Besoin d'aide avec mon analyse HiJackThis

Ajouter un message à la discussion

tacite

Posté le 02/07/2007 @ 17:26

Bonjour,

Ma page d'accueil IE7 est toujours remplacée par About Blank.

J'ai essayé sans succés différentes méthodes proposées sur le Web et il est conseillé de faire une analyse HijackThis et de placer le résultat sur le forum pour identifier le pb. Voici le résultat:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:13:10, on 02/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\VSTASCAN\vsaccess.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Cobian Backup 8\cbService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\dllhost.exe
D:\LOGICIELS\Hijackthis\HiJackThis_v2.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe

Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program

Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program

files\google\googletoolbar1.dll
O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} -

C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma

Loader.exe
O4 - Startup: UMAX VistaAccess.lnk = C:\VSTASCAN\vsaccess.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check(2).lnk =

C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google

Updater\GoogleUpdater.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file

missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66}

- %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network

Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

%windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O16 - DPF: {00000005-0000-0000-0000-100009000004} -

http://c.imputati.com/l/5893a68bb72177e6d4a2e4614e277325_35.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -

http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -

http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) -

http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) -

http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) -

http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168007571765
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) -

http://javadl-esd.sun.com/update/1.6.0/jinstall-6u1-windows-i586-jc.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -

http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) -

http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -

http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5019/mcfscan.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program

Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program

Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir

PersonalEdition Classic\avguard.exe
O23 - Service: Cobian Backup 8 service (CobBMService) - Luis Cobian - C:\Program Files\Cobian Backup

8\cbService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -

C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive

Software\DiskeeperLite\DKService.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner -

C:\WINDOWS\System32\dmadmin.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION -

C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers

communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Administration IIS (IISADMIN) - Unknown owner - C:\WINDOWS\system32\inetsrv\inetinfo.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner -

C:\WINDOWS\System32\imapi.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner -

C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner -

C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Simple Mail Transfer Protocol (SMTP) (SMTPSVC) - Unknown owner -

C:\WINDOWS\system32\inetsrv\inetinfo.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner -

C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers

communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -

C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Publication World Wide Web (W3SVC) - Unknown owner -

C:\WINDOWS\system32\inetsrv\inetinfo.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner -

C:\WINDOWS\System32\wbem\wmiapsrv.exe

--
End of file - 11299 bytes

Merci de votre aide.

philbz

Posté le 02/07/2007 à 17:45

tacite

Hijackthis n'est pas installé au bon endroit

tu dois le mettre sur C:

clique sur ma signature "prénettoyage d'un pc infecté"

et poste les rapports demandés

un(e) astucien(ne) compétente va te venir en aide

bonne soirée

nardino

Posté le 02/07/2007 à 21:15

Grand Maître astucien

Bonsoir,

L'analyse de ton rapport est en cours...@ tout à l'heure.

nardino

Posté le 02/07/2007 à 21:27

Grand Maître astucien

Re,

Télécharge findlop : http://metallica.geekstogo.com/findlop.zip

Crée un répertoire à la racine du système comme suit :
C:\findlop
Dézippe-le dedans et lance-le en double cliquant sur findlop.bat
Cela va générer un rapport ici :
C:\findlop.txt

Poste-le pour analyse.

Ainsi que :

Télécharge lopxp sur le bureau

http://www.alt-shift-return.org/Info/Fichiers/lopxpMH2.zip

Decompresse-le (clic droit dessus > extraire tout)
Lance lopxpmh.bat en double-cliquant dessus
Quand il a terminé, un rapport s'ouvre, copie-colle le contenu du rapport dans ta réponse.

Peux-tu remplacer ta version de Hijackthis par celle-ci:

http://pchelpbordeaux.free.fr/frames/logiciels/HIJACKTHIS%20VF.exe" target="_blank"> http://pchelpbordeaux.free.fr/frames/logiciels/HIJACKTHIS%20VF.exe

tacite

Posté le 02/07/2007 à 23:38

Bonsoir philbz,

Je réponds en premier à ton message, j'ai réalisé toute la procédure de pré-nettoyage d'un PC infecté comme recommandé, à savoir:

1 - Chargement de AVG Anti-spyware, j'ai déjà CCleaner installé.

2 - Redémarage en mode sans échec et lancement nettoyage CCleaner puis lancement AVG Anti-spyware, aucun spyware trouvé.

3 - Redémarage en mode normal et chargement de Hijackthis dans C/Programme files/Hijackthis dont le résultat suit:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 23:15:41, on 02/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\VSTASCAN\vsaccess.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Cobian Backup 8\cbService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: UMAX VistaAccess.lnk = C:\VSTASCAN\vsaccess.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check(2).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00000005-0000-0000-0000-100009000004} - http://c.imputati.com/l/5893a68bb72177e6d4a2e4614e277325_35.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168007571765
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u1-windows-i586-jc.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5019/mcfscan.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Cobian Backup 8 service (CobBMService) - Luis Cobian - C:\Program Files\Cobian Backup 8\cbService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Administration IIS (IISADMIN) - Unknown owner - C:\WINDOWS\system32\inetsrv\inetinfo.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Simple Mail Transfer Protocol (SMTP) (SMTPSVC) - Unknown owner - C:\WINDOWS\system32\inetsrv\inetinfo.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Publication World Wide Web (W3SVC) - Unknown owner - C:\WINDOWS\system32\inetsrv\inetinfo.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe--

End of file - 11389 bytes

Etant donné l'heure, je stoppe et répondrai à nardino demain.

Merci à tous les deux de votre concours.

tacite

Posté le 04/07/2007 à 01:58

Bonsoir,

Je viens de terminer les analyses proposées par nardino et voici les résultats:

1 - Analyse Findlop

[TRACE] Enumerating jobs and queues
[TRACE] Activating job 'AdwareAlert Scheduled Scan.job'
[TRACE] Printing all job properties

ApplicationName: 'C:\Program Files\AdwareAlert\AdwareAlert.exe'
Parameters: 'scheduled'
WorkingDirectory: 'C:\Program Files\AdwareAlert'
Comment: 'Runs AdwareAlert to scan your computer for malicious and potenially unwanted programs.'
Creator: 'Administrateur'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 00/00/0000 0:00:00
NextRun: 07/04/2007 3:00:00
StartError: 0x80070003
ExitCode: 0
Status: SCHED_S_TASK_HAS_NOT_RUN
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 0
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 1
SystemRequired = 0
Hidden = 0
TaskFlags: 0

1 Trigger

Trigger 0:
Type: Daily
DaysInterval: 1
StartDate: 05/27/2007
EndDate: 00/00/0000
StartTime: 03:00
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0

[TRACE] Activating job 'AppleSoftwareUpdate.job'
[TRACE] Printing all job properties

ApplicationName: 'C:\Program Files\Apple Software Update\SoftwareUpdate.exe'
Parameters: '-Task'
WorkingDirectory: ''
Comment: ''
Creator: 'SYSTEM'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 06/28/2007 9:21:59
NextRun: 07/05/2007 9:22:00
StartError: S_OK
ExitCode: 0
Status: SCHED_S_TASK_READY
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 0
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 0
SystemRequired = 0
Hidden = 0
TaskFlags: 0

1 Trigger

Trigger 0:
Type: Weekly
WeeksInterval: 1
DaysOfTheWeek: ....R..
StartDate: 04/19/2007
EndDate: 00/00/0000
StartTime: 09:22
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0

[TRACE] Activating job 'MP Scheduled Scan.job'
[TRACE] Printing all job properties

ApplicationName: 'C:\Program Files\Windows Defender\MpCmdRun.exe'
Parameters: 'Scan -RestrictPrivileges'
WorkingDirectory: ''
Comment: 'Scheduled Scan'
Creator: 'SYSTEM'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 00/00/0000 0:00:00
NextRun: 07/04/2007 2:11:00
StartError: SCHED_S_TASK_HAS_NOT_RUN
ExitCode: 0
Status: SCHED_S_TASK_HAS_NOT_RUN
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 1
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 0
SystemRequired = 0
Hidden = 1
TaskFlags: 0

1 Trigger

Trigger 0:
Type: Daily
DaysInterval: 1
StartDate: 07/03/2007
EndDate: 00/00/0000
StartTime: 02:11
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0

[TRACE] Activating job 'XoftSpySE 2.job'
[TRACE] Printing all job properties

ApplicationName: 'C:\Program Files\XoftSpySE\XoftSpy.exe'
Parameters: 'ShowReminders'
WorkingDirectory: 'C:\Program Files\XoftSpySE\\'
Comment: 'Runs XoftSpySE at Scheduled Time.'
Creator: 'Administrateur'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 07/03/2007 23:45:47
NextRun: 07/04/2007 17:00:00
StartError: S_OK
ExitCode: 0
Status: SCHED_S_TASK_READY
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 0
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 1
SystemRequired = 0
Hidden = 0
TaskFlags: 0

2 Triggers

Trigger 0:
Type: AtLogon
StartDate: 01/01/2006
EndDate: 00/00/0000
StartTime: 12:00
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0

Trigger 1:
Type: Daily
DaysInterval: 1
StartDate: 01/01/2006
EndDate: 00/00/0000
StartTime: 17:00
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0

[TRACE] Activating job 'XoftSpySE.job'
[TRACE] Printing all job properties

ApplicationName: 'C:\Program Files\XoftSpySE\XoftSpy.exe'
Parameters: '-t'
WorkingDirectory: 'C:\Program Files\XoftSpySE\\'
Comment: 'Runs XoftSpySE at Scheduled Time.'
Creator: 'Administrateur'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 06/30/2007 3:00:03
NextRun: 07/07/2007 3:00:00
StartError: S_OK
ExitCode: 0
Status: SCHED_S_TASK_READY
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 0
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 1
SystemRequired = 0
Hidden = 0
TaskFlags: 0

1 Trigger

Trigger 0:
Type: Weekly
WeeksInterval: 1
DaysOfTheWeek: ..T...A
StartDate: 05/28/2007
EndDate: 00/00/0000
StartTime: 03:00
MinutesDuration: 0
MinutesInterval: 0
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0

2 - Analyse LopXp

Rapport lopxpMH2 version 2.0 fait à 1:09:08,40 le 04/07/2007
C:\Documents and Settings\Administrateur\Bureau

******************************************
## Répertoires Application Data

Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Documents and Settings\Administrateur\Application Data

11/09/2006 15:37 <REP> .
11/09/2006 15:37 <REP> ..
11/09/2006 21:19 <REP> Adobe
14/09/2006 09:07 <REP> AdobeUM
27/05/2007 01:10 <REP> AdwareAlert
11/09/2006 21:33 <REP> Ahead
13/09/2006 18:12 <REP> Apple Computer
21/06/2007 11:31 <REP> AquaSoft
12/09/2006 19:50 <REP> Azureus
23/11/2006 20:03 <REP> binuscan
18/10/2006 17:54 <REP> Creative
27/11/2006 00:56 <REP> DivX
12/09/2006 23:30 <REP> Download Manager
12/09/2006 16:29 <REP> Google
02/07/2007 18:11 <REP> Grisoft
20/09/2006 20:44 <REP> Help
11/09/2006 15:37 <REP> Identities
11/09/2006 21:10 <REP> IsolatedStorage
24/11/2006 21:28 <REP> Jasc Software Inc
13/09/2006 00:10 <REP> Lavasoft
23/11/2006 16:57 <REP> Leadertech
12/09/2006 16:23 <REP> Macromedia
11/09/2006 15:37 <REP> Microsoft
01/12/2006 14:42 <REP> Mozilla
27/11/2006 19:45 <REP> OfficeUpdate12
23/11/2006 02:06 <REP> Opera
12/09/2006 22:12 <REP> Real
24/11/2006 18:26 <REP> ScanSoft
12/09/2006 19:49 <REP> Sun
11/09/2006 19:49 <REP> Symantec
06/01/2007 12:27 <REP> SYSTRAN
13/09/2006 00:00 <REP> Ulead Systems
02/11/2006 12:44 <REP> Winamp
18/10/2006 17:20 <REP> Zeon
05/01/2007 00:53 325 AutoGK.ini
23/11/2006 20:04 2 653 com.binuscan.PPIO_CMYK.plist
11/09/2006 15:37 62 desktop.ini
15/01/2007 15:43 284 ViewerApp.dat
4 fichier(s) 3 324 octets
34 Rép(s) 21 688 856 576 octets libres
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Documents and Settings\Administrateur\Local Settings\Application Data

11/09/2006 15:37 <REP> .
11/09/2006 15:37 <REP> ..
18/06/2007 09:39 <REP> {9BC22833-ADCE-43DA-8A01-9DF8FD70167F}
18/06/2007 09:36 <REP> {A6709136-4BF6-429C-95B8-07F5723C0668}
13/04/2007 10:48 <REP> {C0DAB3BD-FE6D-43C8-BADB-6E6D26647526}
11/09/2006 21:19 <REP> Adobe
25/11/2006 19:33 <REP> Ahead
13/09/2006 18:19 <REP> Apple Computer
11/09/2006 21:10 <REP> ApplicationHistory
14/09/2006 08:56 <REP> assembly
23/11/2006 15:18 <REP> Downloaded Installations
18/10/2006 17:22 <REP> Google
20/09/2006 20:44 <REP> Help
08/04/2007 10:03 <REP> Identities
11/09/2006 15:37 <REP> Microsoft
01/12/2006 14:42 <REP> Mozilla
13/04/2007 10:50 <REP> Pando
13/09/2006 09:19 <REP> PCHealth
14/09/2006 00:04 <REP> WMTools Downloaded Files
06/05/2007 21:33 86 016 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
11/09/2006 21:10 137 fusioncache.dat
11/09/2006 15:37 87 888 GDIPFONTCACHEV1.DAT
13/09/2006 23:48 7 464 688 IconCache.db
4 fichier(s) 7 638 729 octets
19 Rép(s) 21 688 856 576 octets libres
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Documents and Settings\All Users\Application Data

11/09/2006 12:50 <REP> .
11/09/2006 12:50 <REP> ..
25/11/2006 19:57 <REP> ACD Systems
11/09/2006 19:29 <REP> Adobe
24/11/2006 20:39 <REP> Adobe Systems
17/01/2007 01:31 <REP> AntiVir PersonalEdition Classic
13/09/2006 18:10 <REP> Apple Computer
18/10/2006 17:46 <REP> Creative
25/11/2006 00:29 <REP> espionServerData
12/09/2006 16:29 <REP> Google
05/04/2007 00:55 <REP> Google Updater
02/07/2007 18:11 <REP> Grisoft
18/10/2006 17:20 <REP> InstallShield
11/09/2006 12:50 <REP> Microsoft
26/11/2006 00:00 <REP> MSScanAppDataDir
06/12/2006 09:55 <REP> Office Genuine Advantage
18/10/2006 21:57 <REP> OLYMPUS
12/09/2006 15:00 <REP> Pinnacle
12/09/2006 18:55 <REP> QuickTime
18/10/2006 17:20 <REP> ScanSoft
05/01/2007 21:47 <REP> SmartSound Software Inc
09/10/2006 19:09 <REP> Spybot - Search & Destroy
11/09/2006 19:49 <REP> Symantec
07/02/2007 17:47 <REP> TEMP
12/09/2006 23:59 <REP> Ulead Systems
11/09/2006 12:57 <REP> Windows Genuine Advantage
18/10/2006 17:20 <REP> zeon
11/09/2006 15:21 305 addr_file.html
11/09/2006 12:50 62 desktop.ini
13/12/2006 19:43 1 755 QTSBandwidthCache
3 fichier(s) 2 122 octets
27 Rép(s) 21 688 852 480 octets libres
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Documents and Settings\Default User\Application Data

11/09/2006 12:50 <REP> .
11/09/2006 12:50 <REP> ..
11/09/2006 12:50 <REP> Microsoft
11/09/2006 12:50 62 desktop.ini
1 fichier(s) 62 octets
3 Rép(s) 21 688 852 480 octets libres
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Documents and Settings\Default User\Local Settings\Application Data

11/09/2006 12:50 <REP> .
11/09/2006 12:50 <REP> ..
0 fichier(s) 0 octets
2 Rép(s) 21 688 852 480 octets libres
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Documents and Settings\jeanlouis\Application Data

11/09/2006 12:00 <REP> .
11/09/2006 12:00 <REP> ..
06/05/2007 17:12 <REP> Adobe
11/09/2006 12:00 <REP> Identities
11/09/2006 12:00 <REP> Microsoft
06/05/2007 17:12 <REP> Real
11/09/2006 12:00 62 desktop.ini
1 fichier(s) 62 octets
6 Rép(s) 21 688 852 480 octets libres
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Documents and Settings\jeanlouis\Local Settings\Application Data

11/09/2006 12:00 <REP> .
11/09/2006 12:00 <REP> ..
06/05/2007 17:12 <REP> Adobe
06/05/2007 17:12 <REP> Ahead
11/09/2006 12:00 <REP> Microsoft
11/09/2006 12:21 13 104 GDIPFONTCACHEV1.DAT
11/09/2006 12:03 4 778 060 IconCache.db
2 fichier(s) 4 791 164 octets
5 Rép(s) 21 688 852 480 octets libres
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Documents and Settings\LocalService\Application Data

11/09/2006 12:00 <REP> .
11/09/2006 12:00 <REP> ..
11/09/2006 12:00 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 21 688 852 480 octets libres
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Documents and Settings\LocalService\Local Settings\Application Data

11/09/2006 12:00 <REP> .
11/09/2006 12:00 <REP> ..
11/09/2006 12:00 <REP> Microsoft
06/05/2007 18:30 2 272 FontCache3.0.0.0.dat
1 fichier(s) 2 272 octets
3 Rép(s) 21 688 848 384 octets libres
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Documents and Settings\NetworkService\Application Data

11/09/2006 12:00 <REP> .
11/09/2006 12:00 <REP> ..
11/09/2006 12:00 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 21 688 848 384 octets libres
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Documents and Settings\NetworkService\Local Settings\Application Data

Répertoire de C:\WINDOWS\system32\config\systemprofile\Application Data

11/09/2006 11:58 <REP> .
11/09/2006 11:58 <REP> ..
11/09/2006 11:58 <REP> Microsoft
18/10/2006 17:20 <REP> Zeon
11/09/2006 11:58 62 desktop.ini
1 fichier(s) 62 octets
4 Rép(s) 21 688 848 384 octets libres
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data

11/09/2006 11:58 <REP> .
11/09/2006 11:58 <REP> ..
11/09/2006 12:20 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 21 688 848 384 octets libres

******************************************
Recherche des taches planifiées dans C:\WINDOWS\tasks

C:\WINDOWS\Tasks\AdwareAlert
AdwareAlert inexploitable

C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
’bÝ ©xL¢ˆ&à(LÁ4F ê <
s €!× ; ç : C : \ P r o g r a m F i l e s \ A p p l e S o f t w a r e U p d a t

e \ S o f t w a r e U p d a t e . e x e - T a s k S Y S T E M 0 ×

C:\WINDOWS\Tasks\MP
MP inexploitable

C:\WINDOWS\Tasks\XoftSpySE
XoftSpySE inexploitable

C:\WINDOWS\Tasks\XoftSpySE.job
s €!× ê ' C : \ P r o g r a m F i l e s \ X o f t S p y S E \ X o f t S p y . e x e - t C : \ P r o g r a m F i l e s \ X o f

t S p y S E \ A d m i n i s t r a t e u r " R u n s X o f t S p y S E a t S c h e d u l e d T i m e . 0 × D

******************************************
## Répertoires de C:\Program Files

Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est 909B-B0E1

Répertoire de C:\Program Files

02/07/2007 23:10 <REP> .
02/07/2007 23:10 <REP> ..
23/11/2006 15:30 <REP> ACD Systems
28/05/2007 15:35 <REP> Acesoft
18/06/2007 20:18 <REP> Adobe
24/11/2006 22:55 <REP> Ahead
12/09/2006 18:01 <REP> Aime P3
01/07/2007 14:12 <REP> AntiVir PersonalEdition Classic
20/04/2007 00:40 <REP> Apple Software Update
30/06/2007 09:16 <REP> Atomic RAR Password Recovery
12/09/2006 18:22 <REP> Audacity
27/11/2006 14:15 <REP> Audio Conversion Studio
05/12/2006 17:27 <REP> AutoGK
05/12/2006 17:26 <REP> AviSynth 2.5
27/05/2007 00:51 <REP> Azureus
23/11/2006 20:02 <REP> binuscan
27/05/2007 00:09 <REP> BitTorrent Fastest Tool
01/07/2007 14:55 <REP> CCleaner
22/11/2006 16:05 <REP> Cobian Backup 8
11/09/2006 11:54 <REP> ComPlus Applications
18/10/2006 17:54 <REP> Creative
01/07/2007 19:32 <REP> DivX
13/03/2007 00:54 <REP> Easy CD-DA Extractor 10
23/11/2006 15:53 <REP> Elaborate Bytes
30/06/2007 09:12 <REP> ElcomSoft
01/01/2007 22:02 <REP> Emtec.No
04/07/2007 00:52 <REP> eMule
20/09/2006 18:35 <REP> EPSON
14/01/2007 00:57 <REP> Executive Software
21/06/2007 11:23 <REP> Fichiers communs
17/10/2006 14:35 <REP> FirmTools
13/03/2007 00:08 <REP> Free Audio Pack
05/12/2006 17:26 <REP> Gabest
06/05/2007 17:19 <REP> Google
02/07/2007 18:11 <REP> Grisoft
02/07/2007 23:15 <REP> Hijackthis
13/06/2007 11:20 <REP> Internet Explorer
21/06/2007 09:34 <REP> iPod
22/11/2006 13:22 <REP> IrfanView
21/06/2007 09:34 <REP> iTunes
13/09/2006 17:53 <REP> Jasc Software Inc
21/06/2007 21:07 <REP> Java
04/04/2007 23:24 <REP> KC Softwares
14/10/2006 23:03 <REP> Lavasoft
18/06/2007 15:07 <REP> MediaCoder
30/03/2007 15:35 <REP> Messenger
21/06/2007 11:23 <REP> Micro Application
09/05/2007 14:42 <REP> Microsoft CAPICOM 2.1.0.2
11/09/2006 11:57 <REP> microsoft frontpage
18/10/2006 18:00 <REP> Microsoft Office
06/05/2007 18:55 <REP> Microsoft User Agent String Utility
18/10/2006 17:59 <REP> Microsoft Visual Studio
18/10/2006 18:08 <REP> Microsoft Works
18/10/2006 18:00 <REP> Microsoft.NET
30/03/2007 15:35 <REP> Movie Maker
06/06/2007 01:08 <REP> Mozilla Firefox
06/05/2007 18:30 <REP> MSBuild
11/09/2006 11:54 <REP> MSN Gaming Zone
15/11/2006 17:49 <REP> MSXML 4.0
06/05/2007 18:32 <REP> MSXML 6.0
30/03/2007 15:35 <REP> MusicBrainz Tagger
01/07/2007 14:32 <REP> Navilog1
23/11/2006 13:51 <REP> Neat Image
25/11/2006 17:41 <REP> Nero
11/09/2006 16:30 <REP> NetMeeting
12/09/2006 19:01 <REP> OLYMPUS
13/06/2007 09:06 <REP> Outlook Express
29/06/2007 17:57 <REP> Passware
21/06/2007 01:00 <REP> Photo Story 3 for Windows
04/07/2007 00:01 <REP> Picasa2
12/09/2006 15:08 <REP> Pinnacle
15/01/2007 11:49 <REP> PIXELA
24/11/2006 23:40 <REP> PSCS2
21/06/2007 15:04 <REP> QuickTime
23/11/2006 20:03 <REP> Rainbow Technologies
12/09/2006 22:13 <REP> Real
18/10/2006 17:32 <REP> RealVNC
06/05/2007 18:27 <REP> Reference Assemblies
23/11/2006 20:39 <REP> Rippackv3
24/11/2006 18:25 <REP> ScanSoft
02/12/2006 15:46 <REP> Screamer Radio
11/09/2006 11:54 <REP> Services en ligne
23/11/2006 15:52 <REP> SlySoft
05/01/2007 21:47 <REP> SmartSound Software
15/01/2007 11:46 <REP> Sony Corporation
02/06/2007 16:59 <REP> Spybot - Search & Destroy
28/05/2007 17:24 <REP> SpywareBlaster
11/09/2006 21:03 <REP> Symantec
06/05/2007 19:50 <REP> Systran
09/10/2006 19:52 <REP> ToniArts
14/01/2007 17:03 <REP> Total Training
03/06/2007 19:13 <REP> Ulead Systems
24/12/2006 19:21 <REP> Web Media Player
18/06/2007 12:31 <REP> Winamp
09/12/2006 13:46 <REP> Windows Defender
09/06/2007 23:59 <REP> Windows Live Safety Center
03/06/2007 19:16 <REP> Windows Media Components
30/03/2007 15:35 <REP> Windows Media Connect 2
28/05/2007 01:55 <REP> Windows Media Player
05/01/2007 15:42 <REP> Windows NT
30/03/2007 15:35 <REP> WinISO
16/10/2006 00:00 <REP> WinRAR
18/10/2006 17:54 <REP> WinZip
11/09/2006 11:57 <REP> xerox
19/06/2007 08:51 <REP> XoftSpySE
13/09/2006 09:34 <REP> Yahoo!
05/01/2007 12:15 <REP> Zone Labs
0 fichier(s) 0 octets
107 Rép(s) 21 688 770 560 octets libres

******************************************
## Popups autorisées

* Internet Explorer

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow
www.infos-du-net.com REG_BINARY

* Mozilla Firefox (1 autorisé 2 interdit)

---------- C:\DOCUMENTS AND SETTINGS\ADMINISTRATEUR\APPLICATION

DATA\MOZILLA\FIREFOX\PROFILES\NAPU9FTH.DEFAULT\HOSTPERM.1
host popup 1 www.parkingsdeparis.com
host popup 1 www.levillage.org

******************************************
## Registre

* [HKEY_CURRENT_USER\\Software\Microsoft\Internet Explorer\Main]
Search Bar REG_SZ http://www.google.com/ie

******************************************
## Zones de sécurité

* HKCU Domains (4)

* P3P History (5)

******************************************
## Recherche C:\WINDOWS\*.htm, "C:\WINDOWS\*.gif"

*************** Fin du rapport ****************

3- Analyse HijackThis version Française

http://pchelpbordeaux.free.fr/frames/logiciels/HIJACKTHIS%20VF.exe "Target =" blank

Je n'ai pas réussi à ouvrir ce lien, j'ai donc chargé le pg au lien suivant

http://pchelpbordeaux.free.fr/frames/logiciels/HIJACKTHIS%20VF.exe et voici le résultat

Logfile of HijackThis v1.99.1
Scan saved at 01:24:19, on 04/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\VSTASCAN\vsaccess.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Cobian Backup 8\cbService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\eMule\emule.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe