[résolu]Trojan-Downloader Win32 Age

candy22 · le 17 juillet 2006

Bonjour à toutes et à tous,

Habituellement je fais très attention à ce que j'exécute, par inadvertance j'ai cliqué sur un .exe, et c'est là qu'on débuté mes problèmes.

Ca a commencé par des alertes de Kaspersky me disant qu'un fichier xxx.exe était infecté par le Trojan-Downloader Win32 Age, du coup je l'ai supprimé puis un autre, puis encore un autre, ça ne s'arrête plus.

Puis a commencé à apparaitre du texte bizarre dans IE : Cliquez pour voir

J'ai fait plusieurs analyses, sans aucun succès, mon antivirus (kaspersky) ne détecte absolument rien, il me prévient uniquement lorsqu'il remarque un fichier infecté (par exemple quand je suis sur msn).

Au bout de nombreuses recherches, je suis tombé sur votre forum, et j'ai pu voir les différents posts que vous aviez traités.

Maintenant c'est à mon tour de venir vous enquiquinez avec mes problèmes.

J'ai bien suivi les instructions dans le post nommé "Pré-Nettoyage d'un PC infecté".

Voici ce que j'obtiens :

Logfile of HijackThis v1.99.1
Scan saved at 21:45:11, on 17/07/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Spam Personal\OESpamTest.exe

C:\WINDOWS\system32\devldr32.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Program Files\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://client.jogo.cn/cdn/browser/sidesear...esearch-en.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://client.jogo.cn/cdn/browser/customse...msearch-en.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: CAISHOW TOOLBAR - {3AF40CB8-B3BA-4E2D-8968-4BF8DB172997} - C:\Program Files\CaiShow Tech\CaiShow\BrowerHelper.dll (file missing)

O2 - BHO: ÍøÂç¼ÓËÙ - {5673A7C0-95CC-4646-BB07-3BD71234CEF9} - C:\WINDOWS\system32\wuwebex.dll

O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll (file missing)

O2 - BHO: ActiveBHO Class - {63C55A7F-6E29-8D4F-5C76-4F850F28D13A} - C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: bg - {7BDAF75A-0D6F-4F50-AFE9-333D08DF4005} - C:\Program Files\baigoo\BGooBHO.dll (file missing)

O2 - BHO: QriZxbtt Class - {93959523-44F5-2B67-2B6D-A952C3EC615E} - C:\WINDOWS\DOWNLO~1\qmkhlw.dll

O2 - BHO: IEHlprObj Class - {999ADFA2-8AD1-47ff-97FC-69FB847458F4} - C:\Progra~1\NetMeeting\nmview.dll

O2 - BHO: WMHlprObj Class - {F5824EFB-728A-4726-A5A5-85A68B20EDC3} - C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll (file missing)

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [KASP] "C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Spam Personal\OESpamTest.exe"

O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kav.exe" /minimize

O4 - HKLM\..\Run: [OESpamTest] C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~3\OESpamTest.ExE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe

O4 - HKCU\..\Run: [caishowmanage] C:\Program Files\CaiShow Tech\CaiShow\UpdateManager.EXE

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: Diskeeper 10 Professional Edition Registration.lnk = C:\Program Files\Diskeeper Corporation\Diskeeper\ESIRegister.exe

O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Chinese Navigation - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll (file missing)

O9 - Extra 'Tools' menuitem: Chinese Navigation - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll (file missing)

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1131975977437

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Bon courage ! :-P

Même si vous ne pouvez pas m'aidé, merci d'avoir prêté attention à mon post,

Un internaute dans la détresse.

Modifié le 21 juillet 2006 par candy22

bruce lee · le 17 juillet 2006

Bonjour,

analyse en cours retour dans 15 minutes

regis56 · le 17 juillet 2006

Bonsoir candy bonsoir bruce

Je laisse la main à bruce.

Modifié le 17 juillet 2006 par regis56

bruce lee · le 17 juillet 2006

re,

Si durant la procedure ci bas, il y a des etapes que tu n'as pas reussi a faire, merci de

continuer la procedure jusqu'au bout et de les signaler dans ta prochaine reponse.

1/Télécharge http://www.ewido.net/en/download/ Ewido anti-spyware

Lance Ewido et clique sur le bouton Update (barre d'outils - au haut). Sous Manual Update clique Start update.

