Comment nettoyer mon pc de ses virus ?

Résolu
A.u.d.r.e.y Messages postés 34 Date d'inscription   Statut Membre Dernière intervention   -  
A.u.d.r.e.y Messages postés 34 Date d'inscription   Statut Membre Dernière intervention   -
Bonjour,

J'ai AVG comme Anti virus et il me dit que j'ai beaucoup de virus sur mon pc ( cheval de troie, vers, ... ). J'ai fais une analyse et j'ai supprimer les virus mis en quarantaine et découvert. Mais PC dit qu'il contient toujours c'est virus ... Comment faire pour les supprimer definitivement de mon PC ? Aider moi sv'p.

Merci d'avance !
A voir également:

62 réponses

Précédent
Réponse 21 / 62
A.u.d.r.e.y Messages postés 34 Date d'inscription   Statut Membre Dernière intervention  
 
C'est bn ..
Il mdisent ça : Search Navipromo version 3.7.0 commencé le 24/12/2008 à 2:44:54,06

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU T2050 @ 1.60GHz )
BIOS : Ver 1.00PARTTBL
USER : Emma ( Administrator )
BOOT : Normal boot

Antivirus : AVG Anti-Virus Free 8.0 (Activated)
Firewall : Norton Internet Worm Protection 2006 (Not Activated)

C:\ (Local Disk) - NTFS - Total:46 Go (Free:23 Go)
D:\ (Local Disk) - NTFS - Total:46 Go (Free:46 Go)
E:\ (CD or DVD)


Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Emma\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Emma\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Emma\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

Fichiers trouvés :

cgmnwkmfy.exe trouvé !

* Recherche dans "C:\Documents and Settings\Emma\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *



*** Recherche fichiers ***


C:\WINDOWS\pack.epk trouvé !

*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :

goocqgeuk.dat trouvé !
yyaqekeb.dat trouvé !

* Dans "C:\Documents and Settings\Emma\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" :


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :


AFF6BD3A918D36F2.job trouvé ! Infection Lop possible non traitée par cet outil !


*** Analyse terminée le 24/12/2008 à 2:59:21,76 ***
0
Réponse 22 / 62
Utilisateur anonyme
 
re,

De navilog1,

Faite le choix 1

Effectue la vérification du système à la recherche de l'adware. Un scan avec catchme de GMER est également éffectué pour Windows XP. Cette analyse peut durer une dizaine de minutes. Patientez alors jusqu'au message «Analyse terminée le ....». Appuyez sur une touche comme demandé et le bloc note va souvrir , Enregistrez-le sur votre disque. Puis Ouvrez-le et Copiez-Collez l'intégralité de ce rapport sur le forum qui vous l'auras demandé.
0
Réponse 23 / 62
Utilisateur anonyme
 
Re,

▶ Navilog1 option2

▶ Déconnecte toi du net et désactive ton antivirus et antispyware résident pour que Navilog1 puisse s'exécuter normalement.

▶ Double-clique sur le raccourci Navilog1 présent sur ton Bureau.

▶ Au menu principal, Fais le choix 2
Laisse toi guider et patiente.
Le fix va t'informer qu'il va alors redémarrer ton PC
Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts.
Appuie sur une touche comme demandé.
(Si ton PC ne redémarre pas automatiquement, fais le toi même)
Au redémarrage de ton PC, choisis ta session habituelle si nécessaire.

▶ Patiente jusqu'au message :
*** Nettoyage Termine le ..... ***
Le Bloc-notes va s'ouvrir.
Sauvegarde le rapport sur ton Bureau de manière à le retrouver.
Referme le Bloc-notes. Ton Bureau va réapparaître

PS : Si ton Bureau ne réapparaît pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Cliques en haut à gauche sur fichiers et choisis "exécuter"
Tapes explorer et valides. Cela te fera apparaître ton Bureau

▶ Poste le rapport de Navilog1 (contenu du fichier navi2.txt) en réponse et dis moi si tu constates des améliorations.

/!\Pense à ré-activer ton antivirus et antispyware résident avant de te reconnecter sur "la toile"./!\

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
0
Réponse 24 / 62
A.u.d.r.e.y Messages postés 34 Date d'inscription   Statut Membre Dernière intervention  
 
Voila :
Clean Navipromo version 3.7.0 commencé le 24/12/2008 à 3:08:35,46

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU T2050 @ 1.60GHz )
BIOS : Ver 1.00PARTTBL
USER : Emma ( Administrator )
BOOT : Normal boot

Antivirus : AVG Anti-Virus Free 8.0 (Activated)
Firewall : Norton Internet Worm Protection 2006 (Not Activated)

C:\ (Local Disk) - NTFS - Total:46 Go (Free:23 Go)
D:\ (Local Disk) - NTFS - Total:46 Go (Free:46 Go)
E:\ (CD or DVD)


Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


cgmnwkmfy.exe trouvé !
Copie cgmnwkmfy.exe réalisée avec succès !
cgmnwkmfy.exe supprimé !


* Suppression dans "C:\Documents and Settings\Emma\locals~1\applic~1" *



* Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *



*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Emma\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Emma\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Emma\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***



*** Suppression fichiers ***

C:\WINDOWS\pack.epk supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Emma\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


goocqgeuk.dat trouvé !
Copie goocqgeuk.dat réalisée avec succès !
goocqgeuk.dat supprimé !

yyaqekeb.dat trouvé !
Copie yyaqekeb.dat réalisée avec succès !
yyaqekeb.dat supprimé !


* Dans "C:\Documents and Settings\Emma\locals~1\applic~1" *


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Recherche autres dossiers et fichiers connus ***

AFF6BD3A918D36F2.job trouvé ! Infection Lop possible non traitée par cet outil !


*** Nettoyage terminé le 24/12/2008 à 3:12:39,50 ***
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 25 / 62
Utilisateur anonyme
 
Re,

Télécharge Lop S&D


▶ Double-clique dessus pour lancer l'installation

▶ Puis double-clique sur le raccourci Lop S&D présent sur ton bureau

▶ Séléctionne la langue souhaitée

▶ Puis choisis l'Option 1 ( Recherche )

▶ Patiente jusqu'à la fin du scan

▶ Poste le rapport généré ( C:lopR.txt )

tutoriel

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
0
Réponse 26 / 62
noctambule28 Messages postés 33382 Date d'inscription   Statut Webmaster Dernière intervention   2 857
 
salut , t'es pas en vacances ?
0
Réponse 27 / 62
A.u.d.r.e.y Messages postés 34 Date d'inscription   Statut Membre Dernière intervention  
 
Sii
0
Réponse 28 / 62
Utilisateur anonyme
 
--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU T2050 @ 1.60GHz )
BIOS : Ver 1.00PARTTBL
USER : Emma ( Administrator )
BOOT : Normal boot
Antivirus : AVG Anti-Virus Free 8.0 (Activated)
Firewall : Norton Internet Worm Protection 2006 (Not Activated)
C:\ (Local Disk) - NTFS - Total:46 Go (Free:25 Go)
D:\ (Local Disk) - NTFS - Total:46 Go (Free:46 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 24/12/2008| 3:31 )

--------------------\\ Listing des dossiers dans APPLIC~1

[25/12/2006|07:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe
[25/12/2006|07:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[24/12/2006|22:47] C:\DOCUME~1\ADMINI~1\APPLIC~1\Intel
[23/12/2008|23:00] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[25/12/2006|07:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\toshiba
[25/12/2006|07:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\Windows Desktop Search

[23/11/2008|19:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{90F3B5EB-A471-42F9-A905-991C2DB2312C}
[23/11/2008|19:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{C39CADE8-EC32-4A3E-ADF3-99FB5B7A317D}
[24/12/2008|02:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Admin Inter 1 Mags
[25/12/2006|07:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[01/05/2008|12:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[25/12/2006|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[23/12/2008|23:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8
[23/11/2008|19:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
[02/07/2008|13:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[04/02/2007|12:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[24/12/2006|22:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intel
[24/12/2008|01:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[20/12/2008|10:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[19/12/2008|18:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[30/05/2008|20:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
[30/03/2007|20:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\mpDRM
[19/12/2008|18:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PassMark
[31/05/2008|16:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ScanSoft
[27/06/2008|12:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
[19/12/2008|18:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[19/12/2008|18:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[07/02/2007|13:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[30/04/2008|16:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[25/12/2006|07:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe
[25/12/2006|07:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[24/12/2006|22:46] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intel
[25/12/2006|07:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[25/12/2006|07:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\toshiba
[25/12/2006|07:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Windows Desktop Search

[28/06/2008|20:54] C:\DOCUME~1\Emma\APPLIC~1\Adobe
[25/12/2006|12:35] C:\DOCUME~1\Emma\APPLIC~1\AdobeUM
[22/08/2008|18:15] C:\DOCUME~1\Emma\APPLIC~1\Apple Computer
[31/05/2008|16:25] C:\DOCUME~1\Emma\APPLIC~1\ArcSoft
[23/12/2008|23:00] C:\DOCUME~1\Emma\APPLIC~1\AVGTOOLBAR
[25/05/2008|14:37] C:\DOCUME~1\Emma\APPLIC~1\Canon
[23/11/2008|20:12] C:\DOCUME~1\Emma\APPLIC~1\Creative
[20/12/2008|08:34] C:\DOCUME~1\Emma\APPLIC~1\EoRezo
[20/12/2008|09:55] C:\DOCUME~1\Emma\APPLIC~1\Face about keep
[21/12/2008|11:03] C:\DOCUME~1\Emma\APPLIC~1\FotoWire
[21/03/2007|16:33] C:\DOCUME~1\Emma\APPLIC~1\FunWebProducts
[13/04/2007|15:28] C:\DOCUME~1\Emma\APPLIC~1\Google
[25/10/2008|17:46] C:\DOCUME~1\Emma\APPLIC~1\Help
[25/12/2006|07:28] C:\DOCUME~1\Emma\APPLIC~1\Identities
[24/12/2006|22:46] C:\DOCUME~1\Emma\APPLIC~1\Intel
[01/01/2007|20:49] C:\DOCUME~1\Emma\APPLIC~1\InterVideo
[10/03/2007|21:44] C:\DOCUME~1\Emma\APPLIC~1\ItsLabel
[06/05/2008|20:09] C:\DOCUME~1\Emma\APPLIC~1\Jasc
[22/12/2008|07:21] C:\DOCUME~1\Emma\APPLIC~1\LimeWire
[25/12/2006|01:02] C:\DOCUME~1\Emma\APPLIC~1\Macromedia
[24/12/2008|01:34] C:\DOCUME~1\Emma\APPLIC~1\Malwarebytes
[23/12/2008|23:00] C:\DOCUME~1\Emma\APPLIC~1\Microsoft
[21/12/2008|15:13] C:\DOCUME~1\Emma\APPLIC~1\Mozilla
[31/05/2008|15:14] C:\DOCUME~1\Emma\APPLIC~1\MSNInstaller
[14/09/2008|15:55] C:\DOCUME~1\Emma\APPLIC~1\NavX
[10/12/2008|19:39] C:\DOCUME~1\Emma\APPLIC~1\Opera
[25/10/2008|10:27] C:\DOCUME~1\Emma\APPLIC~1\Samsung
[01/05/2008|15:03] C:\DOCUME~1\Emma\APPLIC~1\Screenshot Sender
[27/06/2008|12:26] C:\DOCUME~1\Emma\APPLIC~1\skypePM
[19/02/2007|01:39] C:\DOCUME~1\Emma\APPLIC~1\Sun
[25/05/2008|14:35] C:\DOCUME~1\Emma\APPLIC~1\toshiba
[11/08/2008|12:48] C:\DOCUME~1\Emma\APPLIC~1\vlc
[25/12/2006|07:28] C:\DOCUME~1\Emma\APPLIC~1\Windows Desktop Search
[01/07/2008|09:43] C:\DOCUME~1\Emma\APPLIC~1\Yahoo!

[23/12/2008|23:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[25/12/2006|07:29] C:\DOCUME~1\LOCALS~1\APPLIC~1\X10 Commander

[21/08/2008|17:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\Intel
[23/12/2008|23:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft


--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[22/12/2008 20:52][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[24/12/2008 03:00][--ah-----] C:\WINDOWS\tasks\AFF6BD3A918D36F2.job
[24/12/2008 03:10][--ah-----] C:\WINDOWS\tasks\SA.DAT
[10/08/2004 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

( AFF6BD3A918D36F2.job )=( c:\docume~1\emma\applic~1\faceab~1\LiteCurbLoad.exe )

--------------------\\ Listing des dossiers dans C:\Program Files

[25/12/2006|07:30] C:\Program Files\Adobe
[25/12/2006|07:30] C:\Program Files\Apoint2K
[22/12/2008|20:52] C:\Program Files\Apple Software Update
[20/08/2008|17:09] C:\Program Files\Atheros
[23/11/2008|19:51] C:\Program Files\Audible
[22/08/2008|18:22] C:\Program Files\AVG
[22/12/2008|20:53] C:\Program Files\Bonjour
[18/06/2008|21:11] C:\Program Files\BroadJump
[22/08/2008|19:08] C:\Program Files\Canon
[21/12/2008|09:25] C:\Program Files\Circle Developement
[12/10/2008|15:38] C:\Program Files\Club-Internet
[30/05/2008|20:18] C:\Program Files\Common Files
[21/09/2006|11:05] C:\Program Files\ComPlus Applications
[23/11/2008|19:52] C:\Program Files\Creative
[19/12/2008|21:06] C:\Program Files\EoRezo
[20/12/2008|09:53] C:\Program Files\Face about keep
[21/12/2008|12:05] C:\Program Files\Fichiers communs
[31/05/2008|15:57] C:\Program Files\Gamenext
[02/07/2008|18:02] C:\Program Files\Google
[22/12/2008|20:31] C:\Program Files\InstallShield Installation Information
[22/08/2008|18:00] C:\Program Files\Intel
[19/12/2008|18:52] C:\Program Files\Internet Explorer
[25/05/2008|14:27] C:\Program Files\InterVideo
[12/10/2008|15:36] C:\Program Files\iPod
[18/06/2008|21:11] C:\Program Files\ItsLabel
[25/05/2008|14:26] C:\Program Files\Jasc Software Inc
[02/10/2006|17:20] C:\Program Files\Java
[04/08/2007|11:38] C:\Program Files\Lavalys
[20/12/2008|19:23] C:\Program Files\LimeWire
[23/12/2008|20:57] C:\Program Files\Logitech
[24/12/2006|22:48] C:\Program Files\ltmoh
[24/12/2008|02:05] C:\Program Files\Malwarebytes' Anti-Malware
[25/05/2008|14:36] C:\Program Files\Maxis
[19/12/2008|18:45] C:\Program Files\Messenger
[20/12/2008|09:52] C:\Program Files\Messenger Plus! Live
[17/12/2008|23:15] C:\Program Files\Microsoft
[01/05/2008|18:14] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[25/12/2006|07:31] C:\Program Files\microsoft frontpage
[05/10/2008|12:19] C:\Program Files\Microsoft Office
[17/12/2008|23:19] C:\Program Files\Microsoft Silverlight
[17/12/2008|23:17] C:\Program Files\Microsoft SQL Server Compact Edition
[17/12/2008|23:18] C:\Program Files\Microsoft Sync Framework
[05/10/2008|12:19] C:\Program Files\Microsoft.NET
[26/10/2008|09:56] C:\Program Files\Motive
[19/12/2008|18:46] C:\Program Files\Movie Maker
[20/12/2008|00:09] C:\Program Files\MSBuild
[20/12/2008|09:35] C:\Program Files\MSECACHE
[31/05/2008|15:14] C:\Program Files\MSN
[25/12/2006|07:31] C:\Program Files\MSN Gaming Zone
[20/12/2008|09:36] C:\Program Files\MSN Messenger
[26/12/2006|15:13] C:\Program Files\MSXML 4.0
[24/12/2008|03:12] C:\Program Files\Navilog1
[19/12/2008|18:49] C:\Program Files\NetMeeting
[19/02/2007|22:35] C:\Program Files\Offre Wanadoo
[25/12/2006|07:31] C:\Program Files\Online Services
[19/12/2008|18:49] C:\Program Files\Opera
[19/12/2008|18:49] C:\Program Files\Outlook Express
[21/12/2008|14:24] C:\Program Files\PhotoFiltre
[24/10/2008|21:20] C:\Program Files\PROXY
[23/12/2008|14:28] C:\Program Files\QuickTime
[31/05/2008|18:19] C:\Program Files\Realtek
[20/12/2008|00:09] C:\Program Files\Reference Assemblies
[22/12/2008|20:53] C:\Program Files\Safari
[22/08/2008|19:08] C:\Program Files\Safari(2)
[18/05/2007|19:36] C:\Program Files\Securitoo
[25/05/2008|14:37] C:\Program Files\Services en ligne
[09/08/2008|20:33] C:\Program Files\SurfingAdvisor
[19/12/2008|18:49] C:\Program Files\Symantec
[30/04/2008|18:14] C:\Program Files\Thrustmaster
[06/07/2008|14:48] C:\Program Files\TOSHIBA
[24/12/2008|01:22] C:\Program Files\Trend Micro
[02/03/2007|16:32] C:\Program Files\Ubi Soft
[22/09/2006|10:06] C:\Program Files\Uninstall Information
[01/07/2008|19:07] C:\Program Files\Veoh Networks
[25/05/2008|14:37] C:\Program Files\Wanadoo
[22/08/2008|19:08] C:\Program Files\Windows Calendar
[22/08/2008|19:08] C:\Program Files\Windows Collaboration
[22/08/2008|19:08] C:\Program Files\Windows Defender
[25/12/2006|07:31] C:\Program Files\Windows Desktop Search
[20/12/2008|09:34] C:\Program Files\Windows Installer Clean Up(2)
[22/08/2008|19:08] C:\Program Files\Windows Journal
[20/12/2008|09:34] C:\Program Files\Windows Live
[22/08/2008|19:08] C:\Program Files\Windows Live Safety Center
[06/07/2008|11:11] C:\Program Files\Windows Live Toolbar
[22/08/2008|19:08] C:\Program Files\Windows Mail
[02/05/2008|19:17] C:\Program Files\Windows Media Connect 2
[20/09/2008|19:19] C:\Program Files\Windows Media Player
[19/12/2008|18:46] C:\Program Files\Windows NT
[22/08/2008|19:08] C:\Program Files\Windows Photo Gallery
[25/12/2006|07:31] C:\Program Files\Windows Plus
[22/08/2008|19:08] C:\Program Files\Windows Sidebar
[21/09/2006|11:06] C:\Program Files\WindowsUpdate
[25/12/2006|07:31] C:\Program Files\X10 Hardware
[25/12/2006|07:31] C:\Program Files\xerox
[02/07/2008|18:02] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[25/12/2006|07:30] C:\Program Files\Fichiers communs\Adobe
[01/05/2008|12:52] C:\Program Files\Fichiers communs\Apple
[30/03/2007|20:39] C:\Program Files\Fichiers communs\fluxDVD
[04/02/2007|12:16] C:\Program Files\Fichiers communs\InstallShield
[25/12/2006|07:30] C:\Program Files\Fichiers communs\InterVideo
[21/12/2008|12:05] C:\Program Files\Fichiers communs\Logitech
[23/12/2008|20:58] C:\Program Files\Fichiers communs\Microsoft Shared
[30/05/2008|20:18] C:\Program Files\Fichiers communs\Motive
[30/03/2007|20:39] C:\Program Files\Fichiers communs\mpDRM
[25/12/2006|07:30] C:\Program Files\Fichiers communs\MSSoap
[25/12/2006|07:30] C:\Program Files\Fichiers communs\ODBC
[31/05/2008|18:13] C:\Program Files\Fichiers communs\Services
[25/12/2006|07:30] C:\Program Files\Fichiers communs\SpeechEngines
[04/01/2007|16:38] C:\Program Files\Fichiers communs\SWF Studio
[19/12/2008|18:49] C:\Program Files\Fichiers communs\Symantec Shared
[19/12/2008|18:46] C:\Program Files\Fichiers communs\System
[17/12/2008|20:09] C:\Program Files\Fichiers communs\Windows Live
[30/04/2008|16:08] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 44 Processes )

IEXPLORE.EXE ~ [PID:1224]
IEXPLORE.EXE ~ [PID:3088]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Admin Inter 1 Mags
C:\DOCUME~1\Emma\APPLIC~1\faceab~1
C:\DOCUME~1\Emma\APPLIC~1\faceab~1\Deadcreative.exe
C:\DOCUME~1\Emma\APPLIC~1\faceab~1\Lite Curb Load.exe
C:\DOCUME~1\Emma\APPLIC~1\faceab~1\save owns mp3 balm.exe
C:\DOCUME~1\Emma\APPLIC~1\faceab~1\vcajurqc.exe
C:\Program Files\faceab~1
C:\Program Files\Circle Developement
C:\DOCUME~1\Emma\Cookies\emma@adultfriendfinder[1].txt
C:\DOCUME~1\Emma\Cookies\emma@banner.cotedazurpalace[2].txt
C:\DOCUME~1\Emma\Cookies\emma@cotedazurpalace[1].txt
C:\DOCUME~1\Emma\Cookies\emma@www.cotedazurpalace[2].txt
C:\DOCUME~1\Emma\Cookies\emma@pacificpoker[1].txt
C:\DOCUME~1\Emma\Cookies\emma@partygaming.122.2o7[1].txt
C:\DOCUME~1\Emma\Cookies\emma@partypoker[2].txt
C:\DOCUME~1\Emma\Cookies\emma@32vegas[2].txt
C:\DOCUME~1\Emma\Cookies\emma@banner.32vegas[1].txt
C:\WINDOWS\Tasks\AFF6BD3A918D36F2.job

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"slow list"="C:\\DOCUME~1\\Emma\\APPLIC~1\\FACEAB~1\\Deadcreative.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

--------------------\\ Verification du fichier Hosts

Fichier Hosts MODIFIE

127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

-> 72 [ 70 ## added by CiD ]

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-24 03:32:33
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 162

--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[F:15][D:2]-> C:\DOCUME~1\Emma\LOCALS~1\Temp
[F:411][D:0]-> C:\DOCUME~1\Emma\Cookies
[F:3159][D:9]-> C:\DOCUME~1\Emma\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 24/12/2008| 3:33 - Option : [1]

--------------------\\ Fin du rapport a 3:33:55
0
Réponse 29 / 62
Utilisateur anonyme
 
Re,

▶ Relance Lop S&D

▶ Choisis cette fois ci l'Option 2 ( Suppression )

▶ Ne ferme pas la fenêtre lors de la suppression !

▶ Poste le rapport généré ( C:\lopR.txt )

( Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier,

Nouvelle tâche, tape explorer.exe et valide )

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

▶ Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

▶ Double clique sur RSIT.exe pour lancer l'outil.

▶ Clique sur ' continue ' à l'écran Disclaimer.

▶ Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

▶ Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Pour les vacances,pas beau temps !!!

lol.........
0
Réponse 30 / 62
A.u.d.r.e.y Messages postés 34 Date d'inscription   Statut Membre Dernière intervention  
 
Nul pour les vacs' ..


--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU T2050 @ 1.60GHz )
BIOS : Ver 1.00PARTTBL
USER : Emma ( Administrator )
BOOT : Normal boot
Antivirus : AVG Anti-Virus Free 8.0 (Activated)
Firewall : Norton Internet Worm Protection 2006 (Not Activated)
C:\ (Local Disk) - NTFS - Total:46 Go (Free:25 Go)
D:\ (Local Disk) - NTFS - Total:46 Go (Free:46 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 24/12/2008| 3:40 )


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\DOCUME~1\Emma\APPLIC~1\faceab~1\Deadcreative.exe
Supprime! - C:\DOCUME~1\Emma\APPLIC~1\faceab~1\Lite Curb Load.exe
Supprime! - C:\DOCUME~1\Emma\APPLIC~1\faceab~1\save owns mp3 balm.exe
Supprime! - C:\DOCUME~1\Emma\APPLIC~1\faceab~1\vcajurqc.exe
Supprime! - C:\DOCUME~1\Emma\Cookies\emma@adultfriendfinder[1].txt
Supprime! - C:\DOCUME~1\Emma\Cookies\emma@banner.cotedazurpalace[2].txt
Supprime! - C:\DOCUME~1\Emma\Cookies\emma@cotedazurpalace[1].txt
Supprime! - C:\DOCUME~1\Emma\Cookies\emma@www.cotedazurpalace[2].txt
Supprime! - C:\DOCUME~1\Emma\Cookies\emma@pacificpoker[1].txt
Supprime! - C:\DOCUME~1\Emma\Cookies\emma@partygaming.122.2o7[1].txt
Supprime! - C:\DOCUME~1\Emma\Cookies\emma@partypoker[2].txt
Supprime! - C:\DOCUME~1\Emma\Cookies\emma@32vegas[2].txt
Supprime! - C:\DOCUME~1\Emma\Cookies\emma@banner.32vegas[1].txt
Supprime! - C:\WINDOWS\Tasks\AFF6BD3A918D36F2.job
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Admin Inter 1 Mags
Supprime! - C:\DOCUME~1\Emma\APPLIC~1\faceab~1
Supprime! - C:\Program Files\faceab~1
Supprime! - C:\Program Files\Circle Developement
-
[ Fichier Hosts ] .. Restaure!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


--------------------\\ Listing des dossiers dans APPLIC~1

[25/12/2006|07:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe
[25/12/2006|07:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[24/12/2006|22:47] C:\DOCUME~1\ADMINI~1\APPLIC~1\Intel
[23/12/2008|23:00] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[25/12/2006|07:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\toshiba
[25/12/2006|07:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\Windows Desktop Search

[23/11/2008|19:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{90F3B5EB-A471-42F9-A905-991C2DB2312C}
[23/11/2008|19:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{C39CADE8-EC32-4A3E-ADF3-99FB5B7A317D}
[25/12/2006|07:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[01/05/2008|12:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[25/12/2006|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[23/12/2008|23:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8
[23/11/2008|19:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
[02/07/2008|13:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[04/02/2007|12:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[24/12/2006|22:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intel
[24/12/2008|01:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[20/12/2008|10:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[19/12/2008|18:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[30/05/2008|20:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
[30/03/2007|20:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\mpDRM
[19/12/2008|18:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PassMark
[31/05/2008|16:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ScanSoft
[27/06/2008|12:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
[19/12/2008|18:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[19/12/2008|18:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[07/02/2007|13:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[30/04/2008|16:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[25/12/2006|07:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe
[25/12/2006|07:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[24/12/2006|22:46] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intel
[25/12/2006|07:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[25/12/2006|07:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\toshiba
[25/12/2006|07:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Windows Desktop Search

[28/06/2008|20:54] C:\DOCUME~1\Emma\APPLIC~1\Adobe
[25/12/2006|12:35] C:\DOCUME~1\Emma\APPLIC~1\AdobeUM
[22/08/2008|18:15] C:\DOCUME~1\Emma\APPLIC~1\Apple Computer
[31/05/2008|16:25] C:\DOCUME~1\Emma\APPLIC~1\ArcSoft
[23/12/2008|23:00] C:\DOCUME~1\Emma\APPLIC~1\AVGTOOLBAR
[25/05/2008|14:37] C:\DOCUME~1\Emma\APPLIC~1\Canon
[23/11/2008|20:12] C:\DOCUME~1\Emma\APPLIC~1\Creative
[20/12/2008|08:34] C:\DOCUME~1\Emma\APPLIC~1\EoRezo
[21/12/2008|11:03] C:\DOCUME~1\Emma\APPLIC~1\FotoWire
[21/03/2007|16:33] C:\DOCUME~1\Emma\APPLIC~1\FunWebProducts
[13/04/2007|15:28] C:\DOCUME~1\Emma\APPLIC~1\Google
[25/10/2008|17:46] C:\DOCUME~1\Emma\APPLIC~1\Help
[25/12/2006|07:28] C:\DOCUME~1\Emma\APPLIC~1\Identities
[24/12/2006|22:46] C:\DOCUME~1\Emma\APPLIC~1\Intel
[01/01/2007|20:49] C:\DOCUME~1\Emma\APPLIC~1\InterVideo
[10/03/2007|21:44] C:\DOCUME~1\Emma\APPLIC~1\ItsLabel
[06/05/2008|20:09] C:\DOCUME~1\Emma\APPLIC~1\Jasc
[22/12/2008|07:21] C:\DOCUME~1\Emma\APPLIC~1\LimeWire
[25/12/2006|01:02] C:\DOCUME~1\Emma\APPLIC~1\Macromedia
[24/12/2008|01:34] C:\DOCUME~1\Emma\APPLIC~1\Malwarebytes
[23/12/2008|23:00] C:\DOCUME~1\Emma\APPLIC~1\Microsoft
[21/12/2008|15:13] C:\DOCUME~1\Emma\APPLIC~1\Mozilla
[31/05/2008|15:14] C:\DOCUME~1\Emma\APPLIC~1\MSNInstaller
[14/09/2008|15:55] C:\DOCUME~1\Emma\APPLIC~1\NavX
[10/12/2008|19:39] C:\DOCUME~1\Emma\APPLIC~1\Opera
[25/10/2008|10:27] C:\DOCUME~1\Emma\APPLIC~1\Samsung
[01/05/2008|15:03] C:\DOCUME~1\Emma\APPLIC~1\Screenshot Sender
[27/06/2008|12:26] C:\DOCUME~1\Emma\APPLIC~1\skypePM
[19/02/2007|01:39] C:\DOCUME~1\Emma\APPLIC~1\Sun
[25/05/2008|14:35] C:\DOCUME~1\Emma\APPLIC~1\toshiba
[11/08/2008|12:48] C:\DOCUME~1\Emma\APPLIC~1\vlc
[25/12/2006|07:28] C:\DOCUME~1\Emma\APPLIC~1\Windows Desktop Search
[01/07/2008|09:43] C:\DOCUME~1\Emma\APPLIC~1\Yahoo!

[23/12/2008|23:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[25/12/2006|07:29] C:\DOCUME~1\LOCALS~1\APPLIC~1\X10 Commander

[21/08/2008|17:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\Intel
[23/12/2008|23:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft


--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[22/12/2008 20:52][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[24/12/2008 03:10][--ah-----] C:\WINDOWS\tasks\SA.DAT
[10/08/2004 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[25/12/2006|07:30] C:\Program Files\Adobe
[25/12/2006|07:30] C:\Program Files\Apoint2K
[22/12/2008|20:52] C:\Program Files\Apple Software Update
[20/08/2008|17:09] C:\Program Files\Atheros
[23/11/2008|19:51] C:\Program Files\Audible
[22/08/2008|18:22] C:\Program Files\AVG
[22/12/2008|20:53] C:\Program Files\Bonjour
[18/06/2008|21:11] C:\Program Files\BroadJump
[22/08/2008|19:08] C:\Program Files\Canon
[12/10/2008|15:38] C:\Program Files\Club-Internet
[30/05/2008|20:18] C:\Program Files\Common Files
[21/09/2006|11:05] C:\Program Files\ComPlus Applications
[23/11/2008|19:52] C:\Program Files\Creative
[19/12/2008|21:06] C:\Program Files\EoRezo
[21/12/2008|12:05] C:\Program Files\Fichiers communs
[31/05/2008|15:57] C:\Program Files\Gamenext
[02/07/2008|18:02] C:\Program Files\Google
[22/12/2008|20:31] C:\Program Files\InstallShield Installation Information
[22/08/2008|18:00] C:\Program Files\Intel
[19/12/2008|18:52] C:\Program Files\Internet Explorer
[25/05/2008|14:27] C:\Program Files\InterVideo
[12/10/2008|15:36] C:\Program Files\iPod
[18/06/2008|21:11] C:\Program Files\ItsLabel
[25/05/2008|14:26] C:\Program Files\Jasc Software Inc
[02/10/2006|17:20] C:\Program Files\Java
[04/08/2007|11:38] C:\Program Files\Lavalys
[20/12/2008|19:23] C:\Program Files\LimeWire
[23/12/2008|20:57] C:\Program Files\Logitech
[24/12/2006|22:48] C:\Program Files\ltmoh
[24/12/2008|02:05] C:\Program Files\Malwarebytes' Anti-Malware
[25/05/2008|14:36] C:\Program Files\Maxis
[19/12/2008|18:45] C:\Program Files\Messenger
[20/12/2008|09:52] C:\Program Files\Messenger Plus! Live
[17/12/2008|23:15] C:\Program Files\Microsoft
[01/05/2008|18:14] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[25/12/2006|07:31] C:\Program Files\microsoft frontpage
[05/10/2008|12:19] C:\Program Files\Microsoft Office
[17/12/2008|23:19] C:\Program Files\Microsoft Silverlight
[17/12/2008|23:17] C:\Program Files\Microsoft SQL Server Compact Edition
[17/12/2008|23:18] C:\Program Files\Microsoft Sync Framework
[05/10/2008|12:19] C:\Program Files\Microsoft.NET
[26/10/2008|09:56] C:\Program Files\Motive
[19/12/2008|18:46] C:\Program Files\Movie Maker
[20/12/2008|00:09] C:\Program Files\MSBuild
[20/12/2008|09:35] C:\Program Files\MSECACHE
[31/05/2008|15:14] C:\Program Files\MSN
[25/12/2006|07:31] C:\Program Files\MSN Gaming Zone
[20/12/2008|09:36] C:\Program Files\MSN Messenger
[26/12/2006|15:13] C:\Program Files\MSXML 4.0
[24/12/2008|03:39] C:\Program Files\Navilog1
[19/12/2008|18:49] C:\Program Files\NetMeeting
[19/02/2007|22:35] C:\Program Files\Offre Wanadoo
[25/12/2006|07:31] C:\Program Files\Online Services
[19/12/2008|18:49] C:\Program Files\Opera
[19/12/2008|18:49] C:\Program Files\Outlook Express
[21/12/2008|14:24] C:\Program Files\PhotoFiltre
[24/10/2008|21:20] C:\Program Files\PROXY
[23/12/2008|14:28] C:\Program Files\QuickTime
[31/05/2008|18:19] C:\Program Files\Realtek
[20/12/2008|00:09] C:\Program Files\Reference Assemblies
[22/12/2008|20:53] C:\Program Files\Safari
[22/08/2008|19:08] C:\Program Files\Safari(2)
[18/05/2007|19:36] C:\Program Files\Securitoo
[25/05/2008|14:37] C:\Program Files\Services en ligne
[09/08/2008|20:33] C:\Program Files\SurfingAdvisor
[19/12/2008|18:49] C:\Program Files\Symantec
[30/04/2008|18:14] C:\Program Files\Thrustmaster
[06/07/2008|14:48] C:\Program Files\TOSHIBA
[24/12/2008|01:22] C:\Program Files\Trend Micro
[02/03/2007|16:32] C:\Program Files\Ubi Soft
[22/09/2006|10:06] C:\Program Files\Uninstall Information
[01/07/2008|19:07] C:\Program Files\Veoh Networks
[25/05/2008|14:37] C:\Program Files\Wanadoo
[22/08/2008|19:08] C:\Program Files\Windows Calendar
[22/08/2008|19:08] C:\Program Files\Windows Collaboration
[22/08/2008|19:08] C:\Program Files\Windows Defender
[25/12/2006|07:31] C:\Program Files\Windows Desktop Search
[20/12/2008|09:34] C:\Program Files\Windows Installer Clean Up(2)
[22/08/2008|19:08] C:\Program Files\Windows Journal
[20/12/2008|09:34] C:\Program Files\Windows Live
[22/08/2008|19:08] C:\Program Files\Windows Live Safety Center
[06/07/2008|11:11] C:\Program Files\Windows Live Toolbar
[22/08/2008|19:08] C:\Program Files\Windows Mail
[02/05/2008|19:17] C:\Program Files\Windows Media Connect 2
[20/09/2008|19:19] C:\Program Files\Windows Media Player
[19/12/2008|18:46] C:\Program Files\Windows NT
[22/08/2008|19:08] C:\Program Files\Windows Photo Gallery
[25/12/2006|07:31] C:\Program Files\Windows Plus
[22/08/2008|19:08] C:\Program Files\Windows Sidebar
[21/09/2006|11:06] C:\Program Files\WindowsUpdate
[25/12/2006|07:31] C:\Program Files\X10 Hardware
[25/12/2006|07:31] C:\Program Files\xerox
[02/07/2008|18:02] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[25/12/2006|07:30] C:\Program Files\Fichiers communs\Adobe
[01/05/2008|12:52] C:\Program Files\Fichiers communs\Apple
[30/03/2007|20:39] C:\Program Files\Fichiers communs\fluxDVD
[04/02/2007|12:16] C:\Program Files\Fichiers communs\InstallShield
[25/12/2006|07:30] C:\Program Files\Fichiers communs\InterVideo
[21/12/2008|12:05] C:\Program Files\Fichiers communs\Logitech
[23/12/2008|20:58] C:\Program Files\Fichiers communs\Microsoft Shared
[30/05/2008|20:18] C:\Program Files\Fichiers communs\Motive
[30/03/2007|20:39] C:\Program Files\Fichiers communs\mpDRM
[25/12/2006|07:30] C:\Program Files\Fichiers communs\MSSoap
[25/12/2006|07:30] C:\Program Files\Fichiers communs\ODBC
[31/05/2008|18:13] C:\Program Files\Fichiers communs\Services
[25/12/2006|07:30] C:\Program Files\Fichiers communs\SpeechEngines
[04/01/2007|16:38] C:\Program Files\Fichiers communs\SWF Studio
[19/12/2008|18:49] C:\Program Files\Fichiers communs\Symantec Shared
[19/12/2008|18:46] C:\Program Files\Fichiers communs\System
[17/12/2008|20:09] C:\Program Files\Fichiers communs\Windows Live
[30/04/2008|16:08] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 41 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\Emma\Cookies\emma@advertising[1].txt

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-24 03:41:14
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 162

--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[F:15][D:2]-> C:\DOCUME~1\Emma\LOCALS~1\Temp
[F:403][D:0]-> C:\DOCUME~1\Emma\Cookies
[F:3190][D:9]-> C:\DOCUME~1\Emma\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 24/12/2008| 3:33 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 24/12/2008| 3:42 - Option : [2]

--------------------\\ Fin du rapport a 3:42:14
0
Réponse 31 / 62
A.u.d.r.e.y Messages postés 34 Date d'inscription   Statut Membre Dernière intervention  
 
Logfile of random's system information tool 1.05 (written by random/random)
Run by Emma at 2008-12-24 03:45:03
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 26 GB (56%) free of 48 GB
Total RAM: 1014 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:45:20, on 24/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Emma\Local Settings\Temporary Internet Files\Content.IE5\BUUGYUS6\RSIT[1].exe
C:\Program Files\Trend Micro\HijackThis\Emma.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SurfingAdvisor - {08111E97-AB7D-B099-1D3F-F88F47E13432} - C:\Program Files\SurfingAdvisor\SurfingAdvisor-2.dll (file missing)
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll (file missing)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [CanalPlayerHelper] C:\Program Files\Lecteur CANALPLAY\CanalPlayerHelper.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [wuhidikewi] Rundll32.exe "C:\WINDOWS\system32\tajopato.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll ,
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
0
Réponse 32 / 62
Utilisateur anonyme
 
Re,

▶ Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

▶ Double clique sur RSIT.exe pour lancer l'outil.

▶ Clique sur ' continue ' à l'écran Disclaimer.

▶ Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

▶ Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
0
Réponse 33 / 62
Utilisateur anonyme
 
Re,

Reposte le log.tx
0
Réponse 34 / 62
A.u.d.r.e.y Messages postés 34 Date d'inscription   Statut Membre Dernière intervention  
 
Jlai plus et quand je refais ça le fais plus =/
0
Réponse 35 / 62
Utilisateur anonyme
 
Re,

Fait ceci :

Télécharge toolscleaner sur ton Bureau :

toolscleaner

* Double-clique sur ToolsCleaner2.exe et laisse le travailler

* Clique sur Recherche et laisse le scan se terminer.

* Clique sur Suppression pour finaliser.

* Tu peux, si tu le souhaites, te servir des Options facultatives.

* Clique sur Quitter, pour que le rapport puisse se créer.

* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse

supprime tout ce qu'il trouvera
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
▶ Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

▶ Double clique sur RSIT.exe pour lancer l'outil.

▶ Clique sur ' continue ' à l'écran Disclaimer.

▶ Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

▶ Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

Et la tu me poste que le log txt.
0
Réponse 36 / 62
A.u.d.r.e.y Messages postés 34 Date d'inscription   Statut Membre Dernière intervention  
 
Le log txt :

Logfile of random's system information tool 1.05 (written by random/random)
Run by Emma at 2008-12-24 03:58:35
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 27 GB (56%) free of 48 GB
Total RAM: 1014 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:59:00, on 24/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Emma\Local Settings\Temporary Internet Files\Content.IE5\BUUGYUS6\RSIT[1].exe
C:\Program Files\trend micro\Emma.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SurfingAdvisor - {08111E97-AB7D-B099-1D3F-F88F47E13432} - C:\Program Files\SurfingAdvisor\SurfingAdvisor-2.dll (file missing)
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll (file missing)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [CanalPlayerHelper] C:\Program Files\Lecteur CANALPLAY\CanalPlayerHelper.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [wuhidikewi] Rundll32.exe "C:\WINDOWS\system32\tajopato.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll ,
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
0
Réponse 37 / 62
Utilisateur anonyme
 
Re,

Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...

Fais exactement ce qui suit :

Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide :

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation (si jamais tu en as et que je ne les ai pas vu sur le rapport hijackthis....)

---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

--->Je te conseil d'installer la console de récupération.(Voir le tutoriel).

Tuto ici : TUTO
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :

Double-clique sur C-Fix.exe (= combofix.exe ) .

Appuie sur une touche pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
0
Réponse 38 / 62
A.u.d.r.e.y Messages postés 34 Date d'inscription   Statut Membre Dernière intervention  
 
ComboFix 08-12-23.01 - Emma 2008-12-24 4:20:36.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1014.599 [GMT 1:00]
Lancé depuis: c:\documents and settings\Emma\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Emma\Application Data\FunWebProducts
c:\documents and settings\Emma\Application Data\FunWebProducts\Data\Emma\avatar.dat
c:\documents and settings\Emma\Application Data\FunWebProducts\Data\Emma\register.dat
c:\windows\system32\agakugeb.ini
c:\windows\system32\Cache
c:\windows\system32\Process.exe
c:\windows\wiaservb.log
D:\Autorun.inf

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-24 au 2008-12-24 ))))))))))))))))))))))))))))))))))))
.

2008-12-24 03:58 . 2008-12-24 03:59 <REP> d-------- C:\rsit
2008-12-24 01:34 . 2008-12-24 02:05 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-24 01:34 . 2008-12-24 01:34 <REP> d-------- c:\documents and settings\Emma\Application Data\Malwarebytes
2008-12-24 01:34 . 2008-12-24 01:34 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-24 01:34 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-24 01:34 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-24 01:22 . 2008-12-24 03:59 <REP> d-------- c:\program files\Trend Micro
2008-12-23 23:01 . 2008-12-23 23:01 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-12-23 23:01 . 2008-12-23 23:01 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-12-23 23:01 . 2008-12-23 23:01 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-12-23 23:00 . 2008-12-24 02:26 <REP> d-------- c:\windows\system32\drivers\Avg
2008-12-23 23:00 . 2008-12-23 23:00 <REP> d-------- c:\documents and settings\Emma\Application Data\AVGTOOLBAR
2008-12-23 14:27 . 2008-12-23 14:28 <REP> d-------- c:\program files\QuickTime
2008-12-22 21:31 . 2008-12-22 21:31 12,584 --ah----- c:\windows\system32\mlfcache.dat
2008-12-22 20:53 . 2008-12-22 20:53 <REP> d-------- c:\program files\Safari
2008-12-22 20:53 . 2008-12-22 20:53 <REP> d-------- c:\program files\Bonjour
2008-12-22 20:52 . 2008-12-22 20:52 <REP> d-------- c:\program files\Apple Software Update
2008-12-21 15:13 . 2008-12-21 15:13 0 --a------ c:\windows\nsreg.dat
2008-12-21 12:05 . 2008-12-21 12:05 <REP> d-------- c:\program files\Fichiers communs\Logitech
2008-12-21 12:05 . 2008-12-21 12:05 256 --a------ c:\windows\_delis32.ini
2008-12-21 12:04 . 2008-12-21 12:04 81,920 --------- c:\windows\bwUnin-6.1.4.68-8876480L.exe
2008-12-21 11:03 . 2008-12-21 11:03 <REP> d-------- c:\documents and settings\Emma\Application Data\FotoWire
2008-12-20 10:48 . 2008-12-20 10:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-12-20 09:19 . 2008-12-20 09:34 <REP> d-------- c:\program files\Windows Installer Clean Up(2)
2008-12-20 00:09 . 2008-12-20 09:35 <REP> d-------- c:\windows\system32\XPSViewer
2008-12-20 00:09 . 2008-12-20 00:09 <REP> d-------- c:\program files\Reference Assemblies
2008-12-20 00:09 . 2008-12-20 00:09 <REP> d-------- c:\program files\MSBuild
2008-12-19 21:39 . 2008-12-20 09:35 <REP> d-------- c:\program files\MSECACHE
2008-12-19 18:51 . 2008-12-19 18:51 <REP> d-------- c:\windows\system32\fr
2008-12-19 18:51 . 2008-12-19 18:51 <REP> d-------- c:\windows\system32\bits
2008-12-19 18:49 . 2008-12-19 18:49 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-19 18:49 . 2008-12-19 18:49 <REP> d-------- c:\documents and settings\All Users\Application Data\PassMark
2008-12-18 01:32 . 2008-12-20 09:37 <REP> d-------- c:\documents and settings\Emma\Tracing
2008-12-17 23:19 . 2008-12-17 23:19 <REP> d-------- c:\program files\Microsoft Silverlight
2008-12-17 23:18 . 2008-12-17 23:18 <REP> d-------- c:\program files\Microsoft Sync Framework
2008-12-17 23:17 . 2008-12-17 23:17 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition
2008-12-17 23:15 . 2008-12-17 23:15 <REP> d-------- c:\program files\Microsoft
2008-12-17 20:09 . 2008-12-17 20:09 <REP> d-------- c:\program files\Fichiers communs\Windows Live
2008-12-13 09:20 . 2008-12-21 14:24 <REP> d-------- c:\program files\PhotoFiltre
2008-12-12 16:40 . 2008-12-20 09:52 <REP> d-------- c:\program files\Messenger Plus! Live
2008-12-11 03:11 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-12-11 03:11 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-12-11 03:10 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-11 03:10 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-11 03:10 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-11 03:10 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-11 03:10 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-12-11 03:10 . 2008-04-11 20:05 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2008-12-11 03:10 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-11 03:10 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-12-11 03:10 . 2008-05-01 15:36 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2008-12-10 22:34 . 2008-12-10 22:34 <REP> d-------- c:\windows\l2schemas
2008-12-10 22:31 . 2008-12-10 22:34 <REP> d-------- c:\windows\ServicePackFiles
2008-12-10 21:35 . 2008-04-14 03:33 1,888,992 --------- c:\windows\system32\ati3duag.dll
2008-12-10 21:34 . 2008-04-14 03:33 377,984 --------- c:\windows\system32\ati2dvaa.dll
2008-12-10 19:39 . 2008-12-19 18:49 <REP> d-------- c:\program files\Opera
2008-12-02 22:37 . 2007-10-18 10:31 51,224 --a------ c:\windows\system32\sirenacm.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 22:00 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2008-12-23 19:57 --------- d-----w c:\program files\Logitech
2008-12-22 19:31 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-22 06:21 --------- d-----w c:\documents and settings\Emma\Application Data\LimeWire
2008-12-20 18:23 --------- d-----w c:\program files\LimeWire
2008-12-20 08:36 --------- d-----w c:\program files\MSN Messenger
2008-12-20 08:34 --------- d-----w c:\program files\Windows Live
2008-12-20 07:34 --------- d-----w c:\documents and settings\Emma\Application Data\EoRezo
2008-12-19 20:06 --------- d-----w c:\program files\EoRezo
2008-12-19 17:49 --------- d-----w c:\program files\Symantec
2008-12-19 17:49 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-12-19 17:49 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-23 19:12 --------- d-----w c:\documents and settings\Emma\Application Data\Creative
2008-11-23 18:52 --------- d-----w c:\program files\Creative
2008-11-23 18:52 --------- d-----w c:\documents and settings\All Users\Application Data\Creative
2008-11-23 18:51 --------- d-----w c:\program files\Audible
2008-11-23 18:49 --------- d--h--w c:\documents and settings\All Users\Application Data\{C39CADE8-EC32-4A3E-ADF3-99FB5B7A317D}
2008-11-23 18:48 --------- d--h--w c:\documents and settings\All Users\Application Data\{90F3B5EB-A471-42F9-A905-991C2DB2312C}
2008-10-26 09:52 625,664 ----a-w C:\iexplore.exe
2008-10-26 09:42 27,136 ----a-w C:\A0080469.exe
2008-10-26 09:29 69,120 ----a-w c:\windows\system32\iedw.exe
2008-10-26 09:28 60,416 ----a-w c:\windows\system32\hmmapi.dll
2008-10-26 09:18 883 ----a-w c:\program files\setup.ini
2008-10-26 09:18 535,552 ----a-w c:\program files\A0017645.dll
2008-10-26 09:18 473 ----a-w c:\program files\layout.bin
2008-10-26 09:18 372,736 ----a-w c:\program files\A0017647.exe
2008-10-26 09:18 332,744 ----a-w c:\program files\A0017646.dll
2008-10-26 09:18 222,820 ----a-w c:\program files\setup.inx
2008-10-26 09:17 43,720 ----a-w c:\program files\data1.hdr
2008-10-26 09:17 3,537,775 ----a-w c:\program files\data1.cab
2008-10-26 08:56 --------- d-----w c:\program files\Motive
2008-10-25 09:27 --------- d-----w c:\documents and settings\Emma\Application Data\Samsung
2008-10-24 20:20 --------- d-----w c:\program files\PROXY
2008-10-24 20:11 7,761 ----a-w c:\program files\proxy_bb_cm[1].htm
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:18 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-05 11:08 2,381 ----a-w c:\program files\Microsoft Office PowerPoint 2003.lnk
2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-01 17:48 2,551 ----a-w c:\program files\Microsoft Office Excel 2003.lnk
2008-10-01 17:46 2,573 ----a-w c:\program files\Microsoft Office Word 2003.lnk
2008-10-01 17:46 2,437 ----a-w c:\program files\Microsoft Office Picture Manager.lnk
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-08-10 11:30 49,011,296 ----a-w c:\program files\avg_free_stf_eu_8_138a1332.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2004-06-01 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HWSetup"="c:\program files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-05-01 28672]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-05-21 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-06-01 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-06-01 217088]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-23 1261336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 233472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= avgrsstx.dll ,

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.enc"= ITIG726.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TabUserW.exe.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\TabUserW.exe.lnk
backup=c:\windows\pss\TabUserW.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\WINDOWS
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\c:\windows\system32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
--a------ 2004-03-24 06:40 196608 c:\program files\Apoint2K\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
--a------ 2003-01-27 16:16 376912 c:\program files\BroadJump\Client Foundation\CFD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CeEKEY]
--a------ 2006-04-12 15:31 638976 c:\program files\TOSHIBA\E-KEY\CeEKey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 03:33 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDWMon]
--a------ 2006-04-28 10:38 262144 c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:34 64512 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EOUApp]
--a------ 2005-11-28 10:47 569413 c:\program files\Intel\Wireless\Bin\EOUWiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2006-02-07 16:36 77824 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2006-02-07 16:40 118784 c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 2006-02-07 16:39 94208 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
--a------ 2005-11-28 11:41 602182 c:\program files\Intel\Wireless\Bin\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
--a------ 2005-12-05 12:37 667718 c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LtMoh]
--------- 2006-03-03 18:51 184320 c:\program files\ltmoh\ltmoh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
--a------ 2004-05-21 18:11 221184 c:\windows\system32\LVCOMSX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 22:37 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
--a------ 2005-05-17 08:24 118784 c:\program files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SNPSTD2]
-ra------ 2004-08-30 17:37 286720 c:\windows\vsnpstd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SVPWUTIL]
--a------ 2004-05-01 12:45 65536 c:\program files\TOSHIBA\Windows Utilities\SVPWUTIL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
--a------ 2005-04-11 15:08 65536 c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPNF]
--a------ 2006-04-04 13:57 53248 c:\program files\TOSHIBA\TouchPad\TPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]
--a------ 2006-02-02 12:11 73728 c:\program files\TOSHIBA\Tvs\TvsTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a------ 2006-03-03 18:51 88204 c:\windows\agrsmmsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-04 02:43 69632 c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2006-04-17 23:34 16143872 c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TCtryIOHook]
--a------ 2006-01-03 15:11 28672 c:\windows\system32\TCtrlIOHook.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
--a------ 2005-08-12 10:14 266240 c:\windows\system32\TPSMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zooming]
--a------ 2005-06-06 08:58 24576 c:\windows\system32\ZoomingHook.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ccProxy"=2 (0x2)
"ccSetMgr"=2 (0x2)
"ccISPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"NSCService"=3 (0x3)
"navapsvc"=2 (0x2)
"x10nets"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"Symantec Core LC"=2 (0x2)
"SPBBCSvc"=2 (0x2)
"SNDSrvc"=2 (0x2)
"SAVScan"=3 (0x3)
"ose"=3 (0x3)
"Bonjour Service"=2 (0x2)
"TODDSrv"=2 (0x2)
"CTUPnPSv"=3 (0x3)
"CTDevice_Srv"=2 (0x2)
"comHost"=3 (0x3)
"CFSvcs"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=
"c:\\WINDOWS\\system32\\regsvr32.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\WINDOWS\\ehome\\ehrecvr.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\S24EvMon.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Fichiers communs\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-12-23 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-23 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-23 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-12-23 76040]
R2 NwSapAgent;Agent SAP;c:\windows\system32\svchost.exe -k netsvcs [2006-09-21 14336]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\DRIVERS\tdudf.sys [2006-04-18 98816]
R3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-09-22 7040]
S0 Vmx46;Vmx46; []
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
S4 CTUPnPSv;Creative Centrale Media Server;c:\program files\Creative\Creative Centrale\CTUPnPSv.exe [2008-05-21 64000]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dfcf934-234c-11dc-8af1-0016d42cb66b}]
\Shell\AutoRun\command - setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a79aa4fe-63ac-11dd-8c21-0016d42cb66b}]
\Shell\AutoRun\command - F:\setupSNK.exe

*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'

2008-12-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

ShellIconOverlayIdentifiers-{EA3775F2-28BE-11D3-9C8D-00105A24ED29} - (no file)
ShellIconOverlayIdentifiers-{E4000AC4-5E5F-4956-807A-C5854405D64F} - %SystemRoot%\system32\VirtualExpander\VEShellExt.dll
HKLM-Run-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
HKLM-Run-IJNetworkScanUtility - c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
HKLM-Run-CanalPlayerHelper - c:\program files\Lecteur CANALPLAY\CanalPlayerHelper.exe
MSConfigStartUp-kdbkr - c:\windows\system32\kdbkr.exe
MSConfigStartUp-ccApp - c:\program files\Fichiers communs\Symantec Shared\ccApp.exe
MSConfigStartUp-Club-Internet_McciTrayApp - c:\program files\Club-Internet\Agent Wi-Fi V2.1\McciTrayApp.exe
MSConfigStartUp-dashregsshowsave - c:\documents and settings\All Users\Application Data\warnblehdashregs\hope window.exe
MSConfigStartUp-IS CfgWiz - c:\program files\Norton Internet Security\cfgwiz.exe
MSConfigStartUp-lphc3uvj0ejdl - c:\windows\system32\lphc3uvj0ejdl.exe
MSConfigStartUp-OpwareSE4 - c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
MSConfigStartUp-PadTouch - c:\program files\TOSHIBA\Touch and Launch\PadExe.exe
MSConfigStartUp-qqmiq - c:\windows\system32\qqmiq.exe
MSConfigStartUp-slow list - c:\docume~1\Emma\APPLIC~1\FACEAB~1\Deadcreative.exe
MSConfigStartUp-SMrhc7uvj0ejdl - c:\program files\rhc7uvj0ejdl\rhc7uvj0ejdl.exe
MSConfigStartUp-SSBkgdUpdate - c:\program files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe
MSConfigStartUp-SSC_UserPrompt - c:\program files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
MSConfigStartUp-Veoh - c:\program files\Veoh Networks\Veoh\VeohClient.exe
MSConfigStartUp-WOOKIT - c:\progra~1\Wanadoo\GestMaj.exe
MSConfigStartUp-CFSServ - CFSServ.exe
MSConfigStartUp-NDSTray - NDSTray.exe
MSConfigStartUp-TFncKy - TFncKy.exe


.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZJYYYYYYYYFR&fl=0&ptb=2X7_3fpKMLZ2DVCLnRx96w&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms}
uInternet Settings,ProxyOverride = localhost;*.local

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-24 04:22:04
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(884)
c:\windows\system32\avgrsstx.dll

- - - - - - - > 'lsass.exe'(996)
c:\windows\system32\avgrsstx.dll
.
Heure de fin: 2008-12-24 4:23:02
ComboFix-quarantined-files.txt 2008-12-24 03:22:42

Avant-CF: 27 731 304 448 octets libres
Après-CF: 27,813,257,216 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

345 --- E O F --- 2008-12-11 07:05:34
0
Réponse 39 / 62
Utilisateur anonyme
 
Re,

1. Fermez tous les navigateurs ouverts.

2. Fermez/désactivez tous les programmes anti-virus, anti-malware ou anti-spyware afin qu'ils n'interfèrent pas avec le travail de ComboFix.

3. Ouvrez le Bloc-notes et faites un copier/coller du texte en gras situé dans la boîte Citation ci-dessous dans le Bloc-notes:


File::
c:\documents and settings\emma\application data\funwebproducts\data\emma\avatar.dat
c:\documents and settings\emma\application data\funwebproducts\data\emma\register.dat
c:\windows\_delis32.ini



Enregistrez le fichier sous le nom CFScript.txt, au même endroit que ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif


Comme sur l'image ci-dessus, faites glisser CFScript puis déposez-le sur ComboFix.exe

Lorsque l'outil aura terminé, il vous affichera un rapport nommé C:\ComboFix.txt que vous devez m'envoyer dans votre prochain message.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Ensuite tu redémarre ton PC et tu refait un log avec RSIT et tu le poste en deux fois le rapport STP.

A++
0
Réponse 40 / 62
A.u.d.r.e.y Messages postés 34 Date d'inscription   Statut Membre Dernière intervention  
 
ComboFix 08-12-23.01 - Emma 2008-12-24 4:38:26.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1014.508 [GMT 1:00]
Lancé depuis: c:\documents and settings\Emma\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\CFScript.txt
* Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((( Fichiers créés du 2008-11-24 au 2008-12-24 ))))))))))))))))))))))))))))))))))))
.

2008-12-24 03:58 . 2008-12-24 03:59 <REP> d-------- C:\rsit
2008-12-24 01:34 . 2008-12-24 02:05 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-24 01:34 . 2008-12-24 01:34 <REP> d-------- c:\documents and settings\Emma\Application Data\Malwarebytes
2008-12-24 01:34 . 2008-12-24 01:34 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-24 01:34 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-24 01:34 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-24 01:22 . 2008-12-24 03:59 <REP> d-------- c:\program files\Trend Micro
2008-12-23 23:01 . 2008-12-23 23:01 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-12-23 23:01 . 2008-12-23 23:01 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-12-23 23:01 . 2008-12-23 23:01 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-12-23 23:00 . 2008-12-24 02:26 <REP> d-------- c:\windows\system32\drivers\Avg
2008-12-23 23:00 . 2008-12-23 23:00 <REP> d-------- c:\documents and settings\Emma\Application Data\AVGTOOLBAR
2008-12-23 14:27 . 2008-12-23 14:28 <REP> d-------- c:\program files\QuickTime
2008-12-22 21:31 . 2008-12-22 21:31 12,584 --ah----- c:\windows\system32\mlfcache.dat
2008-12-22 20:53 . 2008-12-22 20:53 <REP> d-------- c:\program files\Safari
2008-12-22 20:53 . 2008-12-22 20:53 <REP> d-------- c:\program files\Bonjour
2008-12-22 20:52 . 2008-12-22 20:52 <REP> d-------- c:\program files\Apple Software Update
2008-12-21 15:13 . 2008-12-21 15:13 0 --a------ c:\windows\nsreg.dat
2008-12-21 12:05 . 2008-12-21 12:05 <REP> d-------- c:\program files\Fichiers communs\Logitech
2008-12-21 12:05 . 2008-12-21 12:05 256 --a------ c:\windows\_delis32.ini
2008-12-21 12:04 . 2008-12-21 12:04 81,920 --------- c:\windows\bwUnin-6.1.4.68-8876480L.exe
2008-12-21 11:03 . 2008-12-21 11:03 <REP> d-------- c:\documents and settings\Emma\Application Data\FotoWire
2008-12-20 10:48 . 2008-12-20 10:48 <REP> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-12-20 09:19 . 2008-12-20 09:34 <REP> d-------- c:\program files\Windows Installer Clean Up(2)
2008-12-20 00:09 . 2008-12-20 09:35 <REP> d-------- c:\windows\system32\XPSViewer
2008-12-20 00:09 . 2008-12-20 00:09 <REP> d-------- c:\program files\Reference Assemblies
2008-12-20 00:09 . 2008-12-20 00:09 <REP> d-------- c:\program files\MSBuild
2008-12-19 21:39 . 2008-12-20 09:35 <REP> d-------- c:\program files\MSECACHE
2008-12-19 18:51 . 2008-12-19 18:51 <REP> d-------- c:\windows\system32\fr
2008-12-19 18:51 . 2008-12-19 18:51 <REP> d-------- c:\windows\system32\bits
2008-12-19 18:49 . 2008-12-19 18:49 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-19 18:49 . 2008-12-19 18:49 <REP> d-------- c:\documents and settings\All Users\Application Data\PassMark
2008-12-18 01:32 . 2008-12-20 09:37 <REP> d-------- c:\documents and settings\Emma\Tracing
2008-12-17 23:19 . 2008-12-17 23:19 <REP> d-------- c:\program files\Microsoft Silverlight
2008-12-17 23:18 . 2008-12-17 23:18 <REP> d-------- c:\program files\Microsoft Sync Framework
2008-12-17 23:17 . 2008-12-17 23:17 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition
2008-12-17 23:15 . 2008-12-17 23:15 <REP> d-------- c:\program files\Microsoft
2008-12-17 20:09 . 2008-12-17 20:09 <REP> d-------- c:\program files\Fichiers communs\Windows Live
2008-12-13 09:20 . 2008-12-21 14:24 <REP> d-------- c:\program files\PhotoFiltre
2008-12-12 16:40 . 2008-12-20 09:52 <REP> d-------- c:\program files\Messenger Plus! Live
2008-12-11 03:11 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-12-11 03:11 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-12-11 03:10 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-11 03:10 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-11 03:10 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-11 03:10 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-11 03:10 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-12-11 03:10 . 2008-04-11 20:05 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2008-12-11 03:10 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-11 03:10 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-12-11 03:10 . 2008-05-01 15:36 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2008-12-10 22:34 . 2008-12-10 22:34 <REP> d-------- c:\windows\l2schemas
2008-12-10 22:31 . 2008-12-10 22:34 <REP> d-------- c:\windows\ServicePackFiles
2008-12-10 21:35 . 2008-04-14 03:33 1,888,992 --------- c:\windows\system32\ati3duag.dll
2008-12-10 21:34 . 2008-04-14 03:33 377,984 --------- c:\windows\system32\ati2dvaa.dll
2008-12-10 19:39 . 2008-12-19 18:49 <REP> d-------- c:\program files\Opera
2008-12-02 22:37 . 2007-10-18 10:31 51,224 --a------ c:\windows\system32\sirenacm.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 22:00 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2008-12-23 19:57 --------- d-----w c:\program files\Logitech
2008-12-22 19:31 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-22 06:21 --------- d-----w c:\documents and settings\Emma\Application Data\LimeWire
2008-12-20 18:23 --------- d-----w c:\program files\LimeWire
2008-12-20 08:36 --------- d-----w c:\program files\MSN Messenger
2008-12-20 08:34 --------- d-----w c:\program files\Windows Live
2008-12-20 07:34 --------- d-----w c:\documents and settings\Emma\Application Data\EoRezo
2008-12-19 20:06 --------- d-----w c:\program files\EoRezo
2008-12-19 17:49 --------- d-----w c:\program files\Symantec
2008-12-19 17:49 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-12-19 17:49 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-23 19:12 --------- d-----w c:\documents and settings\Emma\Application Data\Creative
2008-11-23 18:52 --------- d-----w c:\program files\Creative
2008-11-23 18:52 --------- d-----w c:\documents and settings\All Users\Application Data\Creative
2008-11-23 18:51 --------- d-----w c:\program files\Audible
2008-11-23 18:49 --------- d--h--w c:\documents and settings\All Users\Application Data\{C39CADE8-EC32-4A3E-ADF3-99FB5B7A317D}
2008-11-23 18:48 --------- d--h--w c:\documents and settings\All Users\Application Data\{90F3B5EB-A471-42F9-A905-991C2DB2312C}
2008-10-26 09:52 625,664 ----a-w C:\iexplore.exe
2008-10-26 09:42 27,136 ----a-w C:\A0080469.exe
2008-10-26 09:29 69,120 ----a-w c:\windows\system32\iedw.exe
2008-10-26 09:28 60,416 ----a-w c:\windows\system32\hmmapi.dll
2008-10-26 09:18 883 ----a-w c:\program files\setup.ini
2008-10-26 09:18 535,552 ----a-w c:\program files\A0017645.dll
2008-10-26 09:18 473 ----a-w c:\program files\layout.bin
2008-10-26 09:18 372,736 ----a-w c:\program files\A0017647.exe
2008-10-26 09:18 332,744 ----a-w c:\program files\A0017646.dll
2008-10-26 09:18 222,820 ----a-w c:\program files\setup.inx
2008-10-26 09:17 43,720 ----a-w c:\program files\data1.hdr
2008-10-26 09:17 3,537,775 ----a-w c:\program files\data1.cab
2008-10-26 08:56 --------- d-----w c:\program files\Motive
2008-10-25 09:27 --------- d-----w c:\documents and settings\Emma\Application Data\Samsung
2008-10-24 20:20 --------- d-----w c:\program files\PROXY
2008-10-24 20:11 7,761 ----a-w c:\program files\proxy_bb_cm[1].htm
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:18 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-05 11:08 2,381 ----a-w c:\program files\Microsoft Office PowerPoint 2003.lnk
2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-01 17:48 2,551 ----a-w c:\program files\Microsoft Office Excel 2003.lnk
2008-10-01 17:46 2,573 ----a-w c:\program files\Microsoft Office Word 2003.lnk
2008-10-01 17:46 2,437 ----a-w c:\program files\Microsoft Office Picture Manager.lnk
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-08-10 11:30 49,011,296 ----a-w c:\program files\avg_free_stf_eu_8_138a1332.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2004-06-01 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HWSetup"="c:\program files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-05-01 28672]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-05-21 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-06-01 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-06-01 217088]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-23 1261336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 233472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= avgrsstx.dll ,

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.enc"= ITIG726.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TabUserW.exe.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\TabUserW.exe.lnk
backup=c:\windows\pss\TabUserW.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
--a------ 2004-03-24 06:40 196608 c:\program files\Apoint2K\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
--a------ 2003-01-27 16:16 376912 c:\program files\BroadJump\Client Foundation\CFD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CeEKEY]
--a------ 2006-04-12 15:31 638976 c:\program files\TOSHIBA\E-KEY\CeEKey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 03:33 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDWMon]
--a------ 2006-04-28 10:38 262144 c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:34 64512 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EOUApp]
--a------ 2005-11-28 10:47 569413 c:\program files\Intel\Wireless\Bin\EOUWiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2006-02-07 16:36 77824 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2006-02-07 16:40 118784 c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 2006-02-07 16:39 94208 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
--a------ 2005-11-28 11:41 602182 c:\program files\Intel\Wireless\Bin\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
--a------ 2005-12-05 12:37 667718 c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LtMoh]
--------- 2006-03-03 18:51 184320 c:\program files\ltmoh\ltmoh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
--a------ 2004-05-21 18:11 221184 c:\windows\system32\LVCOMSX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 22:37 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
--a------ 2005-05-17 08:24 118784 c:\program files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SNPSTD2]
-ra------ 2004-08-30 17:37 286720 c:\windows\vsnpstd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SVPWUTIL]
--a------ 2004-05-01 12:45 65536 c:\program files\TOSHIBA\Windows Utilities\SVPWUTIL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
--a------ 2005-04-11 15:08 65536 c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPNF]
--a------ 2006-04-04 13:57 53248 c:\program files\TOSHIBA\TouchPad\TPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]
--a------ 2006-02-02 12:11 73728 c:\program files\TOSHIBA\Tvs\TvsTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a------ 2006-03-03 18:51 88204 c:\windows\agrsmmsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-04 02:43 69632 c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2006-04-17 23:34 16143872 c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TCtryIOHook]
--a------ 2006-01-03 15:11 28672 c:\windows\system32\TCtrlIOHook.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
--a------ 2005-08-12 10:14 266240 c:\windows\system32\TPSMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zooming]
--a------ 2005-06-06 08:58 24576 c:\windows\system32\ZoomingHook.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ccProxy"=2 (0x2)
"ccSetMgr"=2 (0x2)
"ccISPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"NSCService"=3 (0x3)
"navapsvc"=2 (0x2)
"x10nets"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"Symantec Core LC"=2 (0x2)
"SPBBCSvc"=2 (0x2)
"SNDSrvc"=2 (0x2)
"SAVScan"=3 (0x3)
"ose"=3 (0x3)
"Bonjour Service"=2 (0x2)
"TODDSrv"=2 (0x2)
"CTUPnPSv"=3 (0x3)
"CTDevice_Srv"=2 (0x2)
"comHost"=3 (0x3)
"CFSvcs"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=
"c:\\WINDOWS\\system32\\regsvr32.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\WINDOWS\\ehome\\ehrecvr.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\S24EvMon.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Fichiers communs\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-12-23 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-23 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-23 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-12-23 76040]
R2 NwSapAgent;Agent SAP;c:\windows\system32\svchost.exe -k netsvcs [2006-09-21 14336]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\DRIVERS\tdudf.sys [2006-04-18 98816]
R3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-09-22 7040]
S0 Vmx46;Vmx46; []
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
S4 CTUPnPSv;Creative Centrale Media Server;c:\program files\Creative\Creative Centrale\CTUPnPSv.exe [2008-05-21 64000]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dfcf934-234c-11dc-8af1-0016d42cb66b}]
\Shell\AutoRun\command - setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a79aa4fe-63ac-11dd-8c21-0016d42cb66b}]
\Shell\AutoRun\command - F:\setupSNK.exe

*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'

2008-12-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZJYYYYYYYYFR&fl=0&ptb=2X7_3fpKMLZ2DVCLnRx96w&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms}
uInternet Settings,ProxyOverride = localhost;*.local

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-24 04:39:19
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(884)
c:\windows\system32\avgrsstx.dll

- - - - - - - > 'lsass.exe'(996)
c:\windows\system32\avgrsstx.dll
.
Heure de fin: 2008-12-24 4:40:18
ComboFix-quarantined-files.txt 2008-12-24 03:40:00
ComboFix2.txt 2008-12-24 03:23:03

Avant-CF: 27 808 636 928 octets libres
Après-CF: 27,794,296,832 octets libres

302 --- E O F --- 2008-12-11 07:05:34
0