probleme avec rapport hijackthis
Dernière réponse : dans Sécurité
lorsque je branche mon cable ethernet sur la livebox, mon pointeur est incontrolable et clic tout seul. Ce n'est pas une souris mais le plateau du pc portable que j'utilise. Voici un rapport. Merci de votre aide.
ps: avant j'ai utilisé spydoc, bitdef, ect...mais aucun changement de comportement du pointeur.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:12:38, on 30/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Apoint\Apoint.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\raaaaaaaaaaaah\Bureau\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://config.zebulon.fr/plugins/hardwaredetection.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe
--
End of file - 7670 bytes
ps: avant j'ai utilisé spydoc, bitdef, ect...mais aucun changement de comportement du pointeur.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:12:38, on 30/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Apoint\Apoint.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\raaaaaaaaaaaah\Bureau\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://config.zebulon.fr/plugins/hardwaredetection.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe
--
End of file - 7670 bytes
Autres pages sur : probleme rapport hijackthis
Lassé par la pub ? Créez un compte
voici le rapport combofix
ComboFix 08-10-28.01 - raaaaaaaaaaaah 2008-10-30 18:01:15.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.66 [GMT 1:00]
Lancé depuis: C:\Documents and Settings\raaaaaaaaaaaah\Bureau\ComboFix.exe
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\regedit.com
C:\WINDOWS\system32\taskmgr.com
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
.
2008-10-30 17:06 . 2008-10-30 17:13 <REP> d--h-c--- C:\Documents and Settings\All Users\Application Data\~0
2008-10-26 18:34 . 2008-10-26 18:34 <REP> d-------- C:\Documents and Settings\raaaaaaaaaaaah\Application Data\Uniblue
2008-10-26 11:29 . 2008-10-15 17:35 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-25 14:39 . 2008-10-25 14:39 <REP> d-------- C:\Documents and Settings\raaaaaaaaaaaah\Application Data\Malwarebytes
2008-10-25 14:39 . 2008-10-25 14:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-24 10:38 . 2008-10-24 10:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-10-20 18:41 . 2004-08-23 13:49 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
2008-10-19 20:37 . 2008-10-20 17:30 1,393 --a------ C:\WINDOWS\imsins.BAK
2008-10-18 20:16 . 2008-09-15 16:26 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-18 20:15 . 2008-08-14 14:23 2,147,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-18 20:15 . 2008-08-14 14:23 2,025,984 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 19:11 . 2008-10-15 10:18 20,313,865 --a------ C:\WINDOWS\LPT$VPN.595
2008-10-15 19:09 . 2008-10-15 19:09 <REP> d-------- C:\WINDOWS\AU_Temp
2008-10-15 10:29 . 2008-10-15 10:29 <REP> d-------- C:\WINDOWS\report
2008-10-15 10:18 . 2008-10-15 17:51 <REP> d-------- C:\WINDOWS\AU_Backup
2008-10-15 10:18 . 2008-10-15 10:18 20,313,865 --a------ C:\WINDOWS\VPTNFILE.595
2008-10-15 10:18 . 2008-10-15 10:18 1,968,332 --a------ C:\WINDOWS\tsc.ptn
2008-10-15 10:18 . 2008-10-15 19:09 1,213,784 --a------ C:\WINDOWS\vsapi32.dll
2008-10-15 10:18 . 2008-10-15 10:18 333,576 --a------ C:\WINDOWS\TSC.exe
2008-10-15 10:18 . 2008-10-15 19:09 91,744 --a------ C:\WINDOWS\BPMNT.dll
2008-10-15 10:18 . 2008-10-15 10:18 71,749 --a------ C:\WINDOWS\hcextoutput.dll
2008-10-15 10:13 . 2008-10-15 10:13 <REP> d-------- C:\WINDOWS\AU_Log
2008-10-15 10:13 . 2008-10-15 19:09 170 --a------ C:\WINDOWS\GetServer.ini
2008-10-13 18:32 . 2008-10-13 18:32 <REP> d-------- C:\Documents and Settings\raaaaaaaaaaaah\Application Data\PC Tools
2008-10-11 15:02 . 2008-10-15 19:43 823 --a------ C:\WINDOWS\TSC.INI
2008-10-11 15:01 . 2008-10-11 15:01 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
2008-10-11 15:01 . 2008-10-11 15:01 286,720 --a------ C:\WINDOWS\PATCH.EXE
2008-10-11 15:01 . 2008-10-11 15:01 69,689 --a------ C:\WINDOWS\UNZIP.DLL
2008-10-08 19:38 . 2008-10-08 19:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-07 19:43 . 2008-10-24 10:56 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-07 18:12 . 2008-10-07 18:12 <REP> d-------- C:\Program Files\CONEXANT
2008-10-07 18:11 . 2001-08-02 10:43 172,032 --a------ C:\WINDOWS\system32\PMUNINST.EXE
2008-10-06 20:51 . 2008-10-06 20:53 4,703,829 --a------ C:\WINDOWS\REGBK00.ZIP
2008-10-06 20:50 . 2008-10-06 20:50 <REP> d-a------ C:\WINDOWS\zts2.exe
2008-10-06 20:50 . 2008-10-06 20:50 <REP> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2008-10-06 20:49 . 2008-10-06 20:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-10-06 20:33 . 2008-10-06 20:33 27 --a------ C:\WINDOWS\Lic.xxx
2008-10-06 20:28 . 2008-10-06 20:28 <REP> d-------- C:\Program Files\Fichiers communs\MicroWorld
2008-10-06 20:28 . 2008-04-14 03:34 153,088 --a------ C:\WINDOWS\R.COM
2008-10-06 20:28 . 2008-04-14 03:34 143,360 --a------ C:\WINDOWS\system32\T.COM
2008-10-06 20:27 . 2008-10-06 20:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MicroWorld
2008-10-06 19:03 . 2008-10-06 19:03 <REP> d-------- C:\Program Files\Yahoo!
2008-10-06 16:44 . 2008-10-06 17:03 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-09-05 22:30 . 2008-09-05 22:30 952,360 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-09-05 22:30 . 2008-09-05 22:30 267,304 -----c--- C:\WINDOWS\system32\dllcache\wgaLogon.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-30 15:21 --------- d-----w C:\Program Files\Wanadoo
2008-10-24 09:58 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-24 09:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-20 19:04 --------- d-----w C:\Program Files\Google
2008-10-11 15:50 102,664 -c--a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2008-09-09 12:38 --------- d-----w C:\Documents and Settings\raaaaaaaaaaaah\Application Data\Notepad++
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2007-07-18 20:48 278,528 -c--a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-28 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 32768]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2002-02-28 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AtiPTA"="atiptaxx.exe" [2002-02-14 C:\WINDOWS\system32\atiptaxx.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= sonymjpg.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UacFlt;Philips Composite Class Filter Driver;C:\WINDOWS\system32\DRIVERS\uacbflt.sys [2003-07-16 15104]
R3 ati2mpab;ati2mpab;C:\WINDOWS\system32\DRIVERS\ati2mpab.sys [2002-06-16 313344]
R3 HSFHWVIA;HSFHWVIA;C:\WINDOWS\system32\DRIVERS\HSFHWVIA.sys [2002-10-31 157236]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [ ]
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-10-13 C:\WINDOWS\Tasks\Norton Security Scan.job
- C:\Program Files\Norton Security Scan\Nss.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-Uniblue RegistryBooster 2009 - C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\raaaaaaaaaaaah\Application Data\Mozilla\Firefox\Profiles\nk8nqnl9.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 18:10:19
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-10-30 18:16:29
ComboFix-quarantined-files.txt 2008-10-30 17:16:22
Avant-CF: 10,602,475,520 octets libres
Après-CF: 10,649,473,024 octets libres
133 --- E O F --- 2008-10-26 11:15:59
ComboFix 08-10-28.01 - raaaaaaaaaaaah 2008-10-30 18:01:15.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.66 [GMT 1:00]
Lancé depuis: C:\Documents and Settings\raaaaaaaaaaaah\Bureau\ComboFix.exe
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\regedit.com
C:\WINDOWS\system32\taskmgr.com
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
.
2008-10-30 17:06 . 2008-10-30 17:13 <REP> d--h-c--- C:\Documents and Settings\All Users\Application Data\~0
2008-10-26 18:34 . 2008-10-26 18:34 <REP> d-------- C:\Documents and Settings\raaaaaaaaaaaah\Application Data\Uniblue
2008-10-26 11:29 . 2008-10-15 17:35 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-25 14:39 . 2008-10-25 14:39 <REP> d-------- C:\Documents and Settings\raaaaaaaaaaaah\Application Data\Malwarebytes
2008-10-25 14:39 . 2008-10-25 14:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-24 10:38 . 2008-10-24 10:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-10-20 18:41 . 2004-08-23 13:49 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
2008-10-19 20:37 . 2008-10-20 17:30 1,393 --a------ C:\WINDOWS\imsins.BAK
2008-10-18 20:16 . 2008-09-15 16:26 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-18 20:15 . 2008-08-14 14:23 2,147,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-18 20:15 . 2008-08-14 14:23 2,025,984 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 19:11 . 2008-10-15 10:18 20,313,865 --a------ C:\WINDOWS\LPT$VPN.595
2008-10-15 19:09 . 2008-10-15 19:09 <REP> d-------- C:\WINDOWS\AU_Temp
2008-10-15 10:29 . 2008-10-15 10:29 <REP> d-------- C:\WINDOWS\report
2008-10-15 10:18 . 2008-10-15 17:51 <REP> d-------- C:\WINDOWS\AU_Backup
2008-10-15 10:18 . 2008-10-15 10:18 20,313,865 --a------ C:\WINDOWS\VPTNFILE.595
2008-10-15 10:18 . 2008-10-15 10:18 1,968,332 --a------ C:\WINDOWS\tsc.ptn
2008-10-15 10:18 . 2008-10-15 19:09 1,213,784 --a------ C:\WINDOWS\vsapi32.dll
2008-10-15 10:18 . 2008-10-15 10:18 333,576 --a------ C:\WINDOWS\TSC.exe
2008-10-15 10:18 . 2008-10-15 19:09 91,744 --a------ C:\WINDOWS\BPMNT.dll
2008-10-15 10:18 . 2008-10-15 10:18 71,749 --a------ C:\WINDOWS\hcextoutput.dll
2008-10-15 10:13 . 2008-10-15 10:13 <REP> d-------- C:\WINDOWS\AU_Log
2008-10-15 10:13 . 2008-10-15 19:09 170 --a------ C:\WINDOWS\GetServer.ini
2008-10-13 18:32 . 2008-10-13 18:32 <REP> d-------- C:\Documents and Settings\raaaaaaaaaaaah\Application Data\PC Tools
2008-10-11 15:02 . 2008-10-15 19:43 823 --a------ C:\WINDOWS\TSC.INI
2008-10-11 15:01 . 2008-10-11 15:01 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
2008-10-11 15:01 . 2008-10-11 15:01 286,720 --a------ C:\WINDOWS\PATCH.EXE
2008-10-11 15:01 . 2008-10-11 15:01 69,689 --a------ C:\WINDOWS\UNZIP.DLL
2008-10-08 19:38 . 2008-10-08 19:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-07 19:43 . 2008-10-24 10:56 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-07 18:12 . 2008-10-07 18:12 <REP> d-------- C:\Program Files\CONEXANT
2008-10-07 18:11 . 2001-08-02 10:43 172,032 --a------ C:\WINDOWS\system32\PMUNINST.EXE
2008-10-06 20:51 . 2008-10-06 20:53 4,703,829 --a------ C:\WINDOWS\REGBK00.ZIP
2008-10-06 20:50 . 2008-10-06 20:50 <REP> d-a------ C:\WINDOWS\zts2.exe
2008-10-06 20:50 . 2008-10-06 20:50 <REP> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2008-10-06 20:49 . 2008-10-06 20:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-10-06 20:33 . 2008-10-06 20:33 27 --a------ C:\WINDOWS\Lic.xxx
2008-10-06 20:28 . 2008-10-06 20:28 <REP> d-------- C:\Program Files\Fichiers communs\MicroWorld
2008-10-06 20:28 . 2008-04-14 03:34 153,088 --a------ C:\WINDOWS\R.COM
2008-10-06 20:28 . 2008-04-14 03:34 143,360 --a------ C:\WINDOWS\system32\T.COM
2008-10-06 20:27 . 2008-10-06 20:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MicroWorld
2008-10-06 19:03 . 2008-10-06 19:03 <REP> d-------- C:\Program Files\Yahoo!
2008-10-06 16:44 . 2008-10-06 17:03 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-09-05 22:30 . 2008-09-05 22:30 952,360 -----c--- C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-09-05 22:30 . 2008-09-05 22:30 267,304 -----c--- C:\WINDOWS\system32\dllcache\wgaLogon.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-30 15:21 --------- d-----w C:\Program Files\Wanadoo
2008-10-24 09:58 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-24 09:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-20 19:04 --------- d-----w C:\Program Files\Google
2008-10-11 15:50 102,664 -c--a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2008-09-09 12:38 --------- d-----w C:\Documents and Settings\raaaaaaaaaaaah\Application Data\Notepad++
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2007-07-18 20:48 278,528 -c--a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-28 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 32768]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2002-02-28 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AtiPTA"="atiptaxx.exe" [2002-02-14 C:\WINDOWS\system32\atiptaxx.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= sonymjpg.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UacFlt;Philips Composite Class Filter Driver;C:\WINDOWS\system32\DRIVERS\uacbflt.sys [2003-07-16 15104]
R3 ati2mpab;ati2mpab;C:\WINDOWS\system32\DRIVERS\ati2mpab.sys [2002-06-16 313344]
R3 HSFHWVIA;HSFHWVIA;C:\WINDOWS\system32\DRIVERS\HSFHWVIA.sys [2002-10-31 157236]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [ ]
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
2008-10-13 C:\WINDOWS\Tasks\Norton Security Scan.job
- C:\Program Files\Norton Security Scan\Nss.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-Uniblue RegistryBooster 2009 - C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\raaaaaaaaaaaah\Application Data\Mozilla\Firefox\Profiles\nk8nqnl9.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 18:10:19
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
Heure de fin: 2008-10-30 18:16:29
ComboFix-quarantined-files.txt 2008-10-30 17:16:22
Avant-CF: 10,602,475,520 octets libres
Après-CF: 10,649,473,024 octets libres
133 --- E O F --- 2008-10-26 11:15:59
Au démarrage du PC, sur l'écran d'accueil où la mémoire et les périphériques sont identifiés, il faut appuyer sur "DEL" (ou tout autre touche précisée sur l'écran) pour rentrer dans le Bios. C'est indiqué : "Press "DEL" (ou F2, ou...) to enter Setup.
Les ports USB sont gérés dans le sous menu "périphériques internes". Le choix "USB port" doit être sur "Enabled".change le en "'disabled"
. Après, il faut sauvegarder les changements avec le menu "Save and exit setup". ainsi au prochain demarage tes ports usb seront desactiver et peux etre que ton cable ethernet ne te posera plus de probleme
Les ports USB sont gérés dans le sous menu "périphériques internes". Le choix "USB port" doit être sur "Enabled".change le en "'disabled"
. Après, il faut sauvegarder les changements avec le menu "Save and exit setup". ainsi au prochain demarage tes ports usb seront desactiver et peux etre que ton cable ethernet ne te posera plus de probleme
Quelqu'un m'a dit ceci:
Redémarre en "Mode sans échec" : redémarre ton ordinateur et tapote sur la touche F8
jusqu'à l'affichage du menu des options avancées de Windows, et sélectionne "Mode sans échec".
Choisis ta session habituelle
à l´aide de hijack this coche et fix les lignes ci dessous :
O17 - HKLM\System\CCS\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
Puis clique sur Fixchecked
Comment fixer :
Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)
-> http://perso.orange.fr/rginformatique/section%20virus/d...jack.htm
Toujours en mode sans échec
click sur démarrer > exécuter > dans la boite de dialogue tape > cmd et valide
dans la fenêtre noir tape ceci : ipconfig /flushdns et valide par entrer
et ensuite supprime ces fichiers :
C:\WINDOWS\zts2.exe
C:\WINDOWS\system32\iifgfgf.dll
C:\WINDOWS\REGBK00.ZIP
C:\WINDOWS\Lic.xxx
C:\WINDOWS\R.COM
C:\WINDOWS\system32\T.COM
et après redémarrage en mode normal poste un nouveau rapport Hitjack
@ +
Qu'est ce que tu en penses?
Redémarre en "Mode sans échec" : redémarre ton ordinateur et tapote sur la touche F8
jusqu'à l'affichage du menu des options avancées de Windows, et sélectionne "Mode sans échec".
Choisis ta session habituelle
à l´aide de hijack this coche et fix les lignes ci dessous :
O17 - HKLM\System\CCS\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
Puis clique sur Fixchecked
Comment fixer :
Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)
-> http://perso.orange.fr/rginformatique/section%20virus/d...jack.htm
Toujours en mode sans échec
click sur démarrer > exécuter > dans la boite de dialogue tape > cmd et valide
dans la fenêtre noir tape ceci : ipconfig /flushdns et valide par entrer
et ensuite supprime ces fichiers :
C:\WINDOWS\zts2.exe
C:\WINDOWS\system32\iifgfgf.dll
C:\WINDOWS\REGBK00.ZIP
C:\WINDOWS\Lic.xxx
C:\WINDOWS\R.COM
C:\WINDOWS\system32\T.COM
et après redémarrage en mode normal poste un nouveau rapport Hitjack
@ +
Qu'est ce que tu en penses?
le DSN pointe vers San Francisco
017-HKLM\System\CCS\Services\Tcpip\::\{C61C0964-DFOC-494E-B5DE-CEE93AE0AE2D}:Name Server=208.67.220.220,208.67.222.222
OrgName: Open DNS, LLC
OrgID: OPEND-2
Address: 199 Fremont St
Address: 12th Floor
City: San Francisco
State Prov: CA
Postal Code: 94105
Country: US
Que dire de tout ça?
017-HKLM\System\CCS\Services\Tcpip\::\{C61C0964-DFOC-494E-B5DE-CEE93AE0AE2D}:Name Server=208.67.220.220,208.67.222.222
OrgName: Open DNS, LLC
OrgID: OPEND-2
Address: 199 Fremont St
Address: 12th Floor
City: San Francisco
State Prov: CA
Postal Code: 94105
Country: US
Que dire de tout ça?
voici un rapport
SmitFraudFix v2.368
Rapport fait à 20:26:54,82, 31/10/2008
Executé à partir de C:\Documents and Settings\raaaaaaaaaaaah\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix
HKLM\SYSTEM\CCS\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CCS\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{49225070-E5F9-444D-AB5D-5A14385B2D88}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{49225070-E5F9-444D-AB5D-5A14385B2D88}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222
»»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix
HKLM\SYSTEM\CCS\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CCS\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{49225070-E5F9-444D-AB5D-5A14385B2D88}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{49225070-E5F9-444D-AB5D-5A14385B2D88}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222
Que peut-on en dire?
SmitFraudFix v2.368
Rapport fait à 20:26:54,82, 31/10/2008
Executé à partir de C:\Documents and Settings\raaaaaaaaaaaah\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix
HKLM\SYSTEM\CCS\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CCS\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{49225070-E5F9-444D-AB5D-5A14385B2D88}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{49225070-E5F9-444D-AB5D-5A14385B2D88}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222
»»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix
HKLM\SYSTEM\CCS\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CCS\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{49225070-E5F9-444D-AB5D-5A14385B2D88}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1B303D80-8AA0-4571-92B3-0A006CB6B50E}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{30A50052-A482-4A8A-8E42-52CBB174D4FC}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{49225070-E5F9-444D-AB5D-5A14385B2D88}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{73D8B425-4FE3-48F9-AEB8-A64B07EB3F80}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: DhcpNameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C61C0964-DF0C-494E-B5DE-CEE93AE0AE2D}: NameServer=208.67.220.220,208.67.222.222
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222
Que peut-on en dire?
Lassé par la pub ? Créez un compte
- Contenus similaires :
Tags :
- ForumProbleme dll rapport hijackthis
- ForumRapport hijackthis probleme pubs ie
- ForumProbleme uc, rapport hijackthis a dechiffrer
- ForumRapport hijackthis probleme d'antivirus
- ForumProbleme winlogon.exe - rapport hijackthis
- ForumProbleme infection et rapport hijackthis
- ForumProbleme cid rapport hijackthis
- ForumProbleme infection analyse rapport hijackthis
- ForumProbleme eplorer.exe, rapport hijackthis
- ForumRapport hijackthis probleme fenetre pub
- Voir plus