Tu verras ceci juste au bas, lorsque la mise à jour sera complétée : "Update successful"

Ferme Ewido. Ne pas le lancer tout de suite.

2/demarre en mode sans echec http://www.sosordi.net/Faq/Faq.2.html

3/

demarrer/panneau de configuration/ajouts et suppresions de programmes et verifie la presence de:

CaiShow Tech

CNNIC

DoDoorRSSFinder

baigoo

si ces programmes sont presents desinstallent les.

4/lance hijackthis en cliquant sur do a scan system only coche ces lignes:

O2 - BHO: CAISHOW TOOLBAR - {3AF40CB8-B3BA-4E2D-8968-4BF8DB172997} - C:\Program Files\CaiShow Tech\CaiShow\BrowerHelper.dll (file missing)

O2 - BHO: ÍøÂç¼ÓËÙ - {5673A7C0-95CC-4646-BB07-3BD71234CEF9} - C:\WINDOWS\system32\wuwebex.dll

O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll (file missing)

O2 - BHO: ActiveBHO Class - {63C55A7F-6E29-8D4F-5C76-4F850F28D13A} - C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll (file missing)

O2 - BHO: bg - {7BDAF75A-0D6F-4F50-AFE9-333D08DF4005} - C:\Program Files\baigoo\BGooBHO.dll (file missing)

O2 - BHO: QriZxbtt Class - {93959523-44F5-2B67-2B6D-A952C3EC615E} - C:\WINDOWS\DOWNLO~1\qmkhlw.dll

O2 - BHO: WMHlprObj Class - {F5824EFB-728A-4726-A5A5-85A68B20EDC3} - C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll (file missing)

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe

O4 - HKCU\..\Run: [caishowmanage] C:\Program Files\CaiShow Tech\CaiShow\UpdateManager.EXE

O9 - Extra button: Chinese Navigation - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll (file missing)

O9 - Extra 'Tools' menuitem: Chinese Navigation - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll (file missing)

Ferme toutes les fenêtres ouvertes sauf Hijackthis et clique sur fix checked

5/pour supprimer les fichiers nefastes on va tous les afficher en faisant comme ceci:

Démarrer, Poste de travail ou autre dossier, Menu Outils, Option des dossiers, onglet Affichage :
Cocher la case : Afficher les fichiers et dossiers cachés

Décocher la case : Masquer les extensions des fichiers dont le type est connu

Décocher la case : Masquer les fichiers protégés du système d'exploitation

cliquer sur "Appliquer"

cliquer sur le bouton "Appliquer à tous les dossiers" / OK

6/supprime ce qui est en gras:

C:\Program Files\ CaiShow Tech<== tout le dossier

C:\Program Files\ CNNIC<== tout le dossier

C:\Program Files\ baigoo<== tout le dossier

C:\program files\ DoDoorRSSFinder<== tout le dossier

C:\WINDOWS\DOWNLO~1\ qmkhlw.dll<== tout le dossier

7/ Du mode Sans Échec, lance Ewido et clique sur le bouton Scanner (de la barre d'outils) et ensuite clique sur Complete System Scan. Le scan prendra un certain temps, donc sois patient.

Ewido affichera une liste des fichiers détectés, sur la gauche. En fin de scan, l'outil appliquera les "Actions" à appliquer automatiquement. Clique sur le bouton Apply all actions. Ewido affichera "All actions have been applied" du côté droit.

Clique sur "Save Report", puis "Save Report As". Ceci génère un rapport en fichier texte. Assure-toi de le sauvegarder dans un endroit sûr (sur ton Bureau, par exemple).

8/redemarre en mode normal

9/poste le rapport d'ewido ainsi qu'un nouveau log hijackthis.

bon courage, et si tu as la moindre question n'hesite surtout pas

@+

candy22 · le 18 juillet 2006

Bonjour regis56 et Bruce,

Je ne m'attendais pas à avoir une réponse si vite.

Avant de poster le rapport d'ewido ainsi que le nouveau log hijackthis, je souhaite te communiquer quelques détails.

6/supprime ce qui est en gras:

C:\Program Files\ CaiShow Tech<== tout le dossier

C:\Program Files\ CNNIC<== tout le dossier

C:\Program Files\ baigoo<== tout le dossier

C:\program files\ DoDoorRSSFinder<== tout le dossier

Je les avais déjà supprimés en mode normal, bien avant ce message, je me demande si j'aurai dû. :-P

C:\WINDOWS\DOWNLO~1\ qmkhlw.dll<== tout le dossier

Je n'ai n'y trouver le dossier, ni la dll, j'ai même fait une recherche.

Concernant les autres étapes tout c'est bien passer.

Rapport d'ewido :

---------------------------------------------------------
ewido anti-spyware - Scan Report

---------------------------------------------------------

+ Created at: 01:11:59 18/07/2006

+ Scan result:

C:\Program Files\HijackThis\backups\backup-20060717-233619-262.dll -> Adware.Cdn : Cleaned with backup (quarantined).

C:\WINDOWS\system32\cdnns.dll -> Adware.Cdn : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrateur\tool.exe -> Adware.Dm : Cleaned with backup (quarantined).

C:\WINDOWS\system32\wmpcda.exe -> Adware.Dmad : Cleaned with backup (quarantined).

C:\WINDOWS\NDNuninstall6_38.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).

C:\WINDOWS\NDNuninstall6_98.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrateur\Local Settings\Temp\temp.fr7963 -> Adware.NewWeb : Cleaned with backup (quarantined).

C:\WINDOWS\system32\WinSC.dll -> Adware.NewWeb : Cleaned with backup (quarantined).

C:\WINDOWS\system\java.exe -> Adware.NewWeb : Cleaned with backup (quarantined).

C:\Mes fichiers\Logiciel\A-V\Kaspersky_Anti-Hacker_1-1.8.180_www.hackhell.com.zip/Crack/KeyViewer.exe -> Dropper.Agent.xk : Cleaned with backup (quarantined).

C:\Mes fichiers\Logiciel\A-V\Kaspersky_Anti-Hacker_1.8.180_www.hackhell.com.zip/Crack/KeyViewer.exe -> Dropper.Agent.xk : Cleaned with backup (quarantined).

:mozilla.291:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.

:mozilla.292:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.

:mozilla.293:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.

:mozilla.294:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@microsoftwga.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@msninvite.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@opodo.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@redcats.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@sfr.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.342:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@gde.adocean[2].txt -> TrackingCookie.Adocean : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@my.adocean[2].txt -> TrackingCookie.Adocean : Cleaned.

:mozilla.113:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.

:mozilla.114:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.

:mozilla.304:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.

:mozilla.205:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.

:mozilla.496:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.

:mozilla.497:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.

:mozilla.498:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.

:mozilla.69:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.

:mozilla.70:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.

:mozilla.71:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.

:mozilla.72:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.

:mozilla.73:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.

:mozilla.74:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.

:mozilla.85:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned.

:mozilla.428:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Com : Cleaned.

:mozilla.267:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.

:mozilla.268:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.

:mozilla.269:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.

:mozilla.336:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.

:mozilla.89:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Enhance : Cleaned.

:mozilla.414:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Estat : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned.

:mozilla.60:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.

:mozilla.61:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.

:mozilla.63:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.

:mozilla.64:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.

:mozilla.65:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.

:mozilla.86:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Goclick : Cleaned.

:mozilla.87:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Goclick : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@goldenpalace[1].txt -> TrackingCookie.Goldenpalace : Cleaned.

:mozilla.492:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.

:mozilla.502:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.

:mozilla.437:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned.

:mozilla.491:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Hypertracker : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@ivwbox[2].txt -> TrackingCookie.Ivwbox : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@komtrack[2].txt -> TrackingCookie.Komtrack : Cleaned.

:mozilla.66:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.

:mozilla.482:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.

:mozilla.483:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.

:mozilla.484:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.

:mozilla.67:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Overture : Cleaned.

:mozilla.68:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Overture : Cleaned.

:mozilla.305:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.

:mozilla.306:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.

:mozilla.307:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned.

:mozilla.435:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Spylog : Cleaned.

:mozilla.443:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.444:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.445:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.446:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.447:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.448:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.449:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.450:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.451:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.452:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.453:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.454:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.455:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.456:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.457:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.458:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.459:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.20:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.21:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.23:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.24:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.25:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.26:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.27:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.31:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.32:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.35:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.36:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.368:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Trafic : Cleaned.

:mozilla.174:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.

:mozilla.175:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.

:mozilla.171:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.

:mozilla.172:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.

:mozilla.173:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.

:mozilla.481:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.

:mozilla.275:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.276:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.277:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.278:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.279:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.280:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.281:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.282:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.283:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.284:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.285:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

C:\Documents and Settings\Administrateur\Cookies\administrateur@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.375:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

:mozilla.376:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

:mozilla.377:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

:mozilla.378:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

:mozilla.379:C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\0jn8ba7u.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

C:\Downloads\Virtual\VirtualDub-MPEG2_1.6.11_b23787_+_aide_Fr.exe -> Trojan.Ransom.a : Cleaned with backup (quarantined).

::Report end

Nouveau Log hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 11:27:31, on 18/07/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Spam Personal\OESpamTest.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\devldr32.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\ewido anti-spyware 4.0\ewido.exe

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Macromedia\Flash 8\Players\SAFlashPlayer.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://client.jogo.cn/cdn/browser/sidesear...esearch-en.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://client.jogo.cn/cdn/browser/customse...msearch-en.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: IEHlprObj Class - {999ADFA2-8AD1-47ff-97FC-69FB847458F4} - C:\Progra~1\NetMeeting\nmview.dll

O4 - HKLM\..\Run: [KASP] "C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Spam Personal\OESpamTest.exe"

O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kav.exe" /minimize

O4 - HKLM\..\Run: [OESpamTest] C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~3\OESpamTest.ExE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: Diskeeper 10 Professional Edition Registration.lnk = C:\Program Files\Diskeeper Corporation\Diskeeper\ESIRegister.exe

O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1131975977437

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Voici ce que je vois dans IE à présent : Voir.

Depuis ce virus, je ne rencontre que des problèmes d'explorer, si j'ouvre Mes Documents et Poste de travail en même temps, explorer se fige, il faut alors ouvrir le gestionnaire de taches pour redémarrer le pc.

Je ne peux même plus travailler sur mon ordinateur.

Candy22 :-(

bruce lee · le 18 juillet 2006

candy,

Ok, ton rapport hijackthis est propre, tu as fait du bon boulot

On va verifié si des bestioles se lancent en silence:

1/telecharge silent runners http://www.silentrunners.org/Silent%20Runners.vbs

(fait clique droit sur le lien, puis enregistrer la cible sous)

2/déconnecte toi du net et ferme toutes les applications en cours.

3/lance silent runners laisse le travailler quand il aura finit de scanner tu en sauras averti par un message et un nouveau fichier texte sera crée ouvre ce fichier texte et colle la totalité du rapport.

candy22 · le 18 juillet 2006

Je ne sais pas par quel miracle, alors que ce matin encore, je rencontrais des erreurs et bugs.

La je viens de redémarrer mon pc et pour l'instant tout va bien, aucune erreur, aucune alerte, aucun problème explorer.

Espérons que ça dure.

Ok, ton rapport hijackthis est propre, tu as fait du bon boulot

Je n'ai fait que suivre tes instructions.

Rapport :

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:

---------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"KASP" = ""C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Spam Personal\OESpamTest.exe"" ["Ashmanov & Partners"]

"KAVPersonal50" = ""C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kav.exe" /minimize" ["Kaspersky Lab"]

"OESpamTest" = "C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~3\OESpamTest.ExE" ["Ashmanov & Partners"]

"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]

"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]

"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]

"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]

"DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"]

"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data]

"!ewido" = ""C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Active Setup\Installed Components\

>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}\(Default) = "Outlook Express"

\StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)

-> {HKLM...CLSID} = "AcroIEHlprObj Class"

\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

-> {HKLM...CLSID} = "SSVHelper Class"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

{999ADFA2-8AD1-47ff-97FC-69FB847458F4}\(Default) = (no title provided)

-> {HKLM...CLSID} = "IEHlprObj Class"

\InProcServer32\(Default) = "C:\Progra~1\NetMeeting\nmview.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"

-> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"

\InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"

-> {HKLM...CLSID} = "HyperTerminal Icon Ext"

\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]

"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"

-> {HKLM...CLSID} = "AlcoholShellEx"

\InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]

"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"

-> {HKLM...CLSID} = "DesktopContext Class"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"

-> {HKLM...CLSID} = "Desktop Explorer"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"

-> {HKLM...CLSID} = "nView Desktop Context Menu"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"

-> {HKLM...CLSID} = "Shell Search Band"

\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]

"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"

-> {HKLM...CLSID} = "Portable Media Devices"

\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]

"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"

-> {HKLM...CLSID} = "Portable Media Devices Menu"

\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]

"{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}" = "TuneUp Shredder Shell Context Menu Extension"

-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"

\InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

"{906b0e6e-61ce-11d3-8ee2-0060080a7242}" = "QuickSFV Shell Extension"

-> {HKLM...CLSID} = "QuickSFV Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\QuickSFV\QSFVShll.dll" ["Mercedes"]

"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"

-> {HKLM...CLSID} = "Microsoft Office Outlook"

\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"

-> {HKLM...CLSID} = "Outlook File Icon Extension"

\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]

"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"

-> {HKLM...CLSID} = "NVIDIA CPL Extension"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

"{B8323370-FF27-11D2-97B6-204C4F4F5020}" = "SmartFTP Shell Extension DLL"

-> {HKLM...CLSID} = "SmartFTP Shell Extension DLL"

\InProcServer32\(Default) = "C:\Program Files\SmartFTP Client 2.0\smarthook.dll" ["SmartFTP"]

"{1CE8B2C9-EAEF-43fc-8218-F092E4F94A47}" = "Notepad++ Shell Extension"

-> {HKLM...CLSID} = "Notepad++ Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Notepad++\nppshellext.dll" ["Notepad++ team"]

"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"

-> {HKLM...CLSID} = "Mes dossiers de partage"

\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0787.00.dll" [MS]

"{8DE0B272-74FA-1FD1-B7DA-0CA0C9B348D6}" = "&DoDoor RSS Finder"

-> {HKLM...CLSID} = "&DoDoor RSS Finder"

\InProcServer32\(Default) = "C:\Progra~1\DoDoorRSSFinder\BandObjs.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\

INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"

-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"

\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\Software\Classes\PROTOCOLS\Filter\

INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"

-> {HKLM...CLSID} = "PDF Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\

ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"

-> {HKLM...CLSID} = "CContextScan Object"

\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]

Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\shellex.dll" ["Kaspersky Lab"]

NppShellExt\(Default) = "{1CE8B2C9-EAEF-43fc-8218-F092E4F94A47}"

-> {HKLM...CLSID} = "Notepad++ Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Notepad++\nppshellext.dll" ["Notepad++ team"]

QuickSFV Shell Extension\(Default) = "{906b0e6e-61ce-11d3-8ee2-0060080a7242}"

-> {HKLM...CLSID} = "QuickSFV Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\QuickSFV\QSFVShll.dll" ["Mercedes"]

TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"

-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"

\InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"

-> {HKLM...CLSID} = "CContextScan Object"

\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]

NppShellExt\(Default) = "{1CE8B2C9-EAEF-43fc-8218-F092E4F94A47}"

-> {HKLM...CLSID} = "Notepad++ Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Notepad++\nppshellext.dll" ["Notepad++ team"]

QuickSFV Shell Extension\(Default) = "{906b0e6e-61ce-11d3-8ee2-0060080a7242}"

-> {HKLM...CLSID} = "QuickSFV Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\QuickSFV\QSFVShll.dll" ["Mercedes"]

TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"

-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"

\InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\shellex.dll" ["Kaspersky Lab"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

-> {HKLM...CLSID} = "WinRAR"

\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:

-----------------------------

Active Desktop is disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\

"Wallpaper" = "C:\Documents and Settings\Administrateur\Mes documents\Mes images\raw.bmp"

Enabled Screen Saver:

---------------------

HKCU\Control Panel\Desktop\

"SCRNSAVE.EXE" = "C:\WINDOWS\System32\scrnsave.scr" [MS]

Startup items in "Administrateur" & "All Users" startup folders:

----------------------------------------------------------------

C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage

"Adobe Gamma" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]

"Diskeeper 10 Professional Edition Registration" -> shortcut to: "C:\Program Files\Diskeeper Corporation\Diskeeper\ESIRegister.exe /remind /language=FRA /PRNM="Diskeeper 10 Professional Edition"" ["Leader Technologies/Diskeeper Coporation"]

C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage

"Kaspersky Anti-Hacker" -> shortcut to: "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe /silence" ["Kaspersky Lab"]

