Sujet Précédent Sujet Suivant

Que puis je effacer

Fermé
schattenlegendar - 29 sept. 2008 à 11:03
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 29 sept. 2008 à 16:15
Bonjour, voila mon rapport hijackthis
les protocol 018 me paraissent inutiles dois je les enlever

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Zumie\zumie.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zumie\zumie.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ensemble clavier et souris sans fil Labtec\MagicKey.exe
C:\Program Files\Ensemble clavier et souris sans fil Labtec\MulMouse.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Ensemble clavier et souris sans fil Labtec\OSD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Angélique\Bureau\clean\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.freeze.com/?AcquisitionID=f05bda27-ba31-4597-bfbd-683c956ffd99&s=&ipc=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_6_2_0.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_6_2_0.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: TBSB02209 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Freeze.com Toolbar\freeze_int.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_6_2_0.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Activer l'ensemble clavier et souris sans fil Labtec.lnk = C:\Program Files\Ensemble clavier et souris sans fil Labtec\MagicKey.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{15C660E0-7780-453C-86F1-0099C2A99B13}: NameServer = 192.168.1.1
O18 - Protocol: bw+0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw+0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw-0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw-0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw00 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw00s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw10 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw10s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw20 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw20s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw30 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw30s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw40 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw40s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw50 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw50s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw60 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw60s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw70 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw70s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw80 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw80s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw90 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw90s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwa0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwa0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwb0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwb0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwc0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwc0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwd0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwd0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwe0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwe0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwf0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwf0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - (no file)
O18 - Protocol: bwg0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwg0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwh0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwh0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwi0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwi0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwj0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwj0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwk0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwk0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwl0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwl0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwm0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwm0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwn0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwn0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwo0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwo0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwp0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwp0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwq0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwq0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwr0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwr0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bws0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bws0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwt0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwt0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwu0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwu0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwv0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwv0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bww0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bww0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwx0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwx0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwy0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwy0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwz0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwz0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: offline-8876480 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgemc.exe (file missing)
O23 - Service: AVG8 WatchDog (avg8wd) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (file missing)
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Zumie Search Service - Zumie.com - C:\Program Files\Zumie\zumie.exe

11 réponses

Réponse 1 / 11
schattenlegendar
29 sept. 2008 à 11:21
ok je te remercie je vais virer ça en attendant le rapport de virus total
0
Réponse 2 / 11
schattenlegendar
29 sept. 2008 à 11:22
voila le rapport MD5: daee383586db76671c43a83c04e51283
First received: 2007.10.06 21:07:27 (CET)
Date 2008.09.29 04:32:37 (CET) [<1D]
Résultats 3/36
Permalink: analisis/f03a5cb215491fe0f2a7f50138e82317
0
Réponse 3 / 11
schattenlegendar
29 sept. 2008 à 11:32
il y avait 142 infection pour un scan rapide voila le rapport
Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1134
Windows 5.1.2600 Service Pack 3

29/09/2008 11:32:00
mbam-log-2008-09-29 (11-32-00).txt

Type de recherche: Examen rapide
Eléments examinés: 50070
Temps écoulé: 2 minute(s), 51 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 6
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 9
Fichier(s) infecté(s): 126

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Interface\{32bb2c9a-647b-455b-82fe-151eb882e96e} (Adware.DosPopToolbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7e5c5dae-44b0-47c3-ba30-ba8d08f2437f} (Adware.DosPopToolbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{77aa25e8-6083-4949-a831-9cb11861dc10} (Adware.DosPopToolbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fcbccb87-9224-4b8d-b117-f56d924beb18} (Adware.DosPopToolbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fcbccb87-9224-4b8d-b117-f56d924beb18} (Adware.DosPopToolbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Casino Tropez (Adware.Casino) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsys2 (Spyware.OnlineGames) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Casino (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\download (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\download\modules (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Documents and Settings\Angélique\Application Data\DriveCleaner 2006 Free (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\Angélique\Application Data\DriveCleaner 2006 Free\Logs (Rogue.DriveCleaner) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\Angélique\Local Settings\Application Data\cofaidd_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Angélique\Local Settings\Application Data\cofaidd_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Angélique\Local Settings\Application Data\cofaidd.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Angélique\Local Settings\Application Data\qcswoymow_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Angélique\Local Settings\Application Data\qcswoymow_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Angélique\Local Settings\Application Data\qcswoymow.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Program Files\Freeze.com Toolbar\freeze_int.dll (Adware.DosPopToolbar) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\arialn_wglb.ttf (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\arial_wgl.ttf (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\arial_wgl_b.ttf (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\casino.exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\clientcore.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\clientscommon.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\common.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\commondlg.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\cximagecrt.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\db.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\devlib.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\devlibcomm.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\download.log (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\game.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gui1lobby.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\ipwssl6.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\misc.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\modstatus.lst (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\mp3dec.asi (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\mss32.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\msvcp71.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\msvcr71.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\playermessage.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\ro.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\timer.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\webbrowsercontrol.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\xml.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_blue.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_blue_low.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_grn.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_grn_low.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_lila.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_lila_low.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_red.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_red_low.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_std.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_std_low.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_ylw.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_mark_s_ylw_low.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_panel_markers.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_ro_bigball.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_ro_historyled.bmp (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_ro_player_color.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_ro_smallball.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_ro_winmarker.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_common_timer.png (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_fro_animclose.jpg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_fro_bkg.jpg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_fro_btndata.bmp (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_fro_fillmap.bmp (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_fro_frame.jpg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_fro_numbers.jpg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\gfx\game_fro_wheelanim.jpg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_0.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_00.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_1.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_10.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_11.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_12.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_13.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_14.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_15.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_16.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_17.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_18.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_19.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_2.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_20.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_21.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_22.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_23.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_24.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_25.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_26.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_27.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_28.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_29.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_3.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_30.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_31.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_32.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_33.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_34.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_35.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_36.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_4.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_5.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_6.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_7.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_8.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_9.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_betexc.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_betlow.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_button.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_chip.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_nmbet.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_ping.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_place.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_plyw.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_ro_black.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_ro_bounc.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_ro_even.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_ro_odd.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_ro_red.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\sfx\game_common_ro_roll.mp3 (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\xrs\config_casino_settings.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\xrs\config_common_game.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\xrs\game_common_chat.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\xrs\game_common_tournamentcomponents.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\xrs\game_common_tournamentdefines.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\xrs\game_common_tournamentinfo.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\xrs\game_fro_main.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bwin Casino\xrs\game_fro_panel.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Documents and Settings\Angélique\Application Data\DriveCleaner 2006 Free\Logs\update.log (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WinSys2.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gpvmtn_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lgdesd_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gpvmtn_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lgdesd_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
0
Réponse 4 / 11
schattenlegendar
29 sept. 2008 à 11:48
ok voila
Search Navipromo version 3.6.5 commencé le 29/09/2008 à 11:43:24,62

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Angélique"

Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.5512
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Angélique\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.HAL\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.000\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.001\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Angélique\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.HAL\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.000\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.001\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Angélique\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.HAL\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.000\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.001\menudm~1\progra~1" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Angélique\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1.HAL\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1.000\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1.001\locals~1\applic~1" *



*** Recherche fichiers ***


C:\WINDOWS\pack.epk trouvé !

*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :

lgdesd.dat trouvé !

* Dans "C:\Documents and Settings\Angélique\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1.HAL\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1.000\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1.001\locals~1\applic~1" :


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 29/09/2008 à 11:47:33,73 ***
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 11
schattenlegendar
29 sept. 2008 à 12:08
merci pour toutes ces informations et procédures s était la première fois que je postais
un problème dans un forum a+
0
Réponse 6 / 11
schattenlegendar
29 sept. 2008 à 16:00
rapport navilog

Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.5512
Système de fichiers : NTFS

Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Angélique\locals~1\applic~1" *


* Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

* Suppression dans "C:\DOCUME~1\ADMINI~1.HAL\locals~1\applic~1" *

* Suppression dans "C:\DOCUME~1\ADMINI~1.000\locals~1\applic~1" *

* Suppression dans "C:\DOCUME~1\ADMINI~1.001\locals~1\applic~1" *


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Angélique\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1.HAL\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1.000\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1.001\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Angélique\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1.HAL\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1.000\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1.001\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Angélique\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1.HAL\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1.000\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1.001\menudm~1\progra~1" ***



*** Suppression fichiers ***

C:\WINDOWS\pack.epk supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Ang‚lique\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


lgdesd.dat trouvé !
Copie lgdesd.dat réalisée avec succès !
lgdesd.dat supprimé !


* Dans "C:\Documents and Settings\Angélique\locals~1\applic~1" *


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *


* Dans "C:\DOCUME~1\ADMINI~1.HAL\locals~1\applic~1" *


* Dans "C:\DOCUME~1\ADMINI~1.000\locals~1\applic~1" *


* Dans "C:\DOCUME~1\ADMINI~1.001\locals~1\applic~1" *


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Nettoyage terminé le 29/09/2008 à 15:47:55,57 ***
0
Réponse 7 / 11
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
29 sept. 2008 à 11:09
slt,



analyse ce fichier sur virus total et colle le rapport https://www.virustotal.com/gui/

C:\WINDOWS\system32\winsys2.exe




_________________

tu utilise Freeze.com Toolbar??? car souvent associée a des espions....



___________________

tu peux déjà fixer ceci:

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O18 - Protocol: bw+0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw+0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw-0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw-0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw00 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw00s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw10 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw10s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw20 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw20s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw30 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw30s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw40 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw40s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw50 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw50s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw60 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw60s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw70 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw70s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw80 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw80s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw90 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bw90s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwa0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwa0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwb0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwb0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwc0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwc0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwd0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwd0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwe0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwe0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwf0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwf0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - (no file)
O18 - Protocol: bwg0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwg0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwh0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwh0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwi0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwi0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwj0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwj0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwk0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwk0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwl0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwl0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwm0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwm0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwn0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwn0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwo0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwo0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwp0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwp0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwq0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwq0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwr0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwr0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bws0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bws0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwt0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwt0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwu0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwu0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwv0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwv0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bww0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bww0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwx0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwx0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwy0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwy0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwz0 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: bwz0s - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O18 - Protocol: offline-8876480 - {A7B6FBD1-CAA4-428D-8F32-5F1F28E218FE} - (no file)
O23 - Service: AVG8 E-mail Scanner (avg8emc) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgemc.exe (file missing)
O23 - Service: AVG8 WatchDog (avg8wd) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (file missing)
-1
Réponse 8 / 11
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
29 sept. 2008 à 11:25
scan avec
MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
-1
Réponse 9 / 11
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
29 sept. 2008 à 11:39
la prochaine fois explique mieux tes soucis? tu aurais du dire que tu avais des pubs....





Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)
-1
Réponse 10 / 11
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
29 sept. 2008 à 12:37
= Lance navilog1
= Cette fois-ci choisi l'option 2
= Navilog va faire le nettoyage.. patient jusqu'à ce qui soit marqué *** Nettoyage Termine le ..... ***
= Un rapport va être génrer sur ton C:\ qui sera en option 2
Note: le bureau disparaît

= colle le contenu du rapport de navilog (qui est en option2)


PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tape explorer et valide. Celà te fera apparaitre ton bureau.
____________________

refais malwarebyte mais un examen complet cette fois!!!! et colle le rapport
-1
Réponse 11 / 11
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
29 sept. 2008 à 16:15
refais malwarebyte mais un examen complet cette fois!!!! et colle le rapport


puis recolle un rapport hijakchtis et dis tes soucis actuels
-1

Discussions similaires

Pokémon X et Y : comment effacer une partie ?
PokéFan -
yoshiedu13 -

49 réponses
Comment on fait pour supprimer les conversations sur Snap ?
Eva6240 -
Charlito598 -

46 réponses
touche suppr du clavier ne fonctionne plus
djef1 -
Yzey -

13 réponses
comment effacer l'historique de google
gen-gen -
twinplatinerouge -

25 réponses
Supprimer les suggestions de recherches sur Instagram
Hip93 -
J -

8 réponses