Eradiquer TR/Crypt.XPACK.Gen [trojan]

Bonjour Lyonnais92,

Merci à toi de venir en renfort pour la résolution de mon problème.

Je vais suivre la procédure que tu as eu la gentillesse de poster à mon intention.

Au préalable, je te transmet une info supplémentaire en espèrant qu'elle sera utile (je veux dire "globalement" utile, pas seulement utile pour moi) :

hier au boulot (hors-connexion) j'ai trouvé le " Fichier " que je cherchais partout en pensais invisible ...Fichier rattaché à mes Alertes Antivir pour mon "TR/CryptXPACK.Gen" = à savoir :


" TR/Crypt.XPACK.Gen [trojan]"
detected in file "C:\WINDOWS\System32\msqpdxkxmeolei.VIR000.

>>> Le " Fichier " recherché ( msqpdxkxmeolei ) Je l'ai trouvé dans mon <Gestionnaire de périphériques> sous la forme msqpdxserv.sys il est qualifié de "Pilote plug & play" - Fabricant "Inconnu" - Emplacement "Inconnu"_(Ce périphérique n'est pas présent, ne fonctionne pas correctement ou tous ses pilotes ne sont pas installés (Code 24).

>>> Dans la Liste du "Gestionnaire" il y a un point d'exclamation sur fond jaune en surimpression sur l'icône du "Fichier".

Je ne sais pas si cette indication est utile ni si elle peut faire avancer la " Lutte " contre l'infection... J'espère que oui.

J'ai également transmis l'info dans une réponse à Gen-Hackman...

Bien, je suis de retour après avoir suivi tes instructions (et être allé aussi récupérer mon fils à l'école ce qui explique le petit délai ;)

Voici, dans la foulée, les deux "Rapports" : 1) celui de ComboFix Scripté [ Prière aux visiteurs de remonter dans les messages et de bien LIRE les "mises-en-garde" des Helpers - Merci ] - 2) Celui de HijackThis...

____________________
1) Rapport ComboFix Scr
____________________

ComboFix 09-01-05.01 - moi 2009-01-05 15:37:01.2 - NTFSx86
Microsoft® Windows Vista™ Professionnel 6.0.6000.0.1252.1.1036.18.3063.1750 [GMT 1:00]
Lancé depuis: c:\users\moi.PC-de-moi.000\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\moi.PC-de-moi.000\Desktop\CFscript.txt
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\extravideo
c:\program files\extravideo\Uninstall.exe
c:\program files\HDTVXviD Codec
c:\program files\HDTVXviD Codec\codec.exe
c:\program files\HDTVXviD Codec\comcat.dll
c:\program files\HDTVXviD Codec\DinkITXPUIMenus.ocx
c:\program files\HDTVXviD Codec\EnhSliderOcx.ocx
c:\program files\HDTVXviD Codec\HDTVXviD.exe
c:\program files\HDTVXviD Codec\Mswinsck.ocx
c:\program files\HDTVXviD Codec\stdole2.tlb
c:\program files\HDTVXviD Codec\Uninstall\IRIMG1.BMP
c:\program files\HDTVXviD Codec\Uninstall\IRIMG2.BMP
c:\program files\HDTVXviD Codec\Uninstall\uninstall.dat
c:\program files\HDTVXviD Codec\Uninstall\uninstall.xml
c:\program files\HDTVXviD Codec\wiaaut.oca
c:\program files\Setup
c:\program files\Setup\Uninstall\IRIMG1.JPG
c:\program files\Setup\Uninstall\IRIMG2.JPG
c:\program files\Setup\Uninstall\uninstall.dat
c:\program files\Setup\Uninstall\uninstall.xml
c:\windows\HDTVXviD Codec
c:\windows\HDTVXviD Codec\uninstall.exe
.
---- Previous Run -------
.
c:\windows\system32\tmp.reg
c:\windows\system32\x64
D:\Autorun.inf
D:\resycled
d:\resycled\boot.com
E:\Autorun.inf
E:\resycled
e:\resycled\boot.com

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-12-05 au 2009-01-05 ))))))))))))))))))))))))))))))))))))
.

2009-01-05 13:21 . 2009-01-05 13:25 215,145,196 --a------ c:\windows\MEMORY.DMP
2009-01-04 18:37 . 2009-01-04 18:48 <REP> d-------- c:\program files\WhatsRunning
2009-01-04 18:26 . 2009-01-04 18:26 <REP> d-------- c:\program files\Passbox
2009-01-04 18:17 . 2009-01-04 18:17 <REP> d-------- c:\program files\PatilanSoft
2009-01-04 18:16 . 2009-01-04 18:16 <REP> d-------- c:\temp\AST
2009-01-04 18:10 . 2009-01-04 18:10 <REP> d-------- c:\program files\ProcessGuard
2009-01-04 18:06 . 2009-01-04 18:06 <REP> d-------- C:\CurrPorts
2009-01-04 18:05 . 2009-01-04 18:05 <REP> d-------- c:\program files\Assassin
2009-01-04 17:54 . 2009-01-04 18:16 <REP> d-------- C:\temp
2009-01-04 17:51 . 2009-01-04 17:51 <REP> d-------- c:\program files\ewido
2009-01-04 17:46 . 2009-01-04 17:46 <REP> d-------- c:\program files\XoftSpy
2009-01-04 17:24 . 2009-01-04 17:25 <REP> d-------- c:\program files\CréditCalc
2009-01-04 17:23 . 2009-01-04 17:23 <REP> d-------- c:\program files\MiniReminder
2009-01-04 14:39 . 2009-01-04 14:40 <REP> d-------- c:\program files\JX Ovulation Calendar
2009-01-04 14:21 . 2009-01-04 14:36 <REP> d-------- C:\Fdm 2.00
2009-01-02 14:49 . 2009-01-02 14:49 0 --a------ C:\ARK228D.tmp
2008-12-31 22:53 . 2005-03-11 18:37 1,986,560 --a------ c:\windows\System32\AudFile.dll
2008-12-31 22:53 . 2005-02-24 13:11 1,212,416 --a------ c:\windows\System32\AudioInfos.dll
2008-12-31 22:53 . 2005-02-24 12:51 348,160 --a------ c:\windows\System32\WMAFile.dll
2008-12-31 22:53 . 1998-07-12 22:00 141,312 --a------ c:\windows\System32\MSCMCFR.DLL
2008-12-31 22:53 . 2000-10-01 18:00 119,568 --a------ c:\windows\System32\VB6FR.DLL
2008-12-31 22:53 . 2005-01-10 13:54 116,296 --a------ c:\windows\System32\NCTWMAProfiles.prx
2008-12-31 22:53 . 1999-03-25 18:00 101,888 --a------ c:\windows\System32\VB6STKIT.DLL
2008-12-31 22:53 . 2003-04-18 15:29 44,544 --a------ c:\windows\System32\msxml4a.dll
2008-12-31 22:53 . 2003-01-26 12:41 40,960 --a------ c:\windows\System32\SSubTmr6.dll
2008-12-31 22:53 . 1998-07-12 18:00 32,768 --a------ c:\windows\System32\CMDLGFR.DLL
2008-12-31 22:53 . 1998-07-12 22:00 15,360 --a------ c:\windows\System32\inetfr.DLL
2008-12-31 14:17 . 2008-12-31 14:17 0 --a------ C:\ARK60F3.tmp
2008-12-31 14:07 . 2008-12-31 14:07 0 --a------ C:\ARK2423.tmp
2008-12-31 13:35 . 2008-12-31 13:35 0 --a------ C:\ARK3968.tmp
2008-12-30 13:00 . 2008-12-30 13:00 0 --a------ C:\ARK9971.tmp
2008-12-30 12:44 . 2008-12-30 12:44 0 --a------ C:\ARKB09B.tmp
2008-12-29 17:01 . 2000-08-11 12:10 73,728 --------- c:\windows\System32\hpoidr07.dll
2008-12-29 17:01 . 2000-08-11 12:11 61,440 --------- c:\windows\System32\hpoinw07.exe
2008-12-29 12:17 . 2008-12-29 12:17 <REP> d-------- C:\rsit
2008-12-28 20:27 . 2008-12-28 20:27 <REP> d-------- c:\users\moi.PC-de-moi.000\AppData\Roaming\Malwarebytes
2008-12-28 20:27 . 2008-12-28 20:27 <REP> d-------- c:\users\All Users\Malwarebytes
2008-12-28 20:27 . 2008-12-28 20:27 <REP> d-------- c:\programdata\Malwarebytes
2008-12-28 20:27 . 2008-12-31 16:30 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-28 20:27 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-12-28 20:27 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-12-28 19:40 . 2008-12-28 19:40 691 --a------ c:\users\moi.PC-de-moi.000\AppData\Roaming\GetValue.vbs
2008-12-28 19:40 . 2008-12-28 19:40 35 --a------ c:\users\moi.PC-de-moi.000\AppData\Roaming\SetValue.bat
2008-12-25 11:13 . 2008-12-25 11:13 0 --a------ C:\ARK705E.tmp
2008-12-25 11:00 . 2008-12-25 11:00 0 --a------ C:\ARK4440.tmp
2008-12-25 10:49 . 2008-12-25 10:49 0 --a------ C:\ARK8289.tmp
2008-12-22 00:18 . 2008-12-22 00:18 <REP> d-------- c:\users\moi.PC-de-moi.000\AppData\Roaming\GlarySoft
2008-12-19 03:04 . 2008-12-29 12:17 <REP> d-------- c:\program files\Trend Micro
2008-12-18 21:26 . 2008-12-18 21:26 81 --a------ c:\windows\wininit.ini
2008-12-18 20:36 . 2008-12-22 02:57 <REP> d-------- c:\users\All Users\Spybot - Search & Destroy
2008-12-18 20:36 . 2008-12-22 02:57 <REP> d-------- c:\programdata\Spybot - Search & Destroy
2008-12-18 16:10 . 2008-12-18 16:10 <REP> d-------- c:\users\moi.PC-de-moi.000\Nouveau dossier
2008-12-17 10:29 . 2008-12-09 03:10 176 --a------ c:\windows\eower.vbs
2008-12-17 10:29 . 2008-12-09 03:18 45 --a------ c:\windows\sys.bat
2008-12-17 00:23 . 2008-12-17 00:23 <REP> d-------- c:\program files\Microsoft Silverlight
2008-12-17 00:10 . 2008-12-17 00:09 410,976 --a------ c:\windows\System32\deploytk.dll
2008-12-16 17:04 . 2008-12-16 17:04 <REP> d-------- c:\program files\Bonjour
2008-12-16 15:59 . 2008-12-16 15:59 <REP> d----c--- c:\windows\System32\DRVSTORE
2008-12-16 15:59 . 2008-12-16 19:26 <REP> d-------- c:\users\moi.PC-de-moi.000\AppData\Roaming\Apple Computer
2008-12-16 15:59 . 2008-12-16 15:59 <REP> d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-16 15:59 . 2008-12-16 15:59 <REP> d-------- c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-16 15:59 . 2008-12-16 15:59 <REP> d-------- c:\program files\iTunes
2008-12-16 15:59 . 2008-12-16 15:59 <REP> d-------- c:\program files\iPod
2008-12-16 15:59 . 2008-04-17 13:12 107,368 --a------ c:\windows\System32\GEARAspi.dll
2008-12-16 15:59 . 2008-04-17 13:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys
2008-12-16 15:57 . 2008-12-16 15:58 <REP> d-------- c:\program files\QuickTime
2008-12-16 15:47 . 2008-12-16 15:47 <REP> d-------- c:\program files\Safari
2008-12-16 15:44 . 2008-12-16 15:59 <REP> d-------- c:\users\All Users\Apple Computer
2008-12-16 15:44 . 2008-12-16 15:59 <REP> d-------- c:\programdata\Apple Computer
2008-12-16 15:44 . 2008-12-16 15:59 <REP> d-------- c:\program files\Common Files\Apple
2008-12-16 15:39 . 2008-12-16 15:39 <REP> d-------- c:\users\All Users\Apple
2008-12-16 15:39 . 2008-12-16 15:39 <REP> d-------- c:\programdata\Apple
2008-12-16 15:39 . 2008-12-16 15:39 <REP> d-------- c:\program files\Apple Software Update
2008-12-16 11:08 . 2008-12-16 11:08 <REP> d-------- c:\users\All Users\Messenger Plus!
2008-12-16 11:08 . 2008-12-16 11:08 <REP> d-------- c:\programdata\Messenger Plus!
2008-12-15 20:22 . 2008-12-15 20:22 <REP> d-------- c:\program files\Messenger Plus! Live
2008-12-13 14:42 . 2008-12-13 14:42 <REP> d-------- c:\users\moi.PC-de-moi.000\AppData\Roaming\Exstora
2008-12-12 11:18 . 2008-12-12 11:18 87,336 --a------ c:\windows\System32\dns-sd.exe
2008-12-12 11:11 . 2008-12-12 11:11 61,440 --a------ c:\windows\System32\dnssd.dll
2008-12-11 15:00 . 2009-01-05 22:19 <REP> d-------- c:\users\moi.PC-de-moi.000\AppData\Roaming\dvdcss
2008-12-11 13:49 . 2008-12-11 13:49 <REP> d-------- c:\program files\BaroufaSoft
2008-12-10 21:22 . 2008-12-10 21:22 297,472 --a------ c:\windows\System32\gdi32.dll
2008-12-10 21:21 . 2008-12-10 21:21 4,247,552 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
2008-12-10 21:21 . 2008-12-10 21:21 1,687,040 --a------ c:\windows\System32\gameux.dll
2008-12-10 21:21 . 2008-12-10 21:21 28,672 --a------ c:\windows\System32\Apphlpdm.dll
2008-12-10 21:20 . 2008-12-10 21:20 2,048 --a------ c:\windows\System32\tzres.dll
2008-12-10 21:18 . 2008-12-10 21:18 2,923,520 --a------ c:\windows\explorer.exe
2008-12-10 21:18 . 2008-12-10 21:18 1,383,424 --a------ c:\windows\System32\mshtml.tlb
2008-12-10 21:18 . 2008-12-10 21:18 826,368 --a------ c:\windows\System32\wininet.dll
2008-12-10 21:17 . 2008-12-10 21:17 1,831,424 --a------ c:\windows\System32\inetcpl.cpl
2008-12-10 21:17 . 2008-12-10 21:17 56,320 --a------ c:\windows\System32\iesetup.dll
2008-12-10 21:17 . 2008-12-10 21:17 26,624 --a------ c:\windows\System32\ieUnatt.exe
2008-12-10 21:16 . 2008-12-10 21:16 2,855,424 --a------ c:\windows\System32\mf.dll
2008-12-10 21:16 . 2008-12-10 21:16 996,352 --a------ c:\windows\System32\WMNetMgr.dll
2008-12-10 21:16 . 2008-12-10 21:16 98,816 --a------ c:\windows\System32\mfps.dll
2008-12-10 21:16 . 2008-12-10 21:16 94,720 --a------ c:\windows\System32\logagent.exe
2008-12-10 21:16 . 2008-12-10 21:16 52,736 --a------ c:\windows\System32\rrinstaller.exe
2008-12-10 21:16 . 2008-12-10 21:16 24,576 --a------ c:\windows\System32\mfpmp.exe
2008-12-10 21:16 . 2008-12-10 21:16 2,048 --a------ c:\windows\System32\mferror.dll
2008-12-10 15:59 . 2008-12-10 15:59 <REP> d-------- c:\users\moi.PC-de-moi.000\AppData\Roaming\Ashampoo
2008-12-10 06:21 . 2008-12-10 06:21 <REP> d-------- c:\users\moi.PC-de-moi.000\AppData\Roaming\Media Player Classic
2008-12-09 11:28 . 2008-12-09 11:28 <REP> d-------- c:\users\All Users\Adobe
2008-12-09 11:28 . 2008-12-09 11:28 <REP> d-------- c:\program files\Common Files\Adobe
2008-12-09 11:19 . 2008-12-09 11:19 <REP> d-------- c:\program files\Sony
2008-12-09 11:19 . 2008-12-09 11:19 <REP> d-------- c:\program files\Common Files\Sony Shared
2008-12-09 11:10 . 2008-12-09 11:10 <REP> d-------- c:\users\All Users\BVRP Software
2008-12-09 11:10 . 2008-12-09 11:10 <REP> d-------- c:\programdata\BVRP Software
2008-12-09 11:10 . 2008-12-09 11:10 <REP> d-------- c:\program files\Avanquest update
2008-12-09 10:58 . 2008-12-09 11:19 <REP> d-------- c:\program files\Sony Ericsson
2008-12-09 10:22 . 2008-12-09 10:22 265,595 --a------ c:\windows\runner.exe
2008-12-06 09:24 . 2008-12-06 09:24 <REP> d-------- c:\users\moi.PC-de-moi.000\AppData\Roaming\Talkback
2008-12-06 09:23 . 2008-12-06 09:24 <REP> d-------- c:\program files\Mozilla Sunbird

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-05 21:19 --------- d-----w c:\program files\Glary Utilities
2009-01-05 12:38 --------- d-----w c:\users\moi.PC-de-moi.000\AppData\Roaming\uTorrent
2009-01-04 16:25 --------- d-----w c:\program files\CréditCalc
2008-12-29 16:37 --------- d-----w c:\program files\Hewlett-Packard
2008-12-29 09:51 --------- d-----w c:\program files\Ovulation Calendar Calculator
2008-12-28 20:04 --------- d-----w c:\program files\CCleaner
2008-12-28 18:40 --------- d-----w c:\program files\Google
2008-12-19 14:56 --------- d-----w c:\program files\a-squared
2008-12-16 23:09 --------- d-----w c:\program files\Java
2008-12-13 13:41 --------- d-----w c:\program files\Exstora
2008-12-10 20:28 174 --sha-w c:\program files\desktop.ini
2008-12-10 20:25 --------- d-----w c:\program files\Windows Mail
2008-12-10 20:24 --------- d-----w c:\programdata\Microsoft Help
2008-12-10 20:21 537,600 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-12-10 20:21 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-12-10 20:21 449,536 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-12-10 20:21 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-12-10 20:21 2,144,256 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-12-10 20:21 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-12-10 05:17 --------- d-----w c:\program files\K-Lite Codec Pack
2008-12-09 10:10 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-09 09:58 --------- d-----w c:\programdata\Sony Ericsson
2008-12-03 16:52 --------- d-----w c:\users\moi.PC-de-moi.000\AppData\Roaming\Bullzip
2008-12-02 18:59 --------- d-----w c:\users\moi.PC-de-moi.000\AppData\Roaming\OpenOffice.org
2008-12-02 18:21 --------- d-----w c:\program files\OpenOffice.org 3
2008-12-02 18:21 --------- d-----w c:\program files\JRE
2008-12-02 13:58 --------- d-----w c:\program files\CDDC-ECalc
2008-12-01 23:49 --------- d-----w c:\users\moi.PC-de-moi.000\AppData\Roaming\vlc
2008-12-01 10:19 --------- d-----w c:\program files\uTorrent
2008-11-30 10:13 --------- d-----w c:\program files\Mozilla Firefox 3.1 Beta 1
2008-11-30 02:04 268,800 ----a-w c:\windows\System32\es.dll
2008-11-30 02:02 --------- d-----w c:\program files\Microsoft SQL Server
2008-11-29 23:42 --------- d-----w c:\program files\Smart PC Solutions
2008-11-29 21:55 --------- d-----w c:\program files\Amic Games
2008-11-29 21:47 --------- d-----w c:\users\moi.PC-de-moi.000\AppData\Roaming\SampleView
2008-11-29 18:58 --------- d-----w c:\program files\Sidebar-Widgets
2008-11-29 18:42 --------- d-----w c:\program files\HFXP2
2008-11-29 17:48 76,160 ----a-w c:\windows\system32\drivers\lnsfw1.sys
2008-11-29 17:48 46,208 ----a-w c:\windows\system32\drivers\lnsfw.sys
2008-11-29 17:48 36,924 ----a-w c:\windows\System32\fwapi.dll
2008-11-29 17:42 --------- d-----w c:\programdata\Symantec
2008-11-29 17:42 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-29 15:47 --------- d-----w c:\program files\IZArc
2008-11-29 11:00 --------- d-----w c:\program files\Windows Calendar
2008-11-29 10:59 --------- d-----w c:\program files\Windows Sidebar
2008-11-29 04:21 --------- d-----w c:\program files\Eraser
2008-11-28 22:15 8,192 ----a-w c:\windows\System32\riched32.dll
2008-11-28 22:14 95,232 ----a-w c:\windows\System32\PortableDeviceClassExtension.dll
2008-11-28 22:14 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll
2008-11-28 22:14 160,768 ----a-w c:\windows\System32\PortableDeviceTypes.dll
2008-11-28 22:13 87,040 ----a-w c:\windows\System32\msoert2.dll
2008-11-28 22:13 39,424 ----a-w c:\windows\System32\ACCTRES.dll
2008-11-28 22:13 205,824 ----a-w c:\windows\System32\msoeacct.dll
2008-11-28 22:11 194,560 ----a-w c:\windows\System32\WebClnt.dll
2008-11-28 22:11 110,080 ----a-w c:\windows\system32\drivers\mrxdav.sys
2008-11-28 22:07 41,984 ----a-w c:\windows\system32\drivers\monitor.sys
2008-11-28 22:07 1,060,920 ----a-w c:\windows\system32\drivers\ntfs.sys
2008-11-28 22:05 211,456 ----a-w c:\windows\system32\drivers\mrxsmb10.sys
2008-11-28 22:03 374,456 ----a-w c:\windows\System32\mcupdate_GenuineIntel.dll
2008-11-28 22:02 303,616 ----a-w c:\windows\System32\wmpeffects.dll
2008-11-28 22:02 2,027,520 ----a-w c:\windows\System32\win32k.sys
2008-11-28 22:01 2,048 ----a-w c:\windows\System32\msxml3r.dll
2008-11-28 22:01 1,194,496 ----a-w c:\windows\System32\msxml3.dll
2008-11-28 21:53 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-11-28 21:52 45,112 ----a-w c:\windows\system32\drivers\pciidex.sys
2008-11-28 21:52 211,000 ----a-w c:\windows\system32\drivers\volsnap.sys
2008-11-28 21:52 21,560 ----a-w c:\windows\system32\drivers\atapi.sys
2008-11-28 21:52 154,624 ----a-w c:\windows\system32\drivers\nwifi.sys
2008-11-28 21:52 15,928 ----a-w c:\windows\system32\drivers\pciide.sys
2008-11-28 21:52 109,624 ----a-w c:\windows\system32\drivers\ataport.sys
2008-11-28 21:50 803,328 ----a-w c:\windows\system32\drivers\tcpip.sys
2008-11-28 21:50 24,064 ----a-w c:\windows\System32\netcfg.exe
2008-11-28 21:50 22,016 ----a-w c:\windows\System32\netiougc.exe
2008-11-28 21:50 216,632 ----a-w c:\windows\system32\drivers\netio.sys
2008-11-28 21:50 167,424 ----a-w c:\windows\System32\tcpipcfg.dll
2008-11-28 21:47 9,845,248 ----a-w c:\windows\System32\NlsData000a.dll
2008-11-28 21:47 797,696 ----a-w c:\windows\System32\NaturalLanguage6.dll
2008-11-28 21:47 6,917,120 ----a-w c:\windows\System32\NlsLexicons0c1a.dll
2008-11-28 21:47 4,493,312 ----a-w c:\windows\System32\NlsData0816.dll
2008-11-28 21:47 4,493,312 ----a-w c:\windows\System32\NlsData0416.dll
2008-11-28 21:47 4,493,312 ----a-w c:\windows\System32\NlsData0414.dll
2008-11-28 21:47 2,641,408 ----a-w c:\windows\System32\NlsData000c.dll
2008-11-28 21:47 2,340,864 ----a-w c:\windows\System32\NlsData000d.dll
2008-11-28 21:47 1,963,520 ----a-w c:\windows\System32\NlsData0c1a.dll
2008-11-28 21:47 1,963,520 ----a-w c:\windows\System32\NlsData081a.dll
2008-11-28 21:47 1,963,520 ----a-w c:\windows\System32\NlsData000f.dll
2008-11-28 21:44 1,585,664 ----a-w c:\windows\System32\setupapi.dll
2008-11-28 21:41 9,728 ----a-w c:\windows\System32\LAPRXY.DLL
2008-11-28 21:41 290,304 ----a-w c:\windows\system32\drivers\srv.sys
2008-11-28 21:41 223,232 ----a-w c:\windows\System32\WMASF.DLL
2008-11-28 21:41 2,048 ----a-w c:\windows\System32\asferror.dll
2008-11-28 21:40 --------- d-----w c:\program files\Windows Live
2008-11-28 21:39 712,192 ----a-w c:\windows\System32\WindowsCodecs.dll
2008-11-28 21:39 57,856 ----a-w c:\windows\System32\SLUINotify.dll
2008-11-28 21:39 566,784 ----a-w c:\windows\System32\SLCommDlg.dll
2008-11-28 21:39 425,472 ----a-w c:\windows\System32\PhotoMetadataHandler.dll
2008-11-28 21:39 39,936 ----a-w c:\windows\System32\slcinst.dll
2008-11-28 21:39 351,232 ----a-w c:\windows\System32\SLUI.exe
2008-11-28 21:39 33,280 ----a-w c:\windows\System32\slwmi.dll
2008-11-28 21:39 268,288 ----a-w c:\windows\System32\mcbuilder.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-11-28 1232896]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]
"UIWatcher"="c:\program files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe" [2008-04-22 3508568]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2008-12-01 270128]
"Exstora"="c:\program files\Exstora\Exstora.exe" [2008-07-04 248832]
"Ovulation Calendar Calculator"="c:\program files\Ovulation Calendar Calculator\ovCalendar.exe" [2008-07-05 6191616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-10-17 1097728]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-05-11 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-05-11 154392]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2007-05-08 331552]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2007-01-09 145184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-05-11 472632]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-05-02 163840]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2003-12-22 17920]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Look 'n' Stop"="c:\program files\Soft4Ever\looknstop\looknstop.exe" [2008-11-29 376900]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [2007-03-16 63712]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2007-05-23 192512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-09 44168]

c:\users\moi.PC-de-moi.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Ashampoo Magic Defrag.lnk - c:\program files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragCtrl.exe [2008-04-05 4104293]
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2008-05-04 192512]
Matrix Screen Locker.lnk - c:\program files\BaroufaSoft\Matrix Screen Locker\matrix.exe [2006-01-29 539136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=APSHook.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ASWLNPkg

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{23AE0698-7606-41AF-948D-4C7F2944C588}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{2984444C-7405-444E-8681-49E5C1356D99}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{F5943B87-A3C8-4468-948C-FC5E95CF7277}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{4B9E6410-E15E-4CDB-9085-F365F5B6842C}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{609DAAD6-6C08-4DD1-84EB-8FD269E30168}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{A29EB013-4F05-4105-B3DD-75EBAC289A44}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"{0DDEAC49-06DA-44B0-A8BF-721393B04508}"= UDP:c:\program files\Mozilla Sunbird\sunbird.exe:Mozilla Sunbird
"{ADEB48A8-A0C4-45D8-89F9-D903CD3352A7}"= TCP:c:\program files\Mozilla Sunbird\sunbird.exe:Mozilla Sunbird
"{AB28F926-84D5-4ACA-BC29-9B11CA742D20}"= UDP:c:\program files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragCtrl.exe:Ashampoo Magic Defrag
"{B8A16CB6-1B19-47F9-B990-71E09E71FBD2}"= TCP:c:\program files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragCtrl.exe:Ashampoo Magic Defrag
"{BD284402-898B-448A-89E2-A691651CDCDD}"= UDP:c:\program files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:Sony Ericsson Media Manager 1.2
"{E87EEED1-F4F0-4740-83D1-0FCFDAD3A4F6}"= TCP:c:\program files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:Sony Ericsson Media Manager 1.2
"{608A016F-4480-4459-B45C-5CE9C94DC4A1}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{500FA50F-C37D-42B2-9BBD-B93D32348262}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{B8A18D95-2851-4702-98F7-5BE578E9AC09}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{340144B9-47E3-47B0-B0AA-C36839CDB026}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 lnsfw1;lnsfw1;c:\windows\System32\drivers\lnsfw1.sys [2008-11-29 76160]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [2007-07-05 179712]
R4 ASBroker;Courtier de session de connexion;c:\windows\System32\svchost.exe -k Cognizance [2006-11-02 22016]
R4 ASChannel;Canal de communication local;c:\windows\System32\svchost.exe -k Cognizance [2006-11-02 22016]
R4 BcmSqlStartupSvc;Service de démarrage SQL Server pour le Gestionnaire de contacts professionnels;c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-16 30312]
R4 hpsrv;HP Service;c:\windows\System32\hpservice.exe [2007-01-05 18944]
R4 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2007-07-05 540448]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
Cognizance REG_MULTI_SZ ASBroker ASChannel

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contenu du dossier 'Tâches planifiées'

2009-01-05 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-12-01 09:38]
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)


.
------- Examen supplémentaire -------
.
mWindow Title =
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\moi.PC-de-moi.000\AppData\Roaming\Mozilla\Firefox\Profiles\l9otbsea.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1396957&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q=
FF - component: c:\users\moi.PC-de-moi.000\AppData\Roaming\Mozilla\Firefox\Profiles\l9otbsea.default\extensions\{f592709f-ff4a-4862-b659-4afabda56312}\components\FFAlert.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-05 15:41:35
Windows 6.0.6000 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'lsass.exe'(652)
c:\program files\Hewlett-Packard\IAM\bin\ASWLNPkg.dll
c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll

- - - - - - - > 'Explorer.exe'(5148)
c:\program files\Hewlett-Packard\IAM\bin\ItClient.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Hewlett-Packard\IAM\Bin\asghost.exe
c:\windows\System32\agrsmsvc.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\windows\System32\conime.exe
c:\windows\SMINST\Scheduler.exe
c:\windows\System32\igfxsrvc.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
c:\windows\System32\dllhost.exe
.
**************************************************************************
.
Heure de fin: 2009-01-05 15:45:12 - La machine a redémarré [moi]
ComboFix-quarantined-files.txt 2009-01-05 14:44:53

Avant-CF: 27 705 643 008 octets libres
Après-CF: 27,478,794,240 octets libres

416 --- E O F --- 2008-12-16 23:23:53


FIN de §§§§§§§§§§§§§§§§§§§§§ - Rapport ComboFix Scripté - §§§§§§§§§§§§§§§§§§§§§§§§§


_____________________
2) Rapport HijackThis
_____________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:46:06, on 05/01/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16764)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
C:\Windows\system32\conime.exe
C:\WINDOWS\SMINST\scheduler.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\System32\igfxtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\PDF Complete\pdfsty.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
C:\Program Files\Exstora\Exstora.exe
C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragCtrl.exe
C:\Program Files\BaroufaSoft\Matrix Screen Locker\matrix.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\moi.PC-de-moi.000\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\RunOnce: [ST Recovery Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [UIWatcher] C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Exstora] "C:\Program Files\Exstora\Exstora.exe"
O4 - HKCU\..\Run: [Ovulation Calendar Calculator] C:\Program Files\Ovulation Calendar Calculator\ovCalendar.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Ashampoo Magic Defrag.lnk = C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragCtrl.exe
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - Global Startup: Matrix Screen Locker.lnk = C:\Program Files\BaroufaSoft\Matrix Screen Locker\matrix.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix:
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

Premiers résultats encourageants!
> ( Pardon si je n'exulte pas, je suis devenu pessimiste depuis que j'utilise Windows )

> Première " Bonne nouvelle " = Antivir s'est mis-à-jour !

...Au chapitre <Gestionnaire de périphériques> / Lors de l'ouverture et à la demande [ afficher les périphériques cachés ] >>> Le " Fichier signalé par Antivir au début de mes ennuis ( msqpdxkxmeolei ) est toujours présent sous la forme sous la forme " msqpdxserv.sys " - "Pilote plug & play" - Fabricant "Inconnu" - Emplacement "Inconnu"_(Ce périphérique n'est pas présent, ne fonctionne pas correctement ou tous ses pilotes ne sont pas installés (Code 24).
>>> Dans la Liste du "Gestionnaire" il y a encore un point d'exclamation sur fond jaune en surimpression sur l'icône du "Fichier".

...Etant donné que je ne sais pas si c'est LE responsable ou seulement une "scorie" de mon infection ; je reste sur la réserve en attendant ton Verdict. - Mais déjà, il semble que ça aille mieux.

> Cordialement _TRN_

^^Marie^^

Je galère...je galère...je galère

1) J'ai recopié à la main tout le texte des recommandations et procédures (car je ne peux plus rien imprimer - le scanner fonctionne pourtant encore donc mon cable ou ma liaison ne sont pas en cause)

2) Refus obstiné de mon navigateur pour se connecter sur Microsoft afin de récupérer les outils "Console de récup"...Avec cette connerie de Windows authentique !!! - J'ai pourtant une licence valide et enregistrée de Vista Pro! - Refus de connexion idem avec Explorer (quelle m... ce truc : c'est illisible; ça me renvoie sur une page bourrée de pubs stupides !!! hallucinant! c'est pas un navigateur c'est JC Decaux ! Pire, on dirait du JC Darmon !) Le Combofix est sur mon burlingue mais je ne bsais pas si j'ai la "Console de Récup"

3) Pour résoudre en partie mes problèmes j'ai essayé de désinstaller / Réinstaller mon imprimante... Rien à faire !

Gros soucis!!!

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)

Merci, c'est sympa : je fais ça tout de suite

...Voilà !

+ Bizarre, juste à la fin du processus, j'ai été déconnecté et mon navigateur a été désactivé...Là, je l'ai redémarré (???)

Voici le rapport (après l'exécution de commande -2-) _Ci-dessous_


-----------\\ ToolBar S&D 1.2.6 XP/Vista

Microsoft® Windows Vista™ Professionnel ( v6.0.6000 )
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T7250 @ 2.00GHz )
BIOS : KBC Version 71.2E
USER : moi ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
C:\ (Local Disk) - NTFS - Total:102 Go (Free:2 Go)
D:\ (Local Disk) - NTFS - Total:7 Go (Free:0 Go)
E:\ (Local Disk) - NTFS - Total:1 Go (Free:1 Go)
F:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
Option : [2] ( 28/12/2008|16:29 )

[ UAC => 1 ]

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\AskBarDis\bar
Supprime! - C:\Program Files\AskBarDis\unins000.dat
Supprime! - C:\Program Files\AskBarDis\unins000.exe
Supprime! - C:\Users\MOIPC-~1.000\AppData\Local\Temp\nssB867.tmp
Supprime! - C:\Program Files\AskBarDis

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/"
"Default_Page_URL"="https://www8.hp.com/fr/fr/home.html"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


--------------------\\ Recherche d'autres infections

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters]
NameServer REG_SZ 85.255.116.149;85.255.112.14
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters]
NameServer REG_SZ 85.255.116.149;85.255.112.14
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
NameServer REG_SZ 85.255.116.149;85.255.112.14
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\..\{318A4654-E274-49B2-B77D-03391D7AB077}]
NameServer REG_SZ 85.255.116.149;85.255.112.14
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}]
NameServer REG_SZ 85.255.116.149;85.255.112.14
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\..\{318A4654-E274-49B2-B77D-03391D7AB077}]
NameServer REG_SZ 85.255.116.149;85.255.112.14
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}]
NameServer REG_SZ 85.255.116.149;85.255.112.14
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}]
DhcpNameServer REG_SZ 85.255.116.149;85.255.112.14
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\..\{318A4654-E274-49B2-B77D-03391D7AB077}]
NameServer REG_SZ 85.255.116.149;85.255.112.14
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}]
NameServer REG_SZ 85.255.116.149;85.255.112.14
[b]==> WAREOUT <==/b

--------------------\\ Cracks & Keygens ..

C:\Users\MOIPC-~1.000\AppData\Roaming\Microsoft\Windows\Recent\crack.lnk


[ UAC => 1 ]


1 - "C:\ToolBar SD\TB_1.txt" - 28/12/2008|12:54 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 28/12/2008|16:29 - Option : [2]

-----------\\ Fin du rapport a 16:29:49,89

...Je viens de relire le "Rapport" ...Je ne (re)trouve pas ce(s) fichiers :

> C:\Users\MOIPC-~1.000\AppData\Roaming\Microsoft\Windows\Recent\crack.lnk

...Il faut dire qu'il y a quelques temps, j'ai reformaté après avoir utilisé une "fonction" sauvegarde de HP installée par défaut sur mon ordi... Celà a eu pour effet de me créer un second "utilisateur" (affublé du 1.000 qui apparaît sur le rapport) ...Je ne parviens pas a localiser le fichier dans "Roaming" !!! = pas de Dossier Microsoft (y compris après avoir modifié les paramètres d'affichage dans mon panneau de config) (???)

Ouuuups! J'ai un peu tardé (peur de faire des conn... + Mon gamin à faire manger, pardon) >>>

Voici le résultat de premier rapport (1) de SmitFraudFix :

SmitFraudFix v2.387

Scan done at 18:47:52,45, 28/12/2008
Run from C:\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Hpservice.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragService.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\SMINST\scheduler.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\PDF Complete\pdfsty.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Exstora\Exstora.exe
C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragCtrl.exe
C:\Program Files\BaroufaSoft\Matrix Screen Locker\matrix.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\conime.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\PDF Complete\pdfvista.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\moi.PC-de-moi.000


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\MOIPC-~1.000\AppData\Local\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\moi.PC-de-moi.000\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\MOIPC-~1.000\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\Google\googletoolbar1.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="APSHook.dll"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

Je ne suis pas sûr de savoir "poster" correctement...Pardon (je ne sais pas s'il faut passer par "répondre à" ou pas ??)

Je recommence (en passant par répondre à) : voici le premier résultat de SmitFraudFix :

SmitFraudFix v2.387

Scan done at 18:47:52,45, 28/12/2008
Run from C:\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Hpservice.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragService.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\SMINST\scheduler.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\PDF Complete\pdfsty.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Exstora\Exstora.exe
C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragCtrl.exe
C:\Program Files\BaroufaSoft\Matrix Screen Locker\matrix.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\conime.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\PDF Complete\pdfvista.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\moi.PC-de-moi.000


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\MOIPC-~1.000\AppData\Local\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\moi.PC-de-moi.000\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\MOIPC-~1.000\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\Google\googletoolbar1.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="APSHook.dll"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

(...) Ok, je reviens -tout de suite cette fois!

Voici donc le rapport n° 2 [ option 5 - DNS ]

>>>

SmitFraudFix v2.387

Scan done at 19:11:00,60, 28/12/2008
Run from C:\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» DNS Before Fix

HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14

»»»»»»»»»»»»»»»»»»»»»»»» DNS After Fix

HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14

C'est pourtant bien le résultat de Option 5 -

>>>

SmitFraudFix v2.387

Scan done at 19:28:25,83, 28/12/2008
Run from C:\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» DNS Before Fix

HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14

»»»»»»»»»»»»»»»»»»»»»»»» DNS After Fix

HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14

....Bon...Curieux effets : Plus de fond d'écran mais un bel écran BLEU à la place et des Alertes Antivir qui se déchainent TR\Crypt.XPack.Gen !!! les unes derrière les autres - Que se passe-t-il ?

>>> Voici le dernier rapport (après le passage de SFF Option 2 Réparer (?) !!!) :

SmitFraudFix v2.387

Scan done at 19:40:09,56, 28/12/2008
Run from C:\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost
::1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\Program Files\Google\googletoolbar1.dll Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: DhcpNameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.116.149;85.255.112.14


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

Curieux qu' après tout ça Antivir envoie encore des alertes ( HIDDENEXT/Crypted[heuristic] detected in "C:_mitFraudFix\Agent OMZ.Fix.exe

Bon, je suppose qu' avec cette localisation c'est normal (?)

...Avant que je ne m'embrouille complètement, je poursuis : Voici le (dernier ?) rapport. Celui de MalWareByte :

>>>

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 6.0.6000

28/12/2008 20:34:57
mbam-log-2008-12-28 (20-34-57).txt

Type de recherche: Examen rapide
Eléments examinés: 54801
Temps écoulé: 3 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 10
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.149;85.255.112.14 -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{318a4654-e274-49b2-b77d-03391d7ab077}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.149;85.255.112.14 -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{a2223c1b-72e2-4d2c-a173-dc1b08f0b4f5}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.149;85.255.112.14 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.149;85.255.112.14 -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{318a4654-e274-49b2-b77d-03391d7ab077}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.149;85.255.112.14 -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{a2223c1b-72e2-4d2c-a173-dc1b08f0b4f5}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.149;85.255.112.14 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.149;85.255.112.14 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{318a4654-e274-49b2-b77d-03391d7ab077}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.149;85.255.112.14 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{a2223c1b-72e2-4d2c-a173-dc1b08f0b4f5}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.149;85.255.112.14 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{a2223c1b-72e2-4d2c-a173-dc1b08f0b4f5}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.149;85.255.112.14 -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\services.exe (Backdoor.ProRat) -> Quarantined and deleted successfully.

Voilà qui est fait !

Ce qui m'étonne est que mon "Antivir" déclenche toujours et toujours les mêmes alertes... Je viens d'essayer la Mise-à-Jour "Update Now " et le résultat (le même que tout-à-l'heure = Internet Connection Failed )

Par ailleurs, je n'ai toujours pas d'accès à mon imprimante ( elle affiche : erreur )

Après un premier passage, ToolsCleaner a refusé de me laisser accéder au Rapport > J'ai du le relancer en tant qu'administrateur pour qu'il y consente... Par conséquent, il manque peut-être des infos dans le rapport. Je pense que d'autres "outils" qu'HiJackThis ont été nettoyés...

Voici le (reste du) rapport :

>>>

[ Rapport ToolsCleaner version 2.2.7 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\TB.txt: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\WINDOWS\SMINST\mbr.exe: trouvé !
C:\WINDOWS\SMINST\RAMDSK\Windows\SYSTEM32\mbr.exe: trouvé !
C:\WINDOWS\SMINST\RPFiles\Windows\System32\mbr.exe: trouvé !

---------------------------------
-->- Suppression:

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: supprimé !
C:\TB.txt: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\WINDOWS\SMINST\mbr.exe: supprimé !
C:\WINDOWS\SMINST\RAMDSK\Windows\SYSTEM32\mbr.exe: supprimé !
C:\WINDOWS\SMINST\RPFiles\Windows\System32\mbr.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: supprimé !


...Ceci dit > Antivir déclenche toujours ses "alertes" et ...Toujours impossible de le mettre à Jour (Connection Internet Failed) _Bizarre tout ça_

Ne resterait-il pas une "souche" de cette cochonnerie ? J'ai lu sur (je ne sais plus quel) site que l'une des premières actions de cette M.... était de devenir invisible puis de créer un fichier qui la réinstalle a chaque Log. (??? !!!)

Bon, après tout ça que dois-je penser : suis-je "guéri" Docteur ? Ou bien mon "Infection " est-elle toujours là ?...

Tu ne peux pas nécessairement avoir la réponse, mais ce serait sympa si je pouvais avoir une petite approximation.

Merci en tout cas de passer tout ce temps pour m'aider à résoudre cette infection. C'est VRAIMENT très sympa!!!

(...) Je viens de trouver ça sur mon bureau... Peut-être le fameux rapport de ToolsCleaner préalablement refusé ???

[ Rapport ToolsCleaner version 2.2.7 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\TB.txt: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\WINDOWS\SMINST\mbr.exe: trouvé !
C:\WINDOWS\SMINST\RAMDSK\Windows\SYSTEM32\mbr.exe: trouvé !
C:\WINDOWS\SMINST\RPFiles\Windows\System32\mbr.exe: trouvé !

---------------------------------
-->- Suppression:

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: supprimé !
C:\TB.txt: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\WINDOWS\SMINST\mbr.exe: supprimé !
C:\WINDOWS\SMINST\RAMDSK\Windows\SYSTEM32\mbr.exe: supprimé !
C:\WINDOWS\SMINST\RPFiles\Windows\System32\mbr.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: supprimé !


>>> Je repart faire un HiJack !

Et Hop! le Revoilou : HiJackThis 2, Le Retour !

>>>

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:33:27, on 28/12/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16764)
Boot mode: Normal

Running processes:
C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\WINDOWS\SMINST\scheduler.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\PDF Complete\pdfsty.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Exstora\Exstora.exe
C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragCtrl.exe
C:\Program Files\BaroufaSoft\Matrix Screen Locker\matrix.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\moi.PC-de-moi.000\Desktop\HiJackThis.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\RunOnce: [ST Recovery Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [UIWatcher] C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
O4 - HKCU\..\Run: [Off4Fit] C:\Program Files\Smart PC Solutions\Off4Fit\Off4Fit.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Exstora] "C:\Program Files\Exstora\Exstora.exe"
O4 - HKCU\..\Run: [Ovulation Calendar Calculator] C:\Program Files\Ovulation Calendar Calculator\ovCalendar.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Ashampoo Magic Defrag.lnk = C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragCtrl.exe
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - Global Startup: Matrix Screen Locker.lnk = C:\Program Files\BaroufaSoft\Matrix Screen Locker\matrix.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer = 85.255.116.149;85.255.112.14
O17 - HKLM\System\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer = 85.255.116.149;85.255.112.14
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.149;85.255.112.14
O17 - HKLM\System\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer = 85.255.116.149;85.255.112.14
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.149;85.255.112.14
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: PsExec (PSEXESVC) - Sysinternals - C:\Windows\PSEXESVC.EXE
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

...Effets désastreux = Plus de connexion Plus moyen d'accéder à internet !!!

J'ai du batailler pour restaurer ma connexion et toujours les alertes Antivir !!!

Heu... Petite question (si tu peux éclairer ma lanterne) = à quoi correspondent ces identifiants, relevés dans le scan HJT :

>>> NameServer = 85.255.116.149;85.255.112.14

Je ne me souviens pas que celà corresponde à mon IP ; serait-ce celle de mon FAI ? - Ques Aquo ? A quoi renvoient ces chiffres ? (Merci)

...Si tu en as marre, je comprendrais que tu veuille faire une "pause" (moi-même je commence à saturer - d'autant que j'ai l'impression que ça n'évolue pas) - N'hésites pas à me le dire... Tu as déjà consacré beaucoup de ton temps a essayer de m'aider!
Mon problème ne semble pas très simple à régler...

En résumé : a chaque alerte Antivir j'ai l'impression que ce "truc" me nargue - ça m'ennerve!!!

En tout cas je crois que je vais VIRER antivir (je remettrai Kaspersky que j'ai acheté et désinstallé parceque je le trouvais pas assez "transparent" pour l'utilisateur à mon goût!)...

Merci beaucoup Toptitbal ! Bonne nuit ! J'essaierai de me reconnecter plus tard...

Je finirai bien par virer cette saloperie de Trojan invisible !

Merci encore de ta patience et de ta pugnacité. A Plus (si tu n'es pas découragé !!!) c'était TRES TRES sympa de ta part _ Merci beaucoup encore une fois.

_TRN_

Bonjour ^^Marie^^,

C 'est gentil de venir à mon secour (ce matin la frappe au clavier est considérablement ralentie... Key-Logger?- Je pense être l'objet de malveillance...Pas seulement d'un virus)... - il tente de modifier mes paramètres d'accès au Forum!!!

Je suis les instructions de ce pas...

Re-Bonjour ^^Marie^^

Je suis connecté en Adsl via une F-Box 2 au moyen d'un cable Ethernet (config en mode "Routeur" Wifi [sécurisé] activé) _PC Portable HP Compaq 6710b_

>>> Ci-joint le Rapport GenProc [ il m'a demandé une première fois de "désactiver l'UAC" à l'aide de UAC active.bat et m'a déconnecté > Je l'ai donc re-lançé après avoir désactivé l'UAC ]

P A P P O R T "GenProc" :

Rapport GenProc 2.316 [1] - 29/12/2008 - Windows Vista

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :


Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
- C:\Program Files\EsetOnlineScanner\log.txt

__________________________________________________________________________________________________________

Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com

...Il manque des bouts de mon message texte : Config = WiFi activé !

...(Suite)...

Impossible d'utiliser Explorer!!! > J'ai été orienté vers une fenêtre de téléchargement d'une "Version 7" qui a tout bloqué (la fenêtre Explorer refuse de se refermer) et pas d'accès à Internet au moyen du Navigateur de Crosoft !!!

Dois-je suivre la recommandation de Scan-en-ligne avec Nod32 ??? - Merci - Ce truc commence à m'épuiser et à me poser de graves problèmes pour administrer plusieurs de mes activités en ligne...Sight !

Re-Bonjour TopTitBal, ...pas trop de cauchemards avec ce TR\Crypt.Gen

J'ai reçu un renfort de ^^Marie^^ qui a l'air de vouloir aussi résoudre ce vilain problème... J'ai semble-t-il quelques soucis avec Explorer (je n'aime pas ce navigateur, trop "constipé" à mon goût, ce qui ne facilite pas les choses parceque , du coup, je le connais très mal!)

Merci de revenir me piloter...

>>> >>> >>> J'ai Utilisé "Glary Utilities" pour nettoyer Registre et Fichiers temp avant de lancer RSIT - Je ne sais pas si j'ai bien fait ???

Voici les deux fichiers Issus du lancement de RSIT :

>>>

Logfile of random's system information tool 1.05 (written by random/random)
Run by moi at 2008-12-29 12:17:47
Microsoft® Windows Vista™ Professionnel
System drive C: has 3 GB (3%) free of 105 GB
Total RAM: 3063 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:17:55, on 29/12/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16764)
Boot mode: Normal

Running processes:
C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\WINDOWS\SMINST\scheduler.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\PDF Complete\pdfsty.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
C:\Program Files\Exstora\Exstora.exe
C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragCtrl.exe
C:\Program Files\BaroufaSoft\Matrix Screen Locker\matrix.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\moi.PC-de-moi.000\Desktop\RSIT.exe
C:\Program Files\trend micro\moi.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\RunOnce: [ST Recovery Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [UIWatcher] C:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe
O4 - HKCU\..\Run: [Off4Fit] C:\Program Files\Smart PC Solutions\Off4Fit\Off4Fit.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Exstora] "C:\Program Files\Exstora\Exstora.exe"
O4 - HKCU\..\Run: [Ovulation Calendar Calculator] C:\Program Files\Ovulation Calendar Calculator\ovCalendar.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Ashampoo Magic Defrag.lnk = C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragCtrl.exe
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - Global Startup: Matrix Screen Locker.lnk = C:\Program Files\BaroufaSoft\Matrix Screen Locker\matrix.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer = 85.255.116.149;85.255.112.14
O17 - HKLM\System\CCS\Services\Tcpip\..\{A2223C1B-72E2-4D2C-A173-DC1B08F0B4F5}: NameServer = 85.255.116.149;85.255.112.14
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.149;85.255.112.14
O17 - HKLM\System\CS1\Services\Tcpip\..\{318A4654-E274-49B2-B77D-03391D7AB077}: NameServer = 85.255.116.149;85.255.112.14
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.149;85.255.112.14
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magic Defrag\bin\aDefragService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: PsExec (PSEXESVC) - Sysinternals - C:\Windows\PSEXESVC.EXE
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe