Comment se débarrasser des pubs CiD sur Vista - Sécurité - Virus
TomsGuide.com : 700 000 inscrits répondent à toutes vos questions high-tech et informatique.
Pour obtenir de l'aide, inscrivez-vous gratuitement !
 

Ajouter une réponse



Mot :   Pseudo :  
 
Bas de page
Auteur
 Sujet : Comment se débarrasser des pubs CiD sur Vista
 
Sirius88
Profil : IDNaute
Plus d'informations
n°292817
19-03-2008 à 20:05:13

Bonjour,

Un nouveau post sur le sujet!
J'ai accepté par erreur d'installer le sponsor de Messenger plus! live. Depuis, des fenêtres CiD apparaissent sans arrêt et saturent ma barre de tâches si je ne les élimine pas au fur et à mesure.
J'ai désinstallé et réinstallé MSn plusieurs fois et rien n'y fait même en cochant le sponsor dans "ajout/suppression de programmes".
J'ai Vista en systême d'exploitation.
Je suis un vrai nul en informatique.

Merci de votre aide.

J'ai téléchargé Hijackthis et voici le rapport:

Logfile of HijackThis v1.99.1
Scan saved at 19:25:54, on 19/03/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
C:\Windows\sttray.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\Denis ROLLIN\Downloads\Picasa2\PicasaMediaDetector.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\OrangeHSS\browser\browser.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Users\Denis ROLLIN\AppData\Local\Temp\Temp1_hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Users\Denis ROLLIN\Downloads\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [PEAK OOZE] "C:\ProgramData\LogMailMail.tau5q"
O4 - HKCU\..\Run: [Grey pop cake audio] "C:\ProgramData\loud wipe sixth.rptxjzm"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/24.9/uploader2.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://copainsdavant.linternaute.c [...] oader4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Liens sponsorisés


Inscrivez-vous ou connectez-vous pour masquer ceci.

Angeldark
Profil : Helper
Plus d'informations
n°292841
19-03-2008 à 20:44:08

Bonjour,

Télécharge Lop S&D.exe sur ton Bureau.

  • Double-clique dessus pour lancer l'installation
  • Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
  • Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche)
  • Patiente jusqu'à la fin du scan
  • Poste le rapport généré (C:\lopR.txt)


(Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide)


---------------
Prévention & Protection|Les logiciels gratuits|L'homme du FLCCF
Sirius88
Profil : IDNaute
Plus d'informations
n°292947
19-03-2008 à 23:15:38

Je dois être trop nul!
J'ai téléchargé Lop s&d, j'ai suivi tes instructions. Mon bureau a disparu et j'ai eu une boite de dialogue rouge me disant "relancez le programme comme ceci: "clique droit - executer en tant qu'administrateur".
Je n'ai pas vu de scan s'executer et je ne trouve pas le rapport dans C!
Que dois-je faire ou qu'ai-je loupé?

Merci

Sirius88
Profil : IDNaute
Plus d'informations
n°292952
19-03-2008 à 23:30:45

C'est bon, j'ai réussi tout seul!!

voilà le rapport:


-----------------------[ Lop S&D 4.0.8 XP/Vista ]----------------------

[ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
[ USER : Denis ROLLIN ] [ "C:\Lop SD" ]
[ 19/03/2008 | 23:21:20,24 ] [ PC : DENIS ]
[ MAJ : 17-03-2008 | 21:50 ]
[ UAC => 0 ]

-------------[ Listing des dossiers dans Application Data ]------------

[30/09/2007|20:49] C:\Users\DENISR~1\AppData\Roaming\Adobe\Acrobat
[30/09/2007|20:49] C:\Users\DENISR~1\AppData\Roaming\Adobe\..
[30/09/2007|20:49] C:\Users\DENISR~1\AppData\Roaming\Adobe\.

[13/11/2007|20:24] C:\Users\DENISR~1\AppData\Roaming\AdobeUM\..
[13/11/2007|20:24] C:\Users\DENISR~1\AppData\Roaming\AdobeUM\.

[26/09/2007|16:37] C:\Users\DENISR~1\AppData\Roaming\Creative\Media Database
[26/09/2007|16:37] C:\Users\DENISR~1\AppData\Roaming\Creative\..
[26/09/2007|16:37] C:\Users\DENISR~1\AppData\Roaming\Creative\MediaSource
[26/09/2007|16:37] C:\Users\DENISR~1\AppData\Roaming\Creative\.

[27/08/2007|11:59] C:\Users\DENISR~1\AppData\Roaming\Identities\..
[27/08/2007|11:59] C:\Users\DENISR~1\AppData\Roaming\Identities\{4E4BC1AE-555E-4230-A4A5-EB82AB30C97B}
[27/08/2007|11:59] C:\Users\DENISR~1\AppData\Roaming\Identities\.

[17/03/2008|21:31] C:\Users\DENISR~1\AppData\Roaming\Macromedia\Flash Player
[27/08/2007|21:44] C:\Users\DENISR~1\AppData\Roaming\Macromedia\..
[27/08/2007|21:44] C:\Users\DENISR~1\AppData\Roaming\Macromedia\.

[02/11/2006|13:37] C:\Users\DENISR~1\AppData\Roaming\Media Center Programs\..
[02/11/2006|13:37] C:\Users\DENISR~1\AppData\Roaming\Media Center Programs\.

[19/03/2008|18:11] C:\Users\DENISR~1\AppData\Roaming\Microsoft\ModŠles
[04/03/2008|18:24] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Word
[04/03/2008|18:13] C:\Users\DENISR~1\AppData\Roaming\Microsoft\preuve
[29/02/2008|21:57] C:\Users\DENISR~1\AppData\Roaming\Microsoft\..
[29/02/2008|21:57] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Speech
[29/02/2008|21:57] C:\Users\DENISR~1\AppData\Roaming\Microsoft\.
[13/01/2008|13:03] C:\Users\DENISR~1\AppData\Roaming\Microsoft\MSN Messenger
[13/01/2008|12:17] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Installer
[14/11/2007|16:31] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Windows Photo Gallery
[14/11/2007|16:26] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Windows
[07/10/2007|22:01] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Windows Live Call
[07/10/2007|22:01] C:\Users\DENISR~1\AppData\Roaming\Microsoft\IdentityCRL
[26/09/2007|16:39] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Office
[19/09/2007|21:19] C:\Users\DENISR~1\AppData\Roaming\Microsoft\PowerPoint
[04/09/2007|21:41] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Excel
[03/09/2007|18:35] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Crypto
[02/09/2007|22:53] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Internet Explorer
[30/08/2007|20:37] C:\Users\DENISR~1\AppData\Roaming\Microsoft\HTML Help
[28/08/2007|20:52] C:\Users\DENISR~1\AppData\Roaming\Microsoft\eHome
[28/08/2007|15:37] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Credentials
[27/08/2007|20:46] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Macros compl‚mentaires
[27/08/2007|20:10] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Network
[27/08/2007|12:04] C:\Users\DENISR~1\AppData\Roaming\Microsoft\MMC
[27/08/2007|11:59] C:\Users\DENISR~1\AppData\Roaming\Microsoft\SystemCertificates
[27/08/2007|11:59] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Protect

[27/08/2007|20:19] C:\Users\DENISR~1\AppData\Roaming\Microsoft Web Folders\..
[27/08/2007|20:19] C:\Users\DENISR~1\AppData\Roaming\Microsoft Web Folders\.

----------------[ Tâches planifiées dans C:\Windows\tasks ]---------------

[19/03/2008 23:21][--ah-----] C:\Windows\tasks\SA.DAT
[19/03/2008 23:20][--a------] C:\Windows\tasks\SCHEDLGU.TXT

------[ Listing des dossiers dans C:\ProgramData ]------

[17/03/2008|22:09] C:\ProgramData\.
[17/03/2008|22:09] C:\ProgramData\..
[26/09/2007|16:46] C:\ProgramData\Adobe
[02/11/2006|14:02] C:\ProgramData\Application Data
[27/08/2007|11:55] C:\ProgramData\Bureau
[02/11/2006|14:02] C:\ProgramData\Desktop
[02/11/2006|14:02] C:\ProgramData\Documents
[27/08/2007|11:55] C:\ProgramData\Favoris
[02/11/2006|14:02] C:\ProgramData\Favorites
[12/01/2008|16:30] C:\ProgramData\LogMailMail.2x2v7o9
[12/01/2008|16:30] C:\ProgramData\LogMailMail.tau5q
[12/01/2008|16:30] C:\ProgramData\loud wipe sixth.rptxjzm
[27/08/2007|11:55] C:\ProgramData\Menu D‚marrer
[17/03/2008|22:09] C:\ProgramData\Messenger Plus!
[30/08/2007|20:37] C:\ProgramData\Microsoft
[27/08/2007|11:55] C:\ProgramData\ModŠles
[12/01/2008|16:30] C:\ProgramData\Part Hide Grey Pop
[27/08/2007|20:27] C:\ProgramData\SBT
[12/01/2008|13:40] C:\ProgramData\Skyline
[17/03/2008|19:14] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|14:02] C:\ProgramData\Start Menu
[02/11/2006|14:02] C:\ProgramData\Templates
[27/08/2007|21:03] C:\ProgramData\UDL
[12/01/2008|16:30] C:\ProgramData\WAITSIXTHSKIP
[17/03/2008|21:49] C:\ProgramData\WLInstaller
[17/03/2008|20:45] C:\ProgramData\Yahoo! Companion

---------------[ Listing des dossiers dans C:\Program Files ]--------------

[17/03/2008|22:04] C:\Program Files\.
[17/03/2008|22:04] C:\Program Files\..
[27/08/2007|21:00] C:\Program Files\ABBYY FineReader 6.0 Sprint
[26/09/2007|16:43] C:\Program Files\Adobe
[28/08/2007|15:53] C:\Program Files\Alwil Software
[28/02/2008|21:13] C:\Program Files\CCleaner
[21/02/2008|17:38] C:\Program Files\Common Files
[30/08/2007|20:45] C:\Program Files\Creative
[30/08/2007|20:44] C:\Program Files\Creative Installation Information
[27/08/2007|12:03] C:\Program Files\Dell
[12/01/2008|14:45] C:\Program Files\desktop.ini
[26/12/2007|15:00] C:\Program Files\eMule
[27/08/2007|21:02] C:\Program Files\epson
[27/08/2007|11:55] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[02/09/2007|21:22] C:\Program Files\Google
[30/08/2007|20:45] C:\Program Files\InstallShield Installation Information
[12/01/2008|14:41] C:\Program Files\Internet Explorer
[27/08/2007|20:02] C:\Program Files\Inventel
[18/09/2007|21:27] C:\Program Files\Ludiclub
[17/03/2008|22:04] C:\Program Files\Messenger Plus! Live
[02/11/2006|13:37] C:\Program Files\Microsoft Games
[27/08/2007|20:27] C:\Program Files\Microsoft Office
[02/11/2006|13:42] C:\Program Files\Movie Maker
[02/11/2006|13:37] C:\Program Files\MSBuild
[02/11/2006|13:37] C:\Program Files\MSN
[28/08/2007|15:32] C:\Program Files\MSN Toolbar
[29/02/2008|22:17] C:\Program Files\OrangeHSS
[02/11/2006|13:37] C:\Program Files\Reference Assemblies
[14/11/2007|12:49] C:\Program Files\Return to Castle Wolfenstein
[21/02/2008|17:19] C:\Program Files\Securitoo
[27/08/2007|21:28] C:\Program Files\SigmaTel
[12/01/2008|13:40] C:\Program Files\Skyline
[27/08/2007|20:27] C:\Program Files\Snapshot Viewer
[17/03/2008|19:08] C:\Program Files\Spybot - Search & Destroy
[02/11/2006|14:01] C:\Program Files\Uninstall Information
[21/02/2008|17:28] C:\Program Files\Wanadoo
[12/01/2008|14:41] C:\Program Files\Windows Calendar
[02/11/2006|13:42] C:\Program Files\Windows Collaboration
[02/11/2006|13:42] C:\Program Files\Windows Defender
[02/11/2006|13:42] C:\Program Files\Windows Journal
[17/03/2008|21:50] C:\Program Files\Windows Live
[12/01/2008|14:41] C:\Program Files\Windows Mail
[02/11/2006|13:42] C:\Program Files\Windows Media Player
[27/08/2007|11:55] C:\Program Files\Windows NT
[02/11/2006|13:42] C:\Program Files\Windows Photo Gallery
[12/01/2008|14:41] C:\Program Files\Windows Sidebar
[17/03/2008|19:07] C:\Program Files\Yahoo!

------[ Listing des dossiers dans C:\Program Files\Common Files ]------

[21/02/2008|17:38] C:\Program Files\Common Files\.
[21/02/2008|17:38] C:\Program Files\Common Files\..
[26/09/2007|16:46] C:\Program Files\Common Files\Adobe
[30/08/2007|20:42] C:\Program Files\Common Files\Creative
[27/08/2007|20:21] C:\Program Files\Common Files\Designer
[21/02/2008|17:38] C:\Program Files\Common Files\France Telecom
[27/08/2007|21:05] C:\Program Files\Common Files\InstallShield
[17/03/2008|21:50] C:\Program Files\Common Files\microsoft shared
[02/11/2006|12:18] C:\Program Files\Common Files\Services
[02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
[12/01/2008|14:41] C:\Program Files\Common Files\System
[12/01/2008|14:53] C:\Program Files\Common Files\WindowsLiveInstaller

----------------------[ Recherche avec S_Lop ]---------------------

C:\ProgramData\loud wipe sixth.rptxjzm
C:\ProgramData\loud wipe sixth.rptxjzm

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

C:\ProgramData\Part Hide Grey Pop
C:\ProgramData\Part Hide Grey Pop\Keep itch.exe

----------------------[ Verification du Registre ]----------------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-19 23:23:16
Windows 6.0.6000 NTFS
scanning hidden files ...
scan completed successfully
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

Aucune autre infection trouvée !

/!\ [Fich:49][Doss:9] C:\Users\DENISR~1\AppData\Local\Temp
/!\ [Fich:148][Doss:1] C:\Users\DENISR~1\AppData\Roaming\MICROS~1\Windows\Cookies
/!\ [Fich:5287][Doss:12] C:\Users\DENISR~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5

[ UAC => 1 ]

--------------------[ Fin du rapport a 23:24:01,86 ]----------------------

Angeldark
Profil : Helper
Plus d'informations
n°293053
20-03-2008 à 15:45:43

Ok ;)

Relance Lop S&D

  • Choisis cette fois ci l'Option 2 (Suppression)
  • Ne ferme pas la fenêtre lors de la suppression !
  • Poste le rapport généré (C:\lopR.txt)


(Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide)


---------------
Prévention & Protection|Les logiciels gratuits|L'homme du FLCCF
Sirius88
Profil : IDNaute
Plus d'informations
n°293129
20-03-2008 à 17:34:25

Bonjour Angeldark,

Voilà le nouveau rapport:


-----------------------[ Lop S&D 4.0.8 XP/Vista ]----------------------

[ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
[ USER : Denis ROLLIN ] [ "C:\Lop SD" ]
[ 20/03/2008 | 17:31:46,01 ] [ PC : DENIS ]
[ MAJ : 17-03-2008 | 21:50 ]
[ UAC => 0 ]

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

Echec ! - C:\ProgramData\Part Hide Grey Pop\Keep itch.exe
Supprimé! - C:\ProgramData\loud wipe sixth.rptxjzm
Echec ! - C:\ProgramData\Part Hide Grey Pop
Restauré! - Fichier Hosts

\\\\\\\\\\\\\\\\\\\\\\\\\\\ DEUXIEME PASSAGE ///////////////////////////

Supprimé! - C:\ProgramData\Part Hide Grey Pop\Keep itch.exe
Supprimé! - C:\ProgramData\Part Hide Grey Pop

//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


-------------[ Listing des dossiers dans Application Data ]------------

[30/09/2007|20:49] C:\Users\DENISR~1\AppData\Roaming\Adobe\Acrobat
[30/09/2007|20:49] C:\Users\DENISR~1\AppData\Roaming\Adobe\..
[30/09/2007|20:49] C:\Users\DENISR~1\AppData\Roaming\Adobe\.

