Besoin d'aide SVP!! Msn et virus photo
Forum Sécurité - Virus : Besoin d'aide SVP!! Msn et virus photo
A ce que je vois c'est le problème a la mode je viens m'ajouter a la liste des gens qui se sont fa
qui se sont fait bêtement avoir en acceptant un fichier photo d'un de ses contacts msn!
j'ai vu qu'il y avait plusieurs méthodes pour regler le problème mais je ne sait pas laquelle faire et si je pouvais obtenir un petit coup de main ça m'aiderai beucoup
Merci d'avance bonne soirée
Je ne sait pas si ça peut servir mais je poste le rapport hijakthis:
Logfile of HijackThis v1.99.1
Scan saved at 20:13:21, on 15/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32\nvsysrot.dll,Enable
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: syshelps - {4DEF5D67-94A2-4A16-A998-A58DD536DCCD} - syshelps.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
voici le rapport MSN fix dans la lancée
MSN_Fix 1.316
C:\Documents and Settings\P'tit Gibus\Bureau\Guillaume\Logiciels\MSNFix
Fix exécuté le 15/06/2007 - 20:25:54,82 By P'tit Gibus
mode normal
************************ Recherche les fichiers présents
... C:\WINDOWS\system32\syshelps.dll
... C:\WINDOWS\photos.zip
************************ Recherche les dossiers présents
Aucun dossier trouvé
************************ Suppression des fichiers
/!\ ... C:\WINDOWS\system32\syshelps.dll
.. OK ... C:\WINDOWS\photos.zip
************************ Nettoyage du registre
.......... OK
Les fichiers encore présents seront supprimés au prochain redémarrage
Aucun dossier trouvé
************************ Suppression des fichiers
/!\ ... C:\WINDOWS\system32\syshelps.dll
Les fichiers encore présents seront supprimés au prochain redémarrage
Aucun dossier trouvé
************************ Suppression des fichiers
/!\ ... C:\WINDOWS\system32\syshelps.dll
************************ Fichiers suspects
/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention
[C:\WINDOWS\cfdemo.scr] 7065EA78122F0FFA97CC564CFBD61E61
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 15062007_20264907.zip
------------------------------------------------------------------------
Auteur : !aur3n7 Contact: http://246694.aceboard.fr
------------------------------------------------------------------------
--------------------------------------------- END ---------------------------------------------
Voici pour terminer le rapport clean:
15/06/2007 a 20:31:16,57
*** Recherche des fichiers dans C:
*** Recherche des fichiers dans C:\WINDOWS\
*** Recherche des fichiers dans C:\WINDOWS\system32
C:\WINDOWS\system32\syshelps.dll FOUND
*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !
Voila bonne lecture et merci d'avance a la personne qui pourra m'aider
Allo que dois-je faire???
Bon bah jcontinue en faisant le max de trucs tout seul si qq peut me dire si ca a marché au final ca serai sympa
J'ai fait un scan complet en mode sans echec avec AVG SP je poste le rapport:
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------
+ Créé à: 14:23:46 16/06/2007
+ Résultat de l'analyse:
C:\Documents and Settings\P'tit Gibus\Bureau\Guillaume\Logiciels\MSNFix\15062007_20264907.zip/backup/photos.zip/webcam_photos-2007-06.scr -> Backdoor.IRCBot.aaq : Nettoyé.
C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP165\A0053866.scr -> Backdoor.IRCBot.aaq : Nettoyé.
C:\Documents and Settings\P'tit Gibus\Bureau\Guillaume\Logiciels\MSNFix\15062007_20264907.zip/backup/syshelps.dll -> Backdoor.IRCBot.acd : Nettoyé.
C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP164\A0053776.dll -> Backdoor.IRCBot.acd : Nettoyé.
C:\WINDOWS\system32\syshelps.dll -> Backdoor.IRCBot.acd : Nettoyé.
:mozilla.139:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.171:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.70:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.71:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.72:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.108:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.109:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.110:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.111:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.48:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.49:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.61:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.62:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.63:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.64:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.21:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.41:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.220:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.221:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.222:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.223:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.68:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Com : Nettoyé.
:mozilla.69:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Com : Nettoyé.
:mozilla.57:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.58:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.60:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.37:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\P'tit Gibus\Cookies\p'tit gibus@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.210:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.88:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.89:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.90:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.91:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.95:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.96:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.201:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.7:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.26:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.102:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.103:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.104:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.128:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.129:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.130:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.131:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.132:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.133:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.16:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.17:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.18:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.27:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.28:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.65:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.66:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.43:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.44:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\jp\Cookies\jp@m.webtrends[2].txt -> TrackingCookie.Webtrends : Nettoyé.
:mozilla.100:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.99:C:\Documents and Settings\P'tit Gibus\Application Data\Mozilla\Firefox\Profiles\zg3r23tk.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
Fin du rapport
on je vais poster quelques rapports:
Le nouveau cean.cmd:
Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 16/06/2007 a 14:24:36,50
Microsoft Windows XP [version 5.1.2600]
*** Suppression des fichiers dans C:
*** Suppression des fichiers dans C:\WINDOWS\
*** Suppression des fichiers dans C:\WINDOWS\system32
*** Suppression des fichiers dans C:\Program Files
*** Suppression des clefs du registre effectuee..
*** Fin du rapport !
Ensuite un nouveau rapport hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 14:44:34, on 16/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\TPSMain.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\program files\steam\steam.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32\nvsysrot.dll,Enable
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Et pour terminer un rapport Msn fix:
MSN_Fix 1.316
C:\Documents and Settings\P'tit Gibus\Bureau\Guillaume\Logiciels\MSNFix
Fix exécuté le 16/06/2007 - 14:46:13,14 By P'tit Gibus
mode normal
************************ Recherche les fichiers présents
Aucun Fichier trouvé
************************ Recherche les dossiers présents
Aucun dossier trouvé
************************ Fichiers suspects
/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention
[C:\WINDOWS\cfdemo.scr] 7065EA78122F0FFA97CC564CFBD61E61
------------------------------------------------------------------------
Auteur : !aur3n7 Contact: http://246694.aceboard.fr
Ouf j'espere que ca veut dire que c'est terminé toutes ces histoires
Je voudrais juste une réponse pour savoir si je suis décontaminé
Bon tampi jvai aller voir ailleur
Il y a 336 utilisateurs connus et inconnus. Pour voir la liste des connectés connus, cliquez ici.
