Le rapport d'Ewido:
+ Résultats du scan:
[768] C:\windows\system32\edhgocog.dll -> Adware.Agent : Nettoyer et sauvegarder
C:\Downloads\Monopoly3-dm[1].exe -> Adware.Trymedia : Nettoyer et sauvegarder
C:\Downloads\Worms2-dm[1].exe -> Adware.Trymedia : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1050.txt -> TrackingCookie.Cpvfeed : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1063.txt -> TrackingCookie.Bluestreak : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1126.txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1172.txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1210.txt -> TrackingCookie.Enhance : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1215.txt -> TrackingCookie.Atdmt : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1226.txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1230.txt -> TrackingCookie.Advertising : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1238.txt -> TrackingCookie.Spylog : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1240.txt -> TrackingCookie.Doubleclick : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1242.txt -> TrackingCookie.Estat : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc1265.txt -> TrackingCookie.Hotlog : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc678.txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc825.txt -> TrackingCookie.Reliablestats : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc832.txt -> TrackingCookie.Falkag : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc871.txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder
C:\RECYCLER\S-1-5-21-796845957-1417001333-725345543-1004\Dc988.txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder
C:\WINDOWS\CHECKS02.0XE -> Trojan.VB.tg : Nettoyer et sauvegarder
C:\WINDOWS\msnmsgr.0xe -> Hijacker.StartPage.aig : Nettoyer et sauvegarder
C:\WINDOWS\SMS112X.0XE -> Downloader.VB.tw : Nettoyer et sauvegarder
C:\WINDOWS\system32\edhgocog.dll -> Adware.Agent : Nettoyer et sauvegarder
C:\WINDOWS\system32\firewall.0xe -> Hijacker.StartPage.aig : Nettoyer et sauvegarder
C:\WINDOWS\system32\internetconfig.0xe -> Hijacker.StartPage.aig : Nettoyer et sauvegarder
C:\WINDOWS\system32\rk.bin -> Adware.RK : Nettoyer et sauvegarder
C:\WINDOWS\system32\rlls.dll -> Adware.RK : Nettoyer et sauvegarder
C:\WINDOWS\system32\rlvknlg.exe -> Adware.RK : Nettoyer et sauvegarder
C:\WINDOWS\UNIN101.0XE -> Trojan.VB.tg : Nettoyer et sauvegarder
C:\WINDOWS\UNI_EH.0XE -> Trojan.VB.tg : Nettoyer et sauvegarder
J:\Salah\Registry Mechanic 5.0.0.142.rar/Registry Mechanic 5.0.0.142\crack\RegMech.exe -> Backdoor.Agent.xn : Erreur durant le nettoyage
::Fin du rapport
Le rapport de HijackThis:
Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\windows\SOUNDMAN.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\EQBranch\EQBranch.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\windows\system32\drivers\CDAC11BA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\windows\System32\nvsvc32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\windows\system32\slserv.exe
C:\windows\System32\svchost.exe
C:\windows\system32\UAService7.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmgr] c:\windows\msnmsgr.exe
O4 - HKCU\..\Run: [EQBranch] "C:\Program Files\EQBranch\EQBranch.exe"
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: Runner.dll,edhgocog.dll,Runner.dll,EQMini.dll
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - BackWeb Technologies Inc. - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\windows\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\windows\SYSTEM32\slserv.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\windows\system32\UAService7.exe
Et maintenant ?
P.S: Les pages de pubs sont toujours là.
Est ce que les pages de pubs vont partir ?
Merci, Merci!!
