hitbox : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@ehg-channelwave.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@ehg-franceloisirs.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@ehg-ignitemedia.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@ehg-interlifeform.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@ehg-nvidia.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@hitbox[2].txt -> TrackingCookie.Hitbox : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@w128.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@linksynergy[2].txt -> TrackingCookie.Linksynergy : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@image.masterstats[1].txt -> TrackingCookie.Masterstats : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@banner.newyorkcasino[1].txt -> TrackingCookie.Newyorkcasino : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@data1.perf.overture[1].txt -> TrackingCookie.Overture : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@overture[1].txt -> TrackingCookie.Overture : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@perf.overture[1].txt -> TrackingCookie.Overture : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@paycounter[2].txt -> TrackingCookie.Paycounter : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@ads.pointroll[1].txt -> TrackingCookie.Pointroll : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@qksrv[2].txt -> TrackingCookie.Qksrv : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@questionmarket[1].txt -> TrackingCookie.Questionmarket : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@questionmarket[1].txt -> TrackingCookie.Questionmarket : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@web4.realtracker[2].txt -> TrackingCookie.Realtracker : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@ads1.revenue[1].txt -> TrackingCookie.Revenue : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@revenue[2].txt -> TrackingCookie.Revenue : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@counter15.sextracker[1].txt -> TrackingCookie.Sextracker : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@sextracker[2].txt -> TrackingCookie.Sextracker : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@spylog[1].txt -> TrackingCookie.Spylog : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@statcounter[2].txt -> TrackingCookie.Statcounter : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@tacoda[1].txt -> TrackingCookie.Tacoda : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@targetnet[1].txt -> TrackingCookie.Targetnet : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@trafficmp[2].txt -> TrackingCookie.Trafficmp : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@valueclick[2].txt -> TrackingCookie.Valueclick : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@valueclick[2].txt -> TrackingCookie.Valueclick : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@weborama[1].txt -> TrackingCookie.Weborama : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@wreport.weborama[1].txt -> TrackingCookie.Weborama : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@weborama[1].txt -> TrackingCookie.Weborama : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@c2.zedo[1].txt -> TrackingCookie.Zedo : No action taken.

C:\Documents and Settings\CLAUDE\Cookies\claude@zedo[2].txt -> TrackingCookie.Zedo : No action taken.

C:\Documents and Settings\quentin\Cookies\quentin@zedo[2].txt -> TrackingCookie.Zedo : No action taken.

::Report end

BlackLight :

06/20/06 11:29:17 [info]: BlackLight Engine 1.0.37 initialized

06/20/06 11:29:17 [info]: OS: 5.1 build 2600 (Service Pack 2)

06/20/06 11:29:17 [Note]: 7019 4

06/20/06 11:29:17 [Note]: 7005 0

06/20/06 11:30:38 [Note]: 7006 0

06/20/06 11:30:38 [Note]: 7011 132

06/20/06 11:30:38 [Note]: 7026 0

06/20/06 11:30:39 [Note]: 7026 0

06/20/06 11:30:43 [Note]: FSRAW library version 1.7.1015

06/20/06 11:36:39 [Note]: 7007 0

et enfin HijackThis :

Logfile of HijackThis v1.99.1

Scan saved at 11:54:09, on 20/06/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\QuickTime\qttask.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\Program Files\Wanadoo\EspaceWanadoo.exe

C:\Program Files\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\Program Files\Wanadoo\Watch.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\quentin\Mes documents\Mes eBooks\telechargement divers\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr