Votre question

probleme virus, publicitée intempestives , CID

Tags :
  • Sécurité
Dernière réponse : dans Sécurité et virus
14 Avril 2008 12:52:00

bonjour!
je poste un sujet car, cela fait un petit moment que je reçois des publicitées (intempestivement ^^) du cid, j'ai désinstallé le sponsor de windows live messenger , mais sa ne change rien ,et mon pc est lent ,je pense avoir chopé un virus , donc sa serais simpa si quelqu'un pouvais m'aider à solutionner le probleme , svp ,
voici le HijackThis ,merci d'avance !!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:51:40, on 14/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\a-squared free\a2service.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FSPC\fspc.exe
C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Pack Securite\Common\FSM32.EXE
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Ares\Ares.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\WILLIAM\Local Settings\Temporary Internet Files\Content.IE5\IZOUSHBE\HiJackThis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P36 "EPSON Stylus CX3600 Series (Copie 1)" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [HerculesCamService] C:\Program Files\Hercules\Hercules DualPix HD Webcam\CamService.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [copy real junk the] C:\Documents and Settings\All Users\Application Data\Name beep copy real\Store Program.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Software move] C:\DOCUME~1\WILLIAM\APPLIC~1\TIMECH~1\ElseOpen.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support de Cyber-shot Viewer.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986....
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown....
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.ca...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Co...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.ca...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F0DB2599-A856-4FA7-823A-CDF4CB6FE791}: NameServer = 212.27.32.176,212.27.32.177
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O24 - Desktop Component 1: YouTube - décés de gregory lemarchal ! hommage - http://www.youtube.com/watch?v=jtT_tZFdEd0

--
End of file - 11514 bytes

Autres pages sur : probleme virus publicitee intempestives cid

14 Avril 2008 14:15:52

bonjour
pour les lenteurs, il te faut un seul antivirus... alors que tu en as 2.

désinstaller -antivirus

Télécharge Lop S&D.exe sur ton bureau

  • Double-clique dessus pour lancer l'installation
  • Puis double-clique sur le raccourci Lop S&D présent sur ton bureau
  • Séléctionne la langue souhaitée , puis choisis l'Option 1 ( Recherche )
  • Patiente jusqu'à la fin du scan
  • Poste le rapport généré ( C:\lopR.txt )

    ( Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide )
    14 Avril 2008 14:43:16

    re!
    merci ! j'ai désinstallé un de mes antivirus , voici le scan :

    -----------------------[ Lop S&D 4.1.0-9 XP/Vista ]---------------------

    [ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
    [ USER : WILLIAM ] [ "C:\Lop SD" ]
    [ 14/04/2008 | 14:37:51,78 ] [ PC : CHLOE ]
    [ MAJ : 08-04-2008 | 23:37 ]

    -------------[ Listing des dossiers dans Application Data ]------------

    [30/03/2008|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.
    [30/03/2008|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\..
    [22/02/2005|12:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
    [14/04/2008|14:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure
    [21/07/2007|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\fssg
    [27/03/2007|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
    [16/09/2007|13:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
    [08/09/2007|16:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
    [30/03/2008|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Name beep copy real
    [08/04/2005|16:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
    [10/11/2005|20:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
    [18/09/2005|14:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Samsung
    [19/07/2007|11:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware370
    [20/03/2005|20:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
    [11/04/2007|11:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
    [04/04/2007|21:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
    [30/03/2008|14:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
    [01/09/2007|17:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

    [15/12/2007|16:08] C:\DOCUME~1\BeLlA\APPLIC~1\.
    [15/12/2007|16:08] C:\DOCUME~1\BeLlA\APPLIC~1\..
    [22/02/2005|12:34] C:\DOCUME~1\BeLlA\APPLIC~1\desktop.ini
    [16/03/2005|11:26] C:\DOCUME~1\BeLlA\APPLIC~1\Identities
    [14/12/2007|18:44] C:\DOCUME~1\BeLlA\APPLIC~1\Macromedia
    [14/12/2007|20:41] C:\DOCUME~1\BeLlA\APPLIC~1\Microsoft
    [15/12/2007|16:08] C:\DOCUME~1\BeLlA\APPLIC~1\Smart Panel


    [16/03/2005|11:26] C:\DOCUME~1\DEFAUL~1\APPLIC~1\.
    [16/03/2005|11:26] C:\DOCUME~1\DEFAUL~1\APPLIC~1\..
    [22/02/2005|12:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
    [16/03/2005|11:26] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
    [16/03/2005|11:27] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

    [16/03/2005|11:26] C:\DOCUME~1\LOCALS~1\APPLIC~1\.
    [16/03/2005|11:26] C:\DOCUME~1\LOCALS~1\APPLIC~1\..
    [13/05/2007|14:17] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

    [16/03/2005|11:26] C:\DOCUME~1\NETWOR~1\APPLIC~1\.
    [16/03/2005|11:26] C:\DOCUME~1\NETWOR~1\APPLIC~1\..
    [16/03/2005|11:26] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

    [06/02/2008|14:36] C:\DOCUME~1\WILLIAM\APPLIC~1\.
    [06/02/2008|14:36] C:\DOCUME~1\WILLIAM\APPLIC~1\..
    [06/02/2008|14:36] C:\DOCUME~1\WILLIAM\APPLIC~1\Adobe
    [22/02/2005|12:34] C:\DOCUME~1\WILLIAM\APPLIC~1\desktop.ini
    [20/01/2008|20:19] C:\DOCUME~1\WILLIAM\APPLIC~1\dvdcss
    [02/10/2006|19:50] C:\DOCUME~1\WILLIAM\APPLIC~1\EPSON
    [03/01/2008|21:42] C:\DOCUME~1\WILLIAM\APPLIC~1\F-Secure
    [08/04/2005|16:03] C:\DOCUME~1\WILLIAM\APPLIC~1\Help
    [16/03/2005|11:26] C:\DOCUME~1\WILLIAM\APPLIC~1\Identities
    [16/09/2006|14:09] C:\DOCUME~1\WILLIAM\APPLIC~1\LG Electronics
    [05/01/2007|22:50] C:\DOCUME~1\WILLIAM\APPLIC~1\Macromedia
    [30/03/2008|13:44] C:\DOCUME~1\WILLIAM\APPLIC~1\Microsoft
    [18/09/2005|20:07] C:\DOCUME~1\WILLIAM\APPLIC~1\Microsoft Web Folders
    [08/09/2007|16:04] C:\DOCUME~1\WILLIAM\APPLIC~1\MSNInstaller
    [26/12/2006|19:52] C:\DOCUME~1\WILLIAM\APPLIC~1\SecuROM
    [04/09/2007|10:47] C:\DOCUME~1\WILLIAM\APPLIC~1\Smart Panel
    [30/11/2006|17:36] C:\DOCUME~1\WILLIAM\APPLIC~1\Sony Corporation
    [19/07/2007|11:44] C:\DOCUME~1\WILLIAM\APPLIC~1\Starware370
    [30/03/2008|13:22] C:\DOCUME~1\WILLIAM\APPLIC~1\Timechinbind
    [30/12/2006|15:46] C:\DOCUME~1\WILLIAM\APPLIC~1\vlc
    [14/11/2007|15:22] C:\DOCUME~1\WILLIAM\APPLIC~1\Windows Live Writer

    ----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

    [14/04/2008 14:15][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
    [05/08/2004 14:00][-rah-----] C:\WINDOWS\tasks\desktop.ini
    [14/04/2008 14:36][--ah-----] C:\WINDOWS\tasks\SA.DAT

    ---------------[ Listing des dossiers dans C:\Program Files ]--------------

    [30/03/2008|13:21] C:\Program Files\.
    [30/03/2008|13:21] C:\Program Files\..
    [20/07/2006|11:59] C:\Program Files\3DO
    [16/09/2007|12:09] C:\Program Files\Adverts
    [15/06/2005|18:29] C:\Program Files\Ahead
    [02/12/2005|13:18] C:\Program Files\Alwil Software
    [16/03/2005|11:26] C:\Program Files\Analog Devices
    [27/07/2007|20:15] C:\Program Files\Ares
    [31/08/2007|20:02] C:\Program Files\a-squared Free
    [01/09/2007|17:48] C:\Program Files\CCleaner
    [12/04/2008|18:35] C:\Program Files\Circle Developement
    [16/03/2005|11:26] C:\Program Files\ComPlus Applications
    [02/07/2007|19:53] C:\Program Files\EA GAMES
    [25/08/2007|16:41] C:\Program Files\eMule
    [04/09/2007|11:09] C:\Program Files\epson
    [14/11/2007|14:19] C:\Program Files\Fichiers communs
    [05/04/2007|19:47] C:\Program Files\Hercules
    [25/08/2007|16:33] C:\Program Files\IncrediMail
    [10/09/2007|17:47] C:\Program Files\InstallShield Installation Information
    [16/03/2005|11:26] C:\Program Files\Intel
    [12/04/2008|13:29] C:\Program Files\Internet Explorer
    [25/08/2007|16:31] C:\Program Files\JS Star
    [16/09/2006|13:56] C:\Program Files\LG Electronics
    [16/09/2006|13:55] C:\Program Files\LG PC Suite
    [16/03/2005|11:26] C:\Program Files\MadOnion.com
    [07/04/2007|10:42] C:\Program Files\Messenger
    [30/03/2008|13:20] C:\Program Files\Messenger Plus! Live
    [24/07/2006|11:19] C:\Program Files\Microsoft AutoRoute
    [12/04/2005|20:15] C:\Program Files\Microsoft Encarta
    [18/09/2005|20:06] C:\Program Files\microsoft frontpage
    [18/04/2007|14:02] C:\Program Files\Microsoft LifeCam
    [18/09/2005|20:07] C:\Program Files\Microsoft Office
    [14/11/2007|14:27] C:\Program Files\Microsoft SQL Server Compact Edition
    [18/09/2005|20:09] C:\Program Files\Microsoft Visual Studio
    [16/03/2005|11:26] C:\Program Files\Movie Maker
    [16/06/2005|14:58] C:\Program Files\MSN
    [16/03/2005|11:26] C:\Program Files\MSN Gaming Zone
    [07/04/2007|10:40] C:\Program Files\MSXML 4.0
    [16/03/2005|11:26] C:\Program Files\NetMeeting
    [04/04/2007|20:17] C:\Program Files\Neuf
    [16/03/2005|11:26] C:\Program Files\Online Services
    [13/06/2007|21:59] C:\Program Files\Outlook Express
    [14/04/2008|14:36] C:\Program Files\Pack Securite
    [21/11/2005|20:04] C:\Program Files\PonyGirl
    [10/11/2005|20:05] C:\Program Files\QuickTime
    [02/12/2005|17:34] C:\Program Files\RegSupreme
    [18/09/2005|14:19] C:\Program Files\Samsung
    [16/03/2005|11:26] C:\Program Files\Services en ligne
    [22/07/2005|18:21] C:\Program Files\Smart Panel
    [21/09/2005|13:13] C:\Program Files\Snapshot Viewer
    [22/08/2007|18:13] C:\Program Files\Sony
    [22/04/2007|13:54] C:\Program Files\Starware370
    [15/01/2006|17:58] C:\Program Files\Styliste3
    [30/03/2008|13:21] C:\Program Files\Timechinbind
    [10/09/2007|17:47] C:\Program Files\TomTom HOME
    [26/12/2006|19:46] C:\Program Files\UbiSoft
    [16/03/2005|11:26] C:\Program Files\Uninstall Information
    [30/12/2006|15:41] C:\Program Files\VideoLAN
    [28/02/2008|22:50] C:\Program Files\Windows Live
    [13/04/2008|19:43] C:\Program Files\Windows Live Safety Center
    [31/10/2007|15:27] C:\Program Files\Windows Live Toolbar
    [13/05/2007|14:03] C:\Program Files\Windows Media Connect 2
    [13/05/2007|14:16] C:\Program Files\Windows Media Player
    [16/03/2005|11:26] C:\Program Files\Windows NT
    [16/03/2005|11:26] C:\Program Files\WindowsUpdate
    [16/03/2005|11:26] C:\Program Files\xerox
    [01/09/2007|17:48] C:\Program Files\Yahoo!

    ------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

    [14/11/2007|14:19] C:\Program Files\Fichiers communs\.
    [14/11/2007|14:19] C:\Program Files\Fichiers communs\..
    [18/09/2005|20:09] C:\Program Files\Fichiers communs\Designer
    [27/03/2007|20:43] C:\Program Files\Fichiers communs\InstallShield
    [14/11/2007|14:21] C:\Program Files\Fichiers communs\Microsoft Shared
    [16/03/2005|11:26] C:\Program Files\Fichiers communs\MSSoap
    [16/03/2005|11:26] C:\Program Files\Fichiers communs\ODBC
    [16/03/2005|11:26] C:\Program Files\Fichiers communs\Services
    [16/03/2005|11:26] C:\Program Files\Fichiers communs\SpeechEngines
    [13/06/2007|21:59] C:\Program Files\Fichiers communs\System
    [14/11/2007|14:20] C:\Program Files\Fichiers communs\WindowsLiveInstaller

    ----------------------[ Recherche avec S_Lop ]---------------------

    C:\DOCUME~1\WILLIAM\LOCALS~1\Temp\bis13E.exe
    C:\DOCUME~1\WILLIAM\LOCALS~1\Temp\bis51.exe

    -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Name beep copy real
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Name beep copy real\Store Program.exe
    C:\Program Files\Adverts
    C:\Program Files\Circle Developement
    C:\Program Files\Circle Developement\Uninstall.0xe

    ----------------------[ Verification du Registre ]----------------------

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "copy real junk the"="C:\\Documents and Settings\\All Users\\Application Data\\Name beep copy real\\Store Program.exe"

    --------------------[ Verification du fichier Hosts ]---------------------

    Fichier Hosts MODIFIE

    127.0.0.1 bin.errorprotector.com ## added by CiD
    127.0.0.1 br.errorsafe.com ## added by CiD
    127.0.0.1 br.winantivirus.com ## added by CiD
    127.0.0.1 br.winfixer.com ## added by CiD
    127.0.0.1 cdn.drivecleaner.com ## added by CiD
    127.0.0.1 cdn.errorsafe.com ## added by CiD
    127.0.0.1 cdn.winsoftware.com ## added by CiD
    127.0.0.1 de.errorsafe.com ## added by CiD
    127.0.0.1 de.winantivirus.com ## added by CiD
    127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
    127.0.0.1 download.cdn.errorsafe.com ## added by CiD
    127.0.0.1 download.cdn.winsoftware.com ## added by CiD
    127.0.0.1 download.errorsafe.com ## added by CiD
    127.0.0.1 download.systemdoctor.com ## added by CiD
    127.0.0.1 download.winantispyware.com ## added by CiD
    127.0.0.1 download.windrivecleaner.com ## added by CiD
    127.0.0.1 download.winfixer.com ## added by CiD
    127.0.0.1 drivecleaner.com ## added by CiD
    127.0.0.1 dynamique.drivecleaner.com ## added by CiD
    127.0.0.1 errorprotector.com ## added by CiD
    127.0.0.1 errorsafe.com ## added by CiD
    127.0.0.1 es.winantivirus.com ## added by CiD
    127.0.0.1 fr.winantivirus.com ## added by CiD
    127.0.0.1 fr.winfixer.com ## added by CiD
    127.0.0.1 go.drivecleaner.com ## added by CiD
    127.0.0.1 go.errorsafe.com ## added by CiD
    127.0.0.1 go.winantispyware.com ## added by CiD
    127.0.0.1 go.winantivirus.com ## added by CiD
    127.0.0.1 hk.winantivirus.com ## added by CiD
    127.0.0.1 instlog.errorsafe.com ## added by CiD
    127.0.0.1 instlog.winantivirus.com ## added by CiD
    127.0.0.1 instlog.winfixer.com ## added by CiD
    127.0.0.1 jsp.drivecleaner.com ## added by CiD
    127.0.0.1 kb.errorsafe.com ## added by CiD
    127.0.0.1 kb.winantivirus.com ## added by CiD
    127.0.0.1 nl.errorsafe.com ## added by CiD
    127.0.0.1 se.errorsafe.com ## added by CiD
    127.0.0.1 secure.drivecleaner.com ## added by CiD
    127.0.0.1 secure.errorsafe.com ## added by CiD
    127.0.0.1 secure.winantispam.com ## added by CiD
    127.0.0.1 secure.winantispy.com ## added by CiD
    127.0.0.1 secure.winantivirus.com ## added by CiD
    127.0.0.1 support.winantivirus.com ## added by CiD
    127.0.0.1 trial.updates.winsoftware.com ## added by CiD
    127.0.0.1 ulog.winantivirus.com ## added by CiD
    127.0.0.1 utils.errorsafe.com ## added by CiD
    127.0.0.1 utils.winantivirus.com ## added by CiD
    127.0.0.1 utils.winfixer.com ## added by CiD
    127.0.0.1 winantispyware.com ## added by CiD
    127.0.0.1 winantivirus.com ## added by CiD
    127.0.0.1 winfixer.com ## added by CiD
    127.0.0.1 winfixer2006.com ## added by CiD
    127.0.0.1 winsoftware.com ## added by CiD
    127.0.0.1 www.drivecleaner.com ## added by CiD
    127.0.0.1 www.errorprotector.com ## added by CiD
    127.0.0.1 www.errorsafe.com ## added by CiD
    127.0.0.1 www.systemdoctor.com ## added by CiD
    127.0.0.1 www.utils.winfixer.com ## added by CiD
    127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
    127.0.0.1 www.win-virus-pro.com ## added by CiD
    127.0.0.1 www.winantispam.com ## added by CiD
    127.0.0.1 www.winantispy.com ## added by CiD
    127.0.0.1 www.winantispyware.com ## added by CiD
    127.0.0.1 www.winantivirus.com ## added by CiD
    127.0.0.1 www.winantiviruspro.com ## added by CiD
    127.0.0.1 www.windrivecleaner.com ## added by CiD
    127.0.0.1 www.windrivesafe.com ## added by CiD
    127.0.0.1 www.winfixer.com ## added by CiD
    127.0.0.1 www.winfixer2006.com ## added by CiD
    127.0.0.1 www.winsoftware.com ## added by CiD

    -> 72 ( 70 ## added by CiD )

    /!\ 1 Not 127.0.0.1 !!

    ----------------[ Recherche de fichiers avec Catchme ]-----------------

    catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-14 14:39:18
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden files ...
    scan completed successfully
    hidden processes: 0
    hidden files: 0

    --------------------[ Recherche d'autres infections ]---------------------

    Aucune autre infection trouvée !

    /!\ [Fich:1573][Doss:24] C:\DOCUME~1\WILLIAM\LOCALS~1\Temp
    /!\ [Fich:610][Doss:0] C:\DOCUME~1\WILLIAM\Cookies
    /!\ [Fich:8854][Doss:34] C:\DOCUME~1\WILLIAM\LOCALS~1\TEMPOR~1\content.IE5

    --------------------[ Fin du rapport a 14:40:55,90 ]----------------------
    14 Avril 2008 19:07:14

    re

    1

    ~Télécharge OTMoveIt (d'OldTimer). Sauvegarde-le sur ton Bureau.

    ~Lance Hijackthis “Do a system scan only”.
    Coche les lignes qui suivent si encore présentes et uniquement celles-là.

    O4 - HKCU\..\Run: [Software move] C:\DOCUME~1\WILLIAM\APPLIC~1\TIMECH~1\ElseOpen.exe

    Clique sur Fix checked (en bas à gauche)


    Sélectionne TOUS les emplacements en gras ci-dessous :

    C:\DOCUME~1\WILLIAM\APPLIC~1\Timechinbind
    C:\Program Files\Timechinbind


    ---> Clique-droit puis Copier (ou Ctrl+C)

    Double-clique sur OTMoveIt.exe afin de le lancer.
    Fais un Clique-droit sur le cadre de gauche puis choisis Coller (ou Ctrl+V).
    Clique maintenant sur MoveIt![/#f]

    [#ff0e00]Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.

    Accepte en cliquant sur YES.

    Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
    Le nom du rapport correspond au moment de sa création : date_heure.log

    2

    Relance Lop S&D

  • Choisis cette fois ci l'Option 2 ( Suppression )
  • Ne ferme pas la fenêtre lors de la suppression !
  • Poste le rapport généré ( C:\lopR.txt )

    ( Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide )

    Tom's guide dans le monde
    • Allemagne
    • Italie
    • Irlande
    • Royaume Uni
    • Etats Unis
    Suivre Tom's Guide
    Inscrivez-vous à la Newsletter
    • ajouter à twitter
    • ajouter à facebook
    • ajouter un flux RSS