Bonjour à tous,
Avast a déplacé deux fichiers en quarantaine (A0005007.dll et installdrivecleanerstart_fr[1].exe) infectés par win32:trojan-gen et win32:adware-gen et semble ne pouvoir les supprimer
...
Résultat : IE n'ouvre pas certaines pages, ne répond plus et mon lecteur DVD ne lit plus de CD !!! Je pense que tout ça doit être lié, mais avoue ne pas y connaître grand'chose
...
Voici mon log de Hijackthis si quelqu'un a du temps à me consacrer, je l'en remercie d'avance, parce que je galère entre les forums et ai peur de faire des co....ies
!!!
---------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 18:34:19, on 24/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesWindows DefenderMsMpEng.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSehomeehtray.exe
C:Program FilesPhoenix Technologies LtdRecoverPro_XPVBPTASK.EXE
C:WINDOWSRTHDCPL.EXE
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:Program FilesQuickTimeqttask.exe
C:WINDOWSSystem32spoolDRIVERSW32X863E_S10IC2.EXE
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesJavajre1.6.0_01injusched.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesWindows Media PlayerWMPNSCFG.exe
C:Program FilesATI TechnologiesATI.ACECLI.exe
C:Program FilesGrisoftAVG Anti-Spyware 7.5guard.exe
C:WINDOWSBricoPacksCrystal ClearRocketDockRocketDock.exe
C:Program FilesTribalWeb.net ribalweb.exe
C:WINDOWSBricoPacksCrystal ClearUberIconUberIcon Manager.exe
C:WINDOWSeHomeehRecvr.exe
C:WINDOWSBricoPacksCrystal ClearYzShadowYzShadow.exe
C:WINDOWSeHomeehSched.exe
C:Program FilesFichiers communsEPSONEBAPISAgent2.exe
C:WINDOWSBricoPacksCrystal ClearYzToolbarYzToolBar.exe
C:PROGRA~1INCRED~1inIMApp.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:PROGRA~1COMMON~1X10Commonx10nets.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:WINDOWSsystem32dllhost.exe
C:WINDOWSeHomeehmsas.exe
C:Program FilesATI TechnologiesATI.ACEcli.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:Program FilesAlwil SoftwareAvast4ashSimpl.exe
C:Program FilesAlwil SoftwareAvast4ashChest.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesWinRARWinRAR.exe
C:hijackthisHijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar =
http://recherche.neuf.fr/ie/default.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page =
http://recherche.neuf.fr/
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://www.google.fr/ig?hl=fr
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL =
http://recherche.neuf.fr/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
http://recherche.neuf.fr/ie/default.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesFichiers communsAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_01inssv.dll
O4 - HKLM..Run: [ehTray] C:WINDOWSehomeehtray.exe
O4 - HKLM..Run: [RestoreIT!] "C:Program FilesPhoenix Technologies LtdRecoverPro_XPVBPTASK.EXE" VBStart
O4 - HKLM..Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM..Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [fenaffiche] C:Program FilesFenAfficheFenUnika.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [EPSON Stylus C42 Series] C:WINDOWSSystem32spoolDRIVERSW32X863E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [ATICCC] "C:Program FilesATI TechnologiesATI.ACEcli.exe" runtime
O4 - HKLM..Run: [Windows Defender] "C:Program FilesWindows DefenderMSASCui.exe" -hide
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_01injusched.exe"
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [IncrediMail] C:Program FilesIncrediMailinIncMail.exe /c
O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe
O4 - Startup: RocketDock.lnk = C:WINDOWSBricoPacksCrystal ClearRocketDockRocketDock.exe
O4 - Startup: TribalWeb.net.lnk = C:Program FilesTribalWeb.net ribalweb.exe
O4 - Startup: UberIcon.lnk = C:WINDOWSBricoPacksCrystal ClearUberIconUberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:WINDOWSBricoPacksCrystal ClearYzShadowYzShadow.exe
O4 - Startup: Y'z Toolbar.lnk = C:WINDOWSBricoPacksCrystal ClearYzToolbarYzToolBar.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:Program FilesAdobeReader 8.0ReaderAdobeCollabSync.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:Program FilesATI TechnologiesATI.ACECLI.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:Program FilesAdobeReader 8.0Reader
eader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel -
res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_01inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_01inssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) -
http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) -
http://www.securite.neuf.fr/Ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1FICHIE~1SkypeSKYPE4~1.DLL
O18 - Filter: text/html - {C6F62B7A-5450-4A2F-8687-6CEEC3AEB055} - C:WINDOWSsystem32controlkids2.dll
O20 - Winlogon Notify: WgaLogon - C:WINDOWSSYSTEM32WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:WINDOWSsystem32WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:WINDOWSsystem32ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:Program FilesGrisoftAVG Anti-Spyware 7.5guard.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:Program FilesFichiers communsEPSONEBAPISAgent2.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%WinPcap
pcapd.exe" -d -f "%ProgramFiles%WinPcap
pcapd.ini (file missing)
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:PROGRA~1COMMON~1X10Commonx10nets.exe
---------------------------------------------------------------------
Merci d'avance...
