Hello again!
Merci encore de ton aide.
Voici le rapport de ewido :
---------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------
+ Créé le: 7:36:30 PM, 05/12/2006
+ Somme de contrôle: BEDB4CA0
+ Résultats du scan:
C:\Program Files\Everest Poker\CStart.exe -> Adware.Casino : Ignoré
C:\Program Files\Everest Poker\cstart-tmp.exe -> Adware.Casino : Ignoré
C:\Program Files\Everest Poker\Everest Poker.exe -> Adware.Casino : Ignoré
(ignorés car je joue en ligne sur everest)
C:\WINDOWS\Club Dice Poker setup.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\Program Files\RealVNC\VNC4\winvnc4.exe -> Not-A-Virus.RemoteAdmin.Win32.WinVNC.4110 : Nettoyer et sauvegarder
C:\Program Files\MP3 to WAV Decoder\NH20040517.4a.EE.exe/NHInstall.exe -> Adware.NavExcel : Nettoyer et sauvegarder
C:\Program Files\MP3 to WAV Decoder\installer_M3_2.exe -> Downloader.Adload.a : Nettoyer et sauvegarder
C:\Program Files\MP3 to WAV Decoder\VVSNInst.exe -> Adware.SaveNow : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP234\A0037563.old -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP235\A0037636.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP240\A0038957.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP240\A0038966.old -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP249\A0047228.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP254\A0051251.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP254\A0051325.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP254\A0051339.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP255\A0051363.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP256\A0052402.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP258\A0052483.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP263\A0055813.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP267\A0056932.exe -> Adware.Casino : Nettoyer et sauvegarder
C:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP277\A0059546.exe -> Adware.Casino : Nettoyer et sauvegarder
E:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP252\A0050884.exe/PO2Crack.exe -> Dropper.Agent.ahm : Nettoyer et sauvegarder
E:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP252\A0050884.exe/PO2Crack.exe -> Dropper.Agent.ahm : Nettoyer et sauvegarder
E:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP252\A0051015.exe/install.exe -> Backdoor.Stupa.a : Nettoyer et sauvegarder
E:\System Volume Information\_restore{20D3A1BC-53B4-4EF4-8E61-95CD19C2AACD}\RP252\A0051015.exe/install.exe -> Backdoor.Stupa.a : Nettoyer et sauvegarder
E:\emule\Incoming\ Serials Et Cle Activation Crack Windows Xp Fr Pro Et Familiale SP2.rar/Serials Et Cle Activation Crack Windows Xp Fr Pro Et Familiale SP2\WinXP.Activation.v1.1.French.exe -> Dropper.Agent.abw : Nettoyer et sauvegarder
E:\emule\Incoming\PokerOffice.v2.03.(Serial Original).by.poker.Software.rar/PokerOffice.v2.03.exe/install.exe -> Backdoor.Stupa.a : Nettoyer et sauvegarder
E:\emule\Incoming\PokerOffice.v2.03.(Serial Original).by.poker.Software.rar/PokerOffice.v2.03.exe/install.exe -> Backdoor.Stupa.a : Nettoyer et sauvegarder
E:\emule\Incoming\Poker_Office_2.02_(original-keymaker).by.jackson.zip/Poker Office 2.exe/PO2Crack.exe -> Dropper.Agent.ahm : Nettoyer et sauvegarder
E:\emule\Incoming\Poker_Office_2.02_(original-keymaker).by.jackson.zip/Poker Office 2.exe/PO2Crack.exe -> Dropper.Agent.ahm : Nettoyer et sauvegarder
E:\emule\Incoming\Poker_Office_2.02_(original-keymaker).by.jackson\Poker Office 2.exe/PO2Crack.exe -> Dropper.Agent.ahm : Nettoyer et sauvegarder
E:\emule\Incoming\Poker_Office_2.02_(original-keymaker).by.jackson\Poker Office 2.exe/PO2Crack.exe -> Dropper.Agent.ahm : Nettoyer et sauvegarder
::Fin du rapport
Maintenant, le nouveau rapport de Hijack
Logfile of HijackThis v1.99.1
Scan saved at 7:38:26 PM, on 05/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Agnitum\Outpost Firewall 1.0\outpost.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Goto Software\Vade Retro\Vaderetro_oe.exe
e:\PokerOffice\bin\POEngine.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Microsoft SQL Server\MSSQL$AEGDB\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Utilisateur\Bureau\Nouveau dossier (2)\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8088
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [POEngine] "e:\PokerOffice\POEngine.exe" e:\PokerOffice
O4 - HKLM\..\Run: [Outpost Firewall] "C:\Program Files\Agnitum\Outpost Firewall 1.0\outpost.exe" /waitservice
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Vade Retro pour Outlook Express.lnk = C:\Program Files\Goto Software\Vade Retro\Vaderetro_oe.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - e:\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - e:\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Program Files\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Program Files\Titan Poker\casino.exe
O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Program Files\Poker.com\poker.exe
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - e:\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - e:\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - E:\CDPoker\casino.exe
O9 - Extra 'Tools' menuitem: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - E:\CDPoker\casino.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: NordicBet Poker - {E6073F93-9541-4be4-9800-109D378EB99B} - C:\Program Files\nordicbetMPP\MPPoker.exe
O9 - Extra button: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - e:\Bodog Poker\GameClient.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2C8FE47-91E7-4EF0-A58F-949658DC8663}: NameServer = 217.19.192.132 217.19.192.131
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - c:\ewido anti-malware\ewidoctrl.exe
Voila voila...
PS : bon, y'avait 2-3 trucs que j'avais "occultés" au depart dans le 1er rapport...
