rss
Rechercher : dans
Par : Pertinence Date Nom d'utilisateur
Statut : Non résolu

Mon pc est trop lent...je ne sais pas comment

lagiraf, le samedi 5 juillet 2008 à 00:23:49
Bonjour, j'ai fait formater mon pc y a pas longtemps, mais il est devenu trop lent: je supprime les programmes temporaires régulièrement! j'ai arrêté l'utilisation d'emule!
J'ai installé l'antivirus avast, j'ai aussi ad-aware qui après l'analyse je ne sais pas comment traiter les infections!!
j'ai lu sur le forum qu'il faut faire une analyse avec Hijackthis et envoyer le bilan de l'analyse!! j'espère que quelqu'un pourra m'aider !!merci d'avance... voici le bilan

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:12:50, on 04/07/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Real\RealJukebox\tsystray.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\Winamp3\winampa.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Ichraf\Bureau\rav.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ichraf\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [Smapp] "C:\Program Files\Analog Devices\SoundMAX\SMTray.exe"
O4 - HKLM\..\Run: [DrvLsnr] "C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [RealJukeboxSystray] "C:\Program Files\Real\RealJukebox\tsystray.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\realplay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [drv wipe iso real] "C:\Documents and Settings\All Users\Application Data\Gram 32 Drv Wipe\lite atom.exe"
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Vgamp3] "C:\DOCUME~1\Ichraf\APPLIC~1\FLAWVI~1\send keep.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC108B26-7326-49A0-B09E-424207C23116}: NameServer = 212.217.0.3 196.217.246.210
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
End of file - 5719 bytes


je vous remercie infiniment
Configuration: Windows XP
Firefox 2.0.0.15
Répondre à lagiraf  Signaler ce message aux modérateurs Aller au dernier message

1


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
vetetistosore, le samedi 5 juillet 2008 à 00:28:11
st lagiraf
commence par changer d'antivirus
passe avec antivir ici:http://www.clubic.com/telecharger-fiche10821-antivir-per­sonal-edition.html
configue ici:http://speedweb1.free.fr/frames2.php?page=tuto5
cet antivirus contiend la recherche de rootkitet surtout est beaucoup plus efficasse que avast pour infos ici:http://forum.malekal.com/viewtopic.php?f=45&t=11659&p=89934#p89934
une fois que tu aura fait l'installation deantivir et au prealable suprimer avast du pc fait la configue ,la mise a jour et scan ton pc completement et suprime ce qu'il trouve si apres passe c.cleener ici:http://www.cleanersoft.net/fr/
une fois que tu aura fait sa tu va dans demarer tu fait clic droit sur ton navigateut IE et tu va dans propireter historique de navigation, suprimer et tu suprime tout l' historique de naviguation .
si tu a un autre navigateur mozilla firfox ,outils ,option,vie priver et pareil efface toute trace
pour la suite repasse hijackthis et colle le rapport ici cela serra beaucoup plus claire
a+
   
Répondre à vetetistosore

2


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
lagiraf, le samedi 5 juillet 2008 à 00:56:12
salut, je te remercie infiniment vetetistosore !! je vais suivre tes instructions!! encore une fois mille merci...
   
Répondre à lagiraf

3


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
vetetistosore, le samedi 5 juillet 2008 à 02:04:37
re st
une fois que tu aura fait cette manip tu va faire un scan en ligne tu peut passer sur deux antivirus different ce qui va completer les recherches sur ton pc, le premier bit defender: pour faire le scan il te faut passer en demande administrateur je m'explique tu fait un clic droit sur IE et tu lance ta recherche en tant que administrateur ,tu tape scan en ligne bit defender et tu fait l'installation ,attention defois il te faut installer les controle active x barre jaune qui clignote et une fois fait lance le scan et suprime ce qu'il trouve .
Apres il ya f.secure scan en ligne pareil pour le premier mais pour celuis la tu n'est pas obliger de passer en mode administrateur, pareil pour les active x par contre pour luis fait une configue perso et met tout tes fichier et scan tout tes disc dur si tu peut colle moi les rapport de scan pour y voir quelle infection tu a attraper si tu en a eu une !!!
pour infos ses deux antivirus utilise des moteurs de recherche different et l'un cherche plus les trojans et l'autre les virus en tout genre et biensur "antivir" qui a un tres bon moteur de recherche et qui de plus est a une recherche heuristic inclus dans sont programes voila pour l'infos. prend ton temps pour faire tout sa de toute façon les scan en ligne sont assez long donc à prevoir avant d'aller au lit , bon courage a+
   
Répondre à vetetistosore

4


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
ffgbfdg, le samedi 5 juillet 2008 à 10:49:07
Bonjour,
ce site internet m'a résolu tous mes problèmes :

http://www.ascentive.com/...
   
Répondre à ffgbfdg

5


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
vetetistosore, le samedi 5 juillet 2008 à 11:17:20
merci du conseil mais avant j'aimerai voir si le pc et propre, car la lenteur d'un pc ne se resoud pas par le simple netoyage de la base de registre, il y a peut etre d'autre programes malveillant qui utilise uc et bloque ou ralentie tout le systeme .
merci pour l'infos j'en prend note et si apres les scan il n'y trouve rien on passera par la.
   
Répondre à vetetistosore

7


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
lagiraf, le samedi 5 juillet 2008 à 12:42:28
bonjour vetetistosore , bonjour tout le monde !!hier j'ai installé l'aintivir et j'ai fait un scan!! je viens de refaire un scan avec l'antivir avira !!je t'envoie le rapport, ensuite je vais faire un autre scan avec hijackthis...




Avira AntiVir Personal
Report file date: samedi 5 juillet 2008 10:01

Scanning for 1378724 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 1) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: ICHRAF-YUVIUGUY

Version information:
BUILD.DAT : 8.1.0.308 16478 Bytes 28/05/2008 17:03:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 11:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 10:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 10:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 10:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 12:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 00:17:13
ANTIVIR2.VDF : 7.0.5.51 273408 Bytes 04/07/2008 00:17:13
ANTIVIR3.VDF : 7.0.5.52 2048 Bytes 04/07/2008 00:17:13
Engineversion : 8.1.0.64
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 11:58:21
AESCRIPT.DLL : 8.1.0.46 283002 Bytes 05/07/2008 00:17:15
AESCN.DLL : 8.1.0.22 119157 Bytes 05/07/2008 00:17:15
AERDL.DLL : 8.1.0.20 418165 Bytes 05/07/2008 00:17:15
AEPACK.DLL : 8.1.1.6 364918 Bytes 05/07/2008 00:17:15
AEOFFICE.DLL : 8.1.0.20 192891 Bytes 05/07/2008 00:17:15
AEHEUR.DLL : 8.1.0.35 1298806 Bytes 05/07/2008 00:17:15
AEHELP.DLL : 8.1.0.15 115063 Bytes 05/07/2008 00:17:14
AEGEN.DLL : 8.1.0.29 307573 Bytes 05/07/2008 00:17:14
AEEMU.DLL : 8.1.0.6 430451 Bytes 05/07/2008 00:17:14
AECORE.DLL : 8.1.0.32 168311 Bytes 05/07/2008 00:17:14
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 19:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 12:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 15:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 19:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 10:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 10:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 19:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 19:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 14:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 16:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 14:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: samedi 5 juillet 2008 10:01

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'dslmon.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SMAgent.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'vsnpstd3.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'realplay.exe' - '1' Module(s) have been scanned
Scan process 'tsystray.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'igfxtray.exe' - '1' Module(s) have been scanned
Scan process 'DrvLsnr.exe' - '1' Module(s) have been scanned
Scan process 'SMTray.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
37 processes with 37 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '34' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\ComboFix\nircmd.com
[DETECTION] Contains detection pattern of the application APPL/NirCmd.E.2.B
[NOTE] The file was moved to '48e146f9.qua'!
C:\Documents and Settings\All Users\Application Data\Gram 32 Drv Wipe\lite atom.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[WARNING] An error has occurred and the file was not deleted. ErrorID: 26003
[WARNING]
C:\Documents and Settings\Ichraf\Application Data\flaw view\Eggs boob extra manager.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '48d64717.qua'!
C:\Documents and Settings\Ichraf\Application Data\flaw view\file way gram.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '48db471e.qua'!
C:\Documents and Settings\Ichraf\Application Data\flaw view\nxdvugix.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '48d34736.qua'!
C:\Documents and Settings\Ichraf\Application Data\flaw view\send keep.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '48dd4731.qua'!
C:\Program Files\Circle Developement\Uninstall.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '48d848a9.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0017818.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4939.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0018818.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f493a.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0018840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f493b.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0019840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f493c.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0020840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f493d.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0021840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4943.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0022840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '4910479c.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P38\A0023840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4946.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P39\A0023945.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f494b.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P39\A0023975.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f494d.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0023977.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f494e.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0023982.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '49104797.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024082.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4953.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024084.com
[DETECTION] Contains detection pattern of the application APPL/NirCmd.E.2.B
[NOTE] The file was moved to '4910478c.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024085.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4954.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024086.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '4910478d.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024087.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4956.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024088.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4955.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024089.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '4910478e.qua'!
Begin scan in 'D:\'


End of the scan: samedi 5 juillet 2008 10:23
Used time: 21:44 min

The scan has been done completely.

1616 Scanning directories
144473 Files were scanned
26 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
25 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
144447 Files not concerned
811 Archives were scanned
2 Warnings
25 Notes
   
Répondre à lagiraf

9


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
lagiraf, le samedi 5 juillet 2008 à 13:34:35
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:33:21, on 05/07/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Real\RealJukebox\tsystray.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\Winamp3\winampa.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Menara\dslmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ichraf\Bureau\bitdefender_free_v10.exe
C:\DOCUME~1\Ichraf\LOCALS~1\Temp\IXP000.TMP\Setup.Exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Ichraf\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] "C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [RealJukeboxSystray] "C:\Program Files\Real\RealJukebox\tsystray.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [drv wipe iso real] "C:\Documents and Settings\All Users\Application Data\Gram 32 Drv Wipe\lite atom.exe"
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\System32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\Ichraf\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Vgamp3] C:\DOCUME~1\Ichraf\APPLIC~1\FLAWVI~1\send keep.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC108B26-7326-49A0-B09E-424207C23116}: NameServer = 212.217.0.3 196.217.246.210
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
End of file - 5908 bytes
   
Répondre à lagiraf

11


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
lagiraf, le samedi 5 juillet 2008 à 13:39:21
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:33:21, on 05/07/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Real\RealJukebox\tsystray.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\Winamp3\winampa.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Menara\dslmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ichraf\Bureau\bitdefender_free_v10.exe
C:\DOCUME~1\Ichraf\LOCALS~1\Temp\IXP000.TMP\Setup.Exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Ichraf\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] "C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [RealJukeboxSystray] "C:\Program Files\Real\RealJukebox\tsystray.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [drv wipe iso real] "C:\Documents and Settings\All Users\Application Data\Gram 32 Drv Wipe\lite atom.exe"
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\System32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\Ichraf\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Vgamp3] C:\DOCUME~1\Ichraf\APPLIC~1\FLAWVI~1\send keep.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC108B26-7326-49A0-B09E-424207C23116}: NameServer = 212.217.0.3 196.217.246.210
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
End of file - 5908 bytes
   
Répondre à lagiraf

6


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
lagiraf, le samedi 5 juillet 2008 à 12:40:03
bonjour vetetistosore , bonjour tout le monde !!hier j'ai installé l'aintivir et j'ai fait un scan!! je viens de refaire un scan avec l'antivir avira !!je t'envoie le rapport, ensuite je vais faire un autre scan avec hijackthis...




Avira AntiVir Personal
Report file date: samedi 5 juillet 2008 10:01

Scanning for 1378724 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 1) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: ICHRAF-YUVIUGUY

Version information:
BUILD.DAT : 8.1.0.308 16478 Bytes 28/05/2008 17:03:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 11:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 10:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 10:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 10:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 12:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 00:17:13
ANTIVIR2.VDF : 7.0.5.51 273408 Bytes 04/07/2008 00:17:13
ANTIVIR3.VDF : 7.0.5.52 2048 Bytes 04/07/2008 00:17:13
Engineversion : 8.1.0.64
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 11:58:21
AESCRIPT.DLL : 8.1.0.46 283002 Bytes 05/07/2008 00:17:15
AESCN.DLL : 8.1.0.22 119157 Bytes 05/07/2008 00:17:15
AERDL.DLL : 8.1.0.20 418165 Bytes 05/07/2008 00:17:15
AEPACK.DLL : 8.1.1.6 364918 Bytes 05/07/2008 00:17:15
AEOFFICE.DLL : 8.1.0.20 192891 Bytes 05/07/2008 00:17:15
AEHEUR.DLL : 8.1.0.35 1298806 Bytes 05/07/2008 00:17:15
AEHELP.DLL : 8.1.0.15 115063 Bytes 05/07/2008 00:17:14
AEGEN.DLL : 8.1.0.29 307573 Bytes 05/07/2008 00:17:14
AEEMU.DLL : 8.1.0.6 430451 Bytes 05/07/2008 00:17:14
AECORE.DLL : 8.1.0.32 168311 Bytes 05/07/2008 00:17:14
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 19:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 12:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 15:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 19:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 10:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 10:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 19:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 19:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 14:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 16:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 14:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: samedi 5 juillet 2008 10:01

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'dslmon.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SMAgent.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'vsnpstd3.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'realplay.exe' - '1' Module(s) have been scanned
Scan process 'tsystray.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'igfxtray.exe' - '1' Module(s) have been scanned
Scan process 'DrvLsnr.exe' - '1' Module(s) have been scanned
Scan process 'SMTray.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
37 processes with 37 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '34' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\ComboFix\nircmd.com
[DETECTION] Contains detection pattern of the application APPL/NirCmd.E.2.B
[NOTE] The file was moved to '48e146f9.qua'!
C:\Documents and Settings\All Users\Application Data\Gram 32 Drv Wipe\lite atom.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[WARNING] An error has occurred and the file was not deleted. ErrorID: 26003
[WARNING]
C:\Documents and Settings\Ichraf\Application Data\flaw view\Eggs boob extra manager.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '48d64717.qua'!
C:\Documents and Settings\Ichraf\Application Data\flaw view\file way gram.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '48db471e.qua'!
C:\Documents and Settings\Ichraf\Application Data\flaw view\nxdvugix.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '48d34736.qua'!
C:\Documents and Settings\Ichraf\Application Data\flaw view\send keep.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '48dd4731.qua'!
C:\Program Files\Circle Developement\Uninstall.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '48d848a9.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0017818.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4939.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0018818.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f493a.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0018840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f493b.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0019840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f493c.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0020840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f493d.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0021840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4943.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P37\A0022840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '4910479c.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P38\A0023840.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4946.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P39\A0023945.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f494b.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P39\A0023975.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f494d.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0023977.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f494e.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0023982.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '49104797.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024082.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4953.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024084.com
[DETECTION] Contains detection pattern of the application APPL/NirCmd.E.2.B
[NOTE] The file was moved to '4910478c.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024085.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4954.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024086.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '4910478d.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024087.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4956.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024088.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '489f4955.qua'!
C:\System Volume Information\_restore{C122117D-E8A8-41CD-9C08-D8CD1905045C}\R­P40\A0024089.exe
[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
[NOTE] The file was moved to '4910478e.qua'!
Begin scan in 'D:\'


End of the scan: samedi 5 juillet 2008 10:23
Used time: 21:44 min

The scan has been done completely.

1616 Scanning directories
144473 Files were scanned
26 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
25 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
144447 Files not concerned
811 Archives were scanned
2 Warnings
25 Notes
   
Répondre à lagiraf

8


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
lagiraf, le samedi 5 juillet 2008 à 12:53:25
et voici maintenant le rapport de hijackthis!
après , je vais faire ce que tu m'as dit hier!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:47:53, on 05/07/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Real\RealJukebox\tsystray.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\Winamp3\winampa.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Menara\dslmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Ichraf\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] "C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [RealJukeboxSystray] "C:\Program Files\Real\RealJukebox\tsystray.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [drv wipe iso real] "C:\Documents and Settings\All Users\Application Data\Gram 32 Drv Wipe\lite atom.exe"
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Vgamp3] C:\DOCUME~1\Ichraf\APPLIC~1\FLAWVI~1\send keep.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
End of file - 5435 bytes


@+ et merci encore
   
Répondre à lagiraf

10


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
vetetistosore, le samedi 5 juillet 2008 à 13:37:46
re st lagiraf
suprime tout ce que antivir a trouver par la suite tu va aller dans demarer post de travail disc local C: proprieter /netoyage de disc /laisse le calculer et tu va dans autre option /restauration du systeme et tu fait netoyer
pour la suite tu va dans IE proprieter historique de navigation et suprimer et la tu choisie toute les option donc tout suprimer et apres tu ferme tu ouvre c.cleener et tu nettoie tout donc historique + registre.
une fois que tu a fait sa tu va dans demarer paneau de configue bascule l'affichage sur les categorie /preformance et maintenance /en haut a gauche dans voir aussi" restaurer le systeme"/ceer un point de restaurationet la tu va ceer plusieur point 10 au moins .
une fois fait tu refais l'etape de netoyage du disc C . tu suit les etapes dans l'ordre et une fois que tu aura fait tout sa tu va refaire un scan avec antivir colle moi le rapport et pour la suite previend moi quand tu aurra fait tout sa merci
   
Répondre à vetetistosore

12


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
lagiraf, le samedi 5 juillet 2008 à 13:44:25
je ne sais pas où passent les messages que j'envoie!! j'espère qu'ils ne sont pas là où ça dérange tout le monde!!
je m'excuse!!

pour télécharger bitdefender je dois d'abord supprimer avira n'est ce pas?




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:33:21, on 05/07/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Real\RealJukebox\tsystray.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\Winamp3\winampa.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Menara\dslmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ichraf\Bureau\bitdefender_free_v10.exe
C:\DOCUME~1\Ichraf\LOCALS~1\Temp\IXP000.TMP\Setup.Exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Ichraf\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] "C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [RealJukeboxSystray] "C:\Program Files\Real\RealJukebox\tsystray.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [drv wipe iso real] "C:\Documents and Settings\All Users\Application Data\Gram 32 Drv Wipe\lite atom.exe"
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\System32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\Ichraf\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Vgamp3] C:\DOCUME~1\Ichraf\APPLIC~1\FLAWVI~1\send keep.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC108B26-7326-49A0-B09E-424207C23116}: NameServer = 212.217.0.3 196.217.246.210
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
End of file - 5908 bytes
   
Répondre à lagiraf

13


  • Ce message vous semble utile, votez !
  • Signaler ce message aux modérateurs
vetetistosore, le samedi 5 juillet 2008 à 14:23:25
non tu n'a pas besoin de suprime antivir tu va le garder , les 2 scann en ligne que je t'ai donner ne necessite pas de fermer tes antivirus au contraire ils peuvent scanner ton PC sans que tu desactive rien
antivir va etre ton antivirus a conserver ne pas le suprimer ATTENTION!!!!
pour le reste a tu fait ce que je t'ai dit et surtout dans l'ordre dit ???
et pour les log de hijackthis si tu peut arrete de me les envoyer merci o en ferra un a la fin de la desinfection de ton PC
atouta
   
Répondre à vetetistosore

14


  • Ce message vous semble utile, votez !