Enabled Scheduled Tasks:

------------------------

"Maintenance en 1 clic" -> launches: "C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]

Winsock2 Service Provider DLLs:

-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:

------------------------------------

Explorer Bars

HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\

{8DE0B272-74FA-1FD1-B7DA-0CA0C9B348D6}\(Default) = (no title provided)

-> {HKLM...CLSID} = "&DoDoor RSS Finder"

\InProcServer32\(Default) = "C:\Progra~1\DoDoorRSSFinder\BandObjs.dll" [file not found]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Console Java (Sun)"

"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"

-> {HKCU...CLSID} = "Java Plug-in"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\

"ButtonText" = "Recherche"

{E19ADC6E-3909-43E4-9A89-B7B676377EE3}\

"ButtonText" = "Sothink SWF Catcher"

"MenuText" = "Sothink SWF Catcher"

"Script" = "C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm" [null data]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\

"ButtonText" = "Messenger"

"MenuText" = "Windows Messenger"

"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

Miscellaneous IE Hijack Points

------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):

[strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"

Missing lines (compared with English-language version):

[strings]: 1 line

HKLM\Software\Microsoft\Internet Explorer\AboutURLs\

HIJACK WARNING! "TuneUp" = "file://C|/Documents and Settings/All Users.WINDOWS/Application Data/TuneUp Software/Common/base.css" [file not found]

Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------

Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"]

ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]

kavsvc, kavsvc, ""C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kavsvc.exe"" ["Kaspersky Lab"]

NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]

Service Messenger Sharing USN Journal Reader, usnsvc, "C:\WINDOWS\system32\svchost.exe -k usnsvc" {"C:\Program Files\MSN Messenger\usnsvc.dll" [MS]}

StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]

Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:

---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\

Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]

----------

+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

+ To search all directories of local fixed drives for DESKTOP.INI

DLL launch points and all Registry CLSIDs for dormant Explorer Bars,

use the -supp parameter or answer "No" at the first message box.

---------- (total run time: 31 seconds, including 8 seconds for message boxes)

Un grand merci à toi Bruce.

bruce lee · le 18 juillet 2006

re,

content que tu n'es pu de problemes

Mais par mesure de precaution:

Fais un scan en ligne avec http://webscanner.kaspersky.fr/

Sous Démonstration en ligne , on t'explique la marche à suivre , et pour lancer le scan il faut sélectionner Exécuter l'analyse en ligne .Le scan ne marche que sous Internet Explorer.

On va te demander de télécharger un contôle active x, accepte .

Dans le menu Choisissez la cible de l'analyse , sélectionne Poste de travail .

Le scan va commencer.Poste le rapport qui sera généré stp.

Si il y a un problème, assure toi que les contrôles active x sont bien configurés dans les options internet comme

décrit sur ce lien=> http://www.inoculer.com/activex.php3

NOTE: le scan est a faire avec Internet Explorer

@+

candy22 · le 18 juillet 2006

Je rencontre un problème avec cette analyse, je clique sur "J'accepte" puis clique droit sur la petite barre en haut (comme la démo) seulement il me ramène à la page avec les conditions et plus rien ne se passe.

Je viens de me rendre compte sous IE quand je fais clique droit, j'ai une ligne avec des signes bizarres (comme sur mes précédents screens).

Que faire ?

Tout petit détail, j'ai perdu touts mes favoris depuis Ewido.

bruce lee · le 18 juillet 2006

re,

as tu bien parametré les activeX?

Si oui et que le scan ne marhce toujours pas, essaye ce scan la:

http://www.pandasoftware.com/activescan/fr...n_principal.htm

tuto pour panda http://www.monaco-pro.com/cool-life/tuto/panda/tuto.htm

a la fin du scan tu cliques sur "consulter le rapport",tu le sauvegardes et tu le posts.

Tout petit détail, j'ai perdu touts mes favoris depuis Ewido.

ca m'etonnerait que ca soit ewido, je le fais utiliser depuis pas mal de temps, et personne a eu ce probleme... On verra ce probleme plus tard si tu veux bien.

Connexion

Pas encore inscrit ?

[résolu]Trojan-Downloader Win32 Age

Messages recommandés

candy22

bruce lee

regis56

bruce lee

candy22

bruce lee

candy22

bruce lee

candy22

bruce lee

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer