Aide a lire toolbar s.dRésolu/Fermé

Question

Bonjour,
j avais 1 probleme desinstaller vuze toolbar..et g cherche des solution..et g trouve ce programme <toolbar s.d....

 sur ce site https://www.commentcamarche.net/faq/9685-supprimer-les-barres-d-outils-toolbars-indesirables
 
Mais j aimerais bien 1 connaisseur m aide...a debarase de ce foutu vuze.voici le rapport


   -----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-58 )
   BIOS : PhoenixBIOS 4.0 Release 6.1     
   USER : Mohammed ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
   Firewall  : ZoneAlarm Firewall 7.0.483.000 (Activated)
   C:\ (Local Disk) - NTFS - Total:142 Go (Free:84 Go)
   D:\ (Local Disk) - NTFS - Total:6 Go (Free:6 Go)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [1] ( 17.03.2010| 0:28 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (Mohammed) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user
   (Mohammed) - {40a1f5d7-afc2-498f-b264-02668d616ff6} => megamanager
   (Mohammed) - {ba14329e-9550-4989-b3f2-9732e92d17cc} => vuze_remote
   (Mohammed) - {EEE6C361-6118-11DC-9C72-001320C79847} => sweetim-toolbar


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 17.03.2010| 0:30 - Option : [1]

   -----------\  Fin du rapport a  0:30:38,35

g!rly · Answer

salut
donne moi de quoi voir.

Télécharge HijackThis ici : 

-> https://www.commentcamarche.net/telecharger/securite/11747-hijackthis/

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

-> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

Post le rapport généré ici stp...

papa levi · Answer

bonsoir, Merci de repondre si vite..voici le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:14:43, on 17.03.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\SYSTEM32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\Programfiler\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Programfiler\Avira\AntiVir Desktop\sched.exe
C:\Programfiler\Fellesfiler\Acronis\Schedule2\schedul2.exe
C:\Programfiler\Avira\AntiVir Desktop\avguard.exe
C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programfiler\Bonjour\mDNSResponder.exe
C:\windows\System32\svchost.exe
C:\Programfiler\Java\jre6\bin\jqs.exe
C:\Programfiler\Fellesfiler\LightScribe\LSSrvc.exe
C:\windows\system32
vsvc32.exe
C:\Programfiler\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\Programfiler\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\windows\system32\svchost.exe
C:\Programfiler\Fellesfiler\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32
SvcAppFlt.exe
C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32
SvcIp.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\windows\Explorer.EXE
C:\Programfiler\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\windows\system32\ICO.EXE
C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
C:\windows\system32\RUNDLL32.EXE
C:\Programfiler\Windows Defender\MSASCui.exe
C:\windows\system32undll32.exe
C:\Programfiler\Avira\AntiVir Desktop\avgnt.exe
C:\Programfiler\Fellesfiler\Real\Update_OBealsched.exe
C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
C:\Programfiler\Hewlett-Packard\Shared\HpqToaster.exe
C:\Programfiler\Winamp\winampa.exe
C:\Programfiler\Java\jre6\bin\jusched.exe
C:\windows\system32\ctfmon.exe
C:\Programfiler\Windows Live\Messenger\MsnMsgr.Exe
C:\Programfiler\Messenger\msmsgs.exe
C:\Programfiler\Ares\Ares.exe
C:\Programfiler\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programfiler\Mozilla Firefox\firefox.exe
C:\Programfiler\Megaupload\Mega Manager\MegaManager.exe
C:\windows\system32\wuauclt.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program filesealealplayerpbrowserrecordplugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programfiler\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre6\bin\ssv.dll
O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Programfiler\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programfiler\Java\jre6\bin\jp2ssv.dll
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programfiler\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programfiler\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programfiler\Veoh Networks\Veoh\Pluginseg\VeohToolbar.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Programfiler\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Programfiler\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programfiler\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Programfiler\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avgnt] "C:\Programfiler\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programfiler\Fellesfiler\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programfiler\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ares] "C:\Programfiler\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: PalTalk.lnk = C:\Programfiler\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Programfiler\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - https://www.eset.com/
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {7A0D1738-10EA-47FF-92BE-4E137B5BE1A4} (Stm Class) - https://mpsnare.iesnare.com/StmOCX.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (Ma-Config control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_0_2_0.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programfiler\Fellesfiler\Acronis\Schedule2\schedul2.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Programfiler\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programfiler\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programfiler\Bonjour\mDNSResponder.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32
SvcAppFlt.exe
O23 - Service: Service Google Update (gupdate1c9e863b3228e84) (gupdate1c9e863b3228e84) - Google Inc. - C:\Programfiler\Google\Update\GoogleUpdate.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programfiler\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programfiler\Fellesfiler\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Programfiler\ma-config.com\maconfservice.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32
vsvc32.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Programfiler\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Programfiler\Fellesfiler\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

g!rly · Answer

il y a bien un tas de toolbar mais pas de vuze ?!
fais ceci :
Télécharge sur ton bureau OAD (Outil Aide Diagnostic) de !aur3n7 : http://sosvirus.changelog.fr/OAD.exe

Clique droit sur le fichier OAD.exe et sur Propriétés, dans l'onglet Compatibilité, Cadre "Niveau de privilège" coche
"Exécuter ce programme en tant qu'administrateur".
Lance-le en cliquant sur OAD.exe, entre le nom du fichier suivant "Vuze", puis Entrée.
Dans la fenêtre suivante tape 6 puis entrée et laisse le scan se terminer.
Copie-colle la totalité du rapport qui s'ouvre dans le blocnote dans ta prochaine réponse.

papa levi · Answer

bsoir g vois pas de cadre niveau de privilege ke g dois crocher...dois je contunuer ou..me le redire d 1 autre maniere 
Mrci

g!rly · Answer

fais comme ton instinct te dicte :)

papa levi · Answer

Dsl..mon pc est  norvegiens ....donc...

Voici.le rapport..

 17.03.2010 ----  1:34:33,67  

----------------------------------
§§§§§§ [vuze] §§§§§§
----------------------------------
[X] Registre
[  ] Fichier (rapide)
[  ] Fichier (disque systeme)
[X] Fichier (complete)




********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vuze]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vuze]
@="Vuze"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Azureus]
@="Vuze Download"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-vuze]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-vuze]
"Extension"=".vuze"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Vuze]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Vuze]
@="Vuze File"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Vuze\DefaultIcon]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Vuze\shell]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Vuze\shell\open]

[HKEY_LOCAL_MACHINE\SOFTWARE\magnet\Handlers\Azureus]
"Description"="Download with Vuze (formerly Azureus)"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\9d1d354a-604e-4ee6-a69c-9bc3a00e4867]
"AppPath"="C:\Programfiler\Vuze_Remote"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\9d1d354a-604e-4ee6-a69c-9bc3a00e4867]
"AppName"="Vuze_RemoteToolbarHelper.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Azureus Vuze]

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Conduit\AppPaths\Vuze.exe]

"c:\documents and settings\mohammed\lokale innstillinger\temporary internet files\content.ie5\nadf71fd\vuze_installer[1].exe"=dword:000016fc

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="vuze"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Azureus Vuze]

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\.vuze]

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\.vuze]
@="Vuze"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\.vuze]
"Content Type"="application/x-vuze"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\Azureus]
@="Vuze Download"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\MIME\Database\Content Type\application/x-vuze]

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\MIME\Database\Content Type\application/x-vuze]
"Extension"=".vuze"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\Vuze]

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\Vuze]
@="Vuze File"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\Vuze]
"Content Type"="application/x-vuze"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003\Software\Classes\Vuze\shell]

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\.vuze]

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\.vuze]
@="Vuze"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\.vuze]
"Content Type"="application/x-vuze"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\Azureus]
@="Vuze Download"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\MIME\Database\Content Type\application/x-vuze]

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\MIME\Database\Content Type\application/x-vuze]
"Extension"=".vuze"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\Vuze]

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\Vuze]
@="Vuze File"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\Vuze]
"Content Type"="application/x-vuze"

[HKEY_USERS\S-1-5-21-1957994488-1390067357-725345543-1003_Classes\Vuze\shell]

*******************
     [Fichier] 
*******************

c:\Documents and Settings\All Users\Skrivebord\Vuze.lnk
c:\Documents and Settings\Mohammed\Programdata\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
c:\Programfiler\Azureus\Vuze.ico


*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

Destrio5 · Answer

Bonjour (Salut g!rly),

&#9679; Télécharge Ad-Remover (de C_XX) sur ton Bureau.
&#9679; Déconnecte-toi d'Internet et ferme toutes applications en cours. 
&#9679; Double-clique sur le programme AD-R situé sur ton Bureau.
&#9679; Clique sur Nettoyer puis valide.
&#9679; Poste le rapport généré (C:\Ad-Report-CLEAN.log).

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

papa levi · Answer

Bonsoir destrio voici le rapport de ad-remover . ======= RAPPORT D'AD-REMOVER 2.0.0.0,A | ONLY XP/VISTA/7 ======= . Updated by C_XX on 15/03/10 à 17:00 Contact: AdRemover.contact@gmail.com Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html . Started: 02:13:24 le 17/03/2010 | Normal boot | Option: CLEAN Executed from: C:\Ad-Remover\ADR.exe Operating systèm: Microsoft® Windows XP™ Service Pack 3 Computer name: HP | Current user: Mohammed (Administrator) . ============== FIXED ELEMENTS ============== . . C:\DOCUME~1\Mohammed\LOKALE~1\Temp\ASKSUTBLOG C:\DOCUME~1\Mohammed\LOKALE~1\Temp\Del_AskHPRFF.VBS C:\Documents and Settings\Mohammed\Programdata\Mozilla\FireFox\Profiles\84dm41mz.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} C:\Documents and Settings\Mohammed\Programdata\Mozilla\FireFox\Profiles\84dm41mz.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847} C:\Documents and Settings\Mohammed\Programdata\Mozilla\FireFox\Profiles\84dm41mz.default\searchplugins\askcom.xml C:\Documents and Settings\Mohammed\Programdata\Mozilla\FireFox\Profiles\84dm41mz.default\SweetIMToolbarData C:\Programfiler\Mozilla FireFox\Components\AskSearch.js (!) -- Deleted temporary files. . HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} HKCU\Software\SweetIM HKLM\Software\Microsoft\ESENT\Process\SweetIM HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420} HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440} . ============== ADDITIONNAL SCAN ============== . * Mozilla FireFox Version 3.0.18 (fr) * . C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.download.lastDir: C:\Documents and Settings\Mohammed\Mine dokumenter\Mine bilder C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.search.defaultenginename: Ask C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.search.defaulturl: hxxp://search.sweetim.com/search.asp?src=2&q= C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.search.selectedEngine: Ask C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.startup.homepage: www.google.fr C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.0.18 C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - sweetim.toolbar.previous.browser.search.defaultenginename: Live Search C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - sweetim.toolbar.previous.browser.search.defaulturl: hxxp://search.live.com/results.aspx?FORM=IEFM1&q= C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - sweetim.toolbar.previous.browser.search.selectedEngine: Live Search C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - sweetim.toolbar.previous.browser.startup.homepage: hxxp://go.microsoft.com/fwlink/?LinkId=69157 C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - sweetim.toolbar.previous.keyword.URL: hxxp://search.live.com/results.aspx?FORM=IEFM1&q= . ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q="); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("extensions.snipit.chromeURL", "hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q={searchTerms}&crm=1"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.mode.debug", "false"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "Live Search"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://search.live.com/results.aspx?FORM=IEFM1&q="); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "Live Search"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://go.microsoft.com/fwlink/?LinkId=69157"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.live.com/results.aspx?FORM=IEFM1&q="); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.search.external", ""); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.search.history.capacity", "10"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.simapp_id", "{23FDE954-6171-411E-A4DA-F09790FAD874}"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com"); ERASED: C:\Documents and Settings\Mohammed\Programdata\mozilla\firefox\profiles\84dm41mz.default\prefs.js - user_pref("sweetim.toolbar.version", "1.0.0.8"); . * Internet Explorer Version 8.0.6001.18702 * . [HKCU\Software\Microsoft\Internet Explorer\Main] . AutoHide: yes Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Do404Search: 0x01000000 Enable Browser Extensions: yes Local Page: C:\WINDOWS\system32\blank.htm Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896 Show_ToolBar: yes Start Page: hxxp://fr.msn.com/ . [HKLM\Software\Microsoft\Internet Explorer\Main] . Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Delete_Temp_Files_On_Exit: yes Local Page: C:\WINDOWS\system32\blank.htm Search bar: hxxp://search.msn.com/spbasic.htm Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Start Page: hxxp://fr.msn.com/ . [HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS] . Tabs: res://ieframe.dll/tabswelcome.htm Blank: res://mshtml.dll/blank.htm . ======================================== . C:\DOCUME~1\Mohammed\LOKALE~1\Temp: 3 Files, 6 Folders C:\windows emp: 4 Files, 9 Folders Temporary Internet Files: 2 Files, 23 Folders . C:\Ad-Remover\Quarantine: 4 Files C:\Ad-Remover\Backup: 14 Files . C:\Ad-Report-CLEAN[1].txt - 9302 Byte(s) . End at:02:20:41, 17/03/2010 . ============== E.O.F - CLEAN[1] ==============

Destrio5 · Answer

--> Relance Ad-Remover et choisis Désinstaller.

Le problème est réglé ?

papa levi · Answer

oui..mais g tjrs tolbar vuze..sur mon mozilla....ke dois faire..???

Destrio5 · Answer

Tu ne peux pas tout simplement la désinstaller à partir du Panneau de configuration ?

g!rly · Answer

salut destrio5 
j´ai des liens datant de l´avant guerre on dirait :)
bises`

papa levi · Answer

pour le programme vuze...g des-installer longtime..mais le tolbar reste encore..g ss pas cmt enleveer pcq...g vois pas de tolbar vuze installer sur ajout/supprimer

Destrio5 · Answer

Sinon, c'est expliqué ici :
http://wiki.vuze.com/?View=entry&EntryID=206

papa levi · Answer

oh Merci..ce enlever..mais j aimerais bien ke tu jette 1 coup d oeil sur mon hijackthis..juste pour voir..si tt est normale.mon antivirus avira a  trouve fakAlert trojan..y a 2 jours..et g le supprimer..mais..g ss pas..

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:36:16, on 17.03.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\SYSTEM32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\Programfiler\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Programfiler\Avira\AntiVir Desktop\sched.exe
C:\Programfiler\Fellesfiler\Acronis\Schedule2\schedul2.exe
C:\Programfiler\Avira\AntiVir Desktop\avguard.exe
C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programfiler\Bonjour\mDNSResponder.exe
C:\windows\System32\svchost.exe
C:\Programfiler\Java\jre6\bin\jqs.exe
C:\Programfiler\Fellesfiler\LightScribe\LSSrvc.exe
C:\windows\system32
vsvc32.exe
C:\Programfiler\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\Programfiler\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\windows\system32\svchost.exe
C:\Programfiler\Fellesfiler\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32
SvcAppFlt.exe
C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32
SvcIp.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programfiler\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\windows\system32\ICO.EXE
C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
C:\Programfiler\Windows Defender\MSASCui.exe
C:\windows\system32undll32.exe
C:\Programfiler\Avira\AntiVir Desktop\avgnt.exe
C:\Programfiler\Fellesfiler\Real\Update_OBealsched.exe
C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
C:\Programfiler\Hewlett-Packard\Shared\HpqToaster.exe
C:\Programfiler\Winamp\winampa.exe
C:\Programfiler\Java\jre6\bin\jusched.exe
C:\windows\system32\ctfmon.exe
C:\Programfiler\Messenger\msmsgs.exe
C:\Programfiler\Ares\Ares.exe
C:\Programfiler\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programfiler\Megaupload\Mega Manager\MegaManager.exe
C:\windows\explorer.exe
C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program filesealealplayerpbrowserrecordplugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programfiler\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre6\bin\ssv.dll
O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Programfiler\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programfiler\Java\jre6\bin\jp2ssv.dll
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programfiler\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programfiler\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programfiler\Veoh Networks\Veoh\Pluginseg\VeohToolbar.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Programfiler\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Programfiler\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programfiler\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Programfiler\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avgnt] "C:\Programfiler\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programfiler\Fellesfiler\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programfiler\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ares] "C:\Programfiler\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: PalTalk.lnk = C:\Programfiler\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Programfiler\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {7A0D1738-10EA-47FF-92BE-4E137B5BE1A4} (Stm Class) - https://mpsnare.iesnare.com/StmOCX.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (Ma-Config control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_0_2_0.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programfiler\Fellesfiler\Acronis\Schedule2\schedul2.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Programfiler\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programfiler\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programfiler\Bonjour\mDNSResponder.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32
SvcAppFlt.exe
O23 - Service: Service Google Update (gupdate1c9e863b3228e84) (gupdate1c9e863b3228e84) - Google Inc. - C:\Programfiler\Google\Update\GoogleUpdate.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programfiler\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programfiler\Fellesfiler\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Programfiler\ma-config.com\maconfservice.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin32
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32
vsvc32.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Programfiler\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Programfiler\Fellesfiler\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Destrio5 · Answer

Je vais dormir, bonne nuit.

---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.

A la fin de l'analyse, un message s'affiche :

L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

papa levi · Answer

OK destrio...Merci pour ton aide g collerais le rapport lorske ce fini

papa levi · Answer

slt,

MBAM n as rien trouve...tt est ok...g crois...

Grands Merci a vous.

Aide a lire toolbar s.d

18 réponses

Discussions similaires

Newsletters