[13/11/2007|20:24] C:\Users\DENISR~1\AppData\Roaming\AdobeUM\..
[13/11/2007|20:24] C:\Users\DENISR~1\AppData\Roaming\AdobeUM\.

[26/09/2007|16:37] C:\Users\DENISR~1\AppData\Roaming\Creative\Media Database
[26/09/2007|16:37] C:\Users\DENISR~1\AppData\Roaming\Creative\..
[26/09/2007|16:37] C:\Users\DENISR~1\AppData\Roaming\Creative\MediaSource
[26/09/2007|16:37] C:\Users\DENISR~1\AppData\Roaming\Creative\.

[27/08/2007|11:59] C:\Users\DENISR~1\AppData\Roaming\Identities\..
[27/08/2007|11:59] C:\Users\DENISR~1\AppData\Roaming\Identities\{4E4BC1AE-555E-4230-A4A5-EB82AB30C97B}
[27/08/2007|11:59] C:\Users\DENISR~1\AppData\Roaming\Identities\.

[17/03/2008|21:31] C:\Users\DENISR~1\AppData\Roaming\Macromedia\Flash Player
[27/08/2007|21:44] C:\Users\DENISR~1\AppData\Roaming\Macromedia\..
[27/08/2007|21:44] C:\Users\DENISR~1\AppData\Roaming\Macromedia\.

[02/11/2006|13:37] C:\Users\DENISR~1\AppData\Roaming\Media Center Programs\..
[02/11/2006|13:37] C:\Users\DENISR~1\AppData\Roaming\Media Center Programs\.

[20/03/2008|12:12] C:\Users\DENISR~1\AppData\Roaming\Microsoft\ModŠles
[04/03/2008|18:24] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Word
[04/03/2008|18:13] C:\Users\DENISR~1\AppData\Roaming\Microsoft\preuve
[29/02/2008|21:57] C:\Users\DENISR~1\AppData\Roaming\Microsoft\..
[29/02/2008|21:57] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Speech
[29/02/2008|21:57] C:\Users\DENISR~1\AppData\Roaming\Microsoft\.
[13/01/2008|13:03] C:\Users\DENISR~1\AppData\Roaming\Microsoft\MSN Messenger
[13/01/2008|12:17] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Installer
[14/11/2007|16:31] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Windows Photo Gallery
[14/11/2007|16:26] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Windows
[07/10/2007|22:01] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Windows Live Call
[07/10/2007|22:01] C:\Users\DENISR~1\AppData\Roaming\Microsoft\IdentityCRL
[26/09/2007|16:39] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Office
[19/09/2007|21:19] C:\Users\DENISR~1\AppData\Roaming\Microsoft\PowerPoint
[04/09/2007|21:41] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Excel
[03/09/2007|18:35] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Crypto
[02/09/2007|22:53] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Internet Explorer
[30/08/2007|20:37] C:\Users\DENISR~1\AppData\Roaming\Microsoft\HTML Help
[28/08/2007|20:52] C:\Users\DENISR~1\AppData\Roaming\Microsoft\eHome
[28/08/2007|15:37] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Credentials
[27/08/2007|20:46] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Macros compl‚mentaires
[27/08/2007|20:10] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Network
[27/08/2007|12:04] C:\Users\DENISR~1\AppData\Roaming\Microsoft\MMC
[27/08/2007|11:59] C:\Users\DENISR~1\AppData\Roaming\Microsoft\SystemCertificates
[27/08/2007|11:59] C:\Users\DENISR~1\AppData\Roaming\Microsoft\Protect

[27/08/2007|20:19] C:\Users\DENISR~1\AppData\Roaming\Microsoft Web Folders\..
[27/08/2007|20:19] C:\Users\DENISR~1\AppData\Roaming\Microsoft Web Folders\.

----------------[ Tâches planifiées dans C:\Windows\tasks ]---------------

[20/03/2008 17:31][--ah-----] C:\Windows\tasks\SA.DAT
[20/03/2008 17:30][--a------] C:\Windows\tasks\SCHEDLGU.TXT

------[ Listing des dossiers dans C:\ProgramData ]------

[20/03/2008|17:32] C:\ProgramData\.
[20/03/2008|17:32] C:\ProgramData\..
[26/09/2007|16:46] C:\ProgramData\Adobe
[02/11/2006|14:02] C:\ProgramData\Application Data
[27/08/2007|11:55] C:\ProgramData\Bureau
[02/11/2006|14:02] C:\ProgramData\Desktop
[02/11/2006|14:02] C:\ProgramData\Documents
[27/08/2007|11:55] C:\ProgramData\Favoris
[02/11/2006|14:02] C:\ProgramData\Favorites
[12/01/2008|16:30] C:\ProgramData\LogMailMail.2x2v7o9
[12/01/2008|16:30] C:\ProgramData\LogMailMail.tau5q
[27/08/2007|11:55] C:\ProgramData\Menu D‚marrer
[17/03/2008|22:09] C:\ProgramData\Messenger Plus!
[30/08/2007|20:37] C:\ProgramData\Microsoft
[27/08/2007|11:55] C:\ProgramData\ModŠles
[27/08/2007|20:27] C:\ProgramData\SBT
[12/01/2008|13:40] C:\ProgramData\Skyline
[17/03/2008|19:14] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|14:02] C:\ProgramData\Start Menu
[02/11/2006|14:02] C:\ProgramData\Templates
[27/08/2007|21:03] C:\ProgramData\UDL
[12/01/2008|16:30] C:\ProgramData\WAITSIXTHSKIP
[17/03/2008|21:49] C:\ProgramData\WLInstaller
[17/03/2008|20:45] C:\ProgramData\Yahoo! Companion

---------------[ Listing des dossiers dans C:\Program Files ]--------------

[17/03/2008|22:04] C:\Program Files\.
[17/03/2008|22:04] C:\Program Files\..
[27/08/2007|21:00] C:\Program Files\ABBYY FineReader 6.0 Sprint
[26/09/2007|16:43] C:\Program Files\Adobe
[28/08/2007|15:53] C:\Program Files\Alwil Software
[28/02/2008|21:13] C:\Program Files\CCleaner
[21/02/2008|17:38] C:\Program Files\Common Files
[30/08/2007|20:45] C:\Program Files\Creative
[30/08/2007|20:44] C:\Program Files\Creative Installation Information
[27/08/2007|12:03] C:\Program Files\Dell
[12/01/2008|14:45] C:\Program Files\desktop.ini
[26/12/2007|15:00] C:\Program Files\eMule
[27/08/2007|21:02] C:\Program Files\epson
[27/08/2007|11:55] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[02/09/2007|21:22] C:\Program Files\Google
[30/08/2007|20:45] C:\Program Files\InstallShield Installation Information
[12/01/2008|14:41] C:\Program Files\Internet Explorer
[27/08/2007|20:02] C:\Program Files\Inventel
[18/09/2007|21:27] C:\Program Files\Ludiclub
[17/03/2008|22:04] C:\Program Files\Messenger Plus! Live
[02/11/2006|13:37] C:\Program Files\Microsoft Games
[27/08/2007|20:27] C:\Program Files\Microsoft Office
[02/11/2006|13:42] C:\Program Files\Movie Maker
[02/11/2006|13:37] C:\Program Files\MSBuild
[02/11/2006|13:37] C:\Program Files\MSN
[28/08/2007|15:32] C:\Program Files\MSN Toolbar
[29/02/2008|22:17] C:\Program Files\OrangeHSS
[02/11/2006|13:37] C:\Program Files\Reference Assemblies
[14/11/2007|12:49] C:\Program Files\Return to Castle Wolfenstein
[21/02/2008|17:19] C:\Program Files\Securitoo
[27/08/2007|21:28] C:\Program Files\SigmaTel
[12/01/2008|13:40] C:\Program Files\Skyline
[27/08/2007|20:27] C:\Program Files\Snapshot Viewer
[17/03/2008|19:08] C:\Program Files\Spybot - Search & Destroy
[02/11/2006|14:01] C:\Program Files\Uninstall Information
[21/02/2008|17:28] C:\Program Files\Wanadoo
[12/01/2008|14:41] C:\Program Files\Windows Calendar
[02/11/2006|13:42] C:\Program Files\Windows Collaboration
[02/11/2006|13:42] C:\Program Files\Windows Defender
[02/11/2006|13:42] C:\Program Files\Windows Journal
[17/03/2008|21:50] C:\Program Files\Windows Live
[12/01/2008|14:41] C:\Program Files\Windows Mail
[02/11/2006|13:42] C:\Program Files\Windows Media Player
[27/08/2007|11:55] C:\Program Files\Windows NT
[02/11/2006|13:42] C:\Program Files\Windows Photo Gallery
[12/01/2008|14:41] C:\Program Files\Windows Sidebar
[17/03/2008|19:07] C:\Program Files\Yahoo!

------[ Listing des dossiers dans C:\Program Files\Common Files ]------

[21/02/2008|17:38] C:\Program Files\Common Files\.
[21/02/2008|17:38] C:\Program Files\Common Files\..
[26/09/2007|16:46] C:\Program Files\Common Files\Adobe
[30/08/2007|20:42] C:\Program Files\Common Files\Creative
[27/08/2007|20:21] C:\Program Files\Common Files\Designer
[21/02/2008|17:38] C:\Program Files\Common Files\France Telecom
[27/08/2007|21:05] C:\Program Files\Common Files\InstallShield
[17/03/2008|21:50] C:\Program Files\Common Files\microsoft shared
[02/11/2006|12:18] C:\Program Files\Common Files\Services
[02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
[12/01/2008|14:41] C:\Program Files\Common Files\System
[12/01/2008|14:53] C:\Program Files\Common Files\WindowsLiveInstaller

----------------------[ Recherche avec S_Lop ]---------------------

Aucun fichier / dossier Lop trouvé !

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

Aucun fichier / dossier Lop trouvé !

----------------------[ Verification du Registre ]----------------------

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-20 17:33:02
Windows 6.0.6000 NTFS
scanning hidden files ...
scan completed successfully
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

Aucune autre infection trouvée !

/!\ [Fich:56][Doss:10] C:\Users\DENISR~1\AppData\Local\Temp
/!\ [Fich:168][Doss:1] C:\Users\DENISR~1\AppData\Roaming\MICROS~1\Windows\Cookies
/!\ [Fich:5581][Doss:12] C:\Users\DENISR~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5

[ UAC => 1 ]

--------------------[ Fin du rapport a 17:33:27,58 ]----------------------

Angeldark
Profil : Helper
Plus d'informations
n°293160
20-03-2008 à 18:18:44

Reposte un rapport Hijackthis.


---------------
Prévention & Protection|Les logiciels gratuits|L'homme du FLCCF
Sirius88
Profil : IDNaute
Plus d'informations
n°293162
20-03-2008 à 18:20:49

Là ça sent bon pour moi! Aucun spam depuis 45 minutes!

Je relance Hijacthis.....

Sirius88
Profil : IDNaute
Plus d'informations
n°293164
20-03-2008 à 18:22:34

Logfile of HijackThis v1.99.1
Scan saved at 18:23:01, on 20/03/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
C:\Windows\sttray.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\Denis ROLLIN\Downloads\Picasa2\PicasaMediaDetector.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\cmd.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Windows\explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\OrangeHSS\browser\browser.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Denis ROLLIN\AppData\Local\Temp\Temp2_hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,Searc