Trojan / Zlob? / ...

Résolu

Desperate internaute -
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention - 28 déc. 2008 à 02:01

Bonjour,

J ai Norton 360
A chaque fois que j ouvre internet explorer - Norton se desactive et il me dit qu une Identy Fraud est possible
Evidemment le scan de Norton 360 ne voit rien ni meme Windows Defender
Par contre Malware me dit que j ai Zlob
Je delete alors Zlob avec Malware et je peux utiliser tout programme sans que Malware ne trouve a nouveau qqchose
SAUF si j ouvre internet explorer
Dans ce cas Norton 360 se desactive et Malware trouve Zlob
C est comme si l ouverture d Internet Explorer infectait une cle de registre et creait une alerte 'Zlob' de la part de Malware
Autre remarque
Spyware fait la meme chose mais avec d autre trojans
Je commence a etre inquiet comme je n arrive pas a identifier ce qui infecte mon ordi
Un technicien de Norton a passe 3 heure sur mon ordi pour me dire qu il ne voyait rien
Any suggestion? Pls help
Merci d avance,

Configuration: Windows Vista
Safari 525.27.1

Afficher la suite

A voir également:

Trojan / Zlob? / ...
Anti trojan - Télécharger - Antivirus & Antimalwares
Trojan remover - Télécharger - Antivirus & Antimalwares
Trojan killer - Télécharger - Antivirus & Antimalwares
Trojan powershell - Guide
Que pensez-vous de Trojan Remover ? ✓ - Forum Virus

29 réponses

Résumé de la discussion

Le problème central est que l'ouverture d'Internet Explorer déclenche la désactivation de Norton 360 et l'apparition d'une alerte d'identité, alors que Zlob est détecté par des outils externes mais pas par Windows Defender. Des solutions proposées incluent la désactivation temporaire de l'UAC pour faciliter la désinfection et l'utilisation d'outils comme UsbFix en mode administrateur, puis un redémarrage après vérification. Le procédé préconisé recommande ensuite un balayage complémentaire avec MBAM et la restitution d'un rapport pour identifier les éléments persistants, tout en évitant d'exposer le système à des sources externes non vérifiées. En complément, certains suivis incluent l'analyse des paramètres du navigateur et des programmes au démarrage pour déceler des extensions indésirables et des clés de registre modifiées.

Réponse 1 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

C'est moi qui suit débile, j'ai oublié certaines choses.

---> Désactive l'UAC le temps de la désinfection :
http://www.commentcamarche.net/faq/sujet 8343 vista desactiver l uac

--> Télécharge UsbFix (de Chiquitine29) sur ton Bureau :
http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

--> Lance l'installation avec les paramètres par défaut.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir.

--> Clique droit sur le raccourci UsbFix situé sur ton Bureau et Exécuter en tant qu'administrateur.

--> Choisis l'option 1 (Nettoyage).

--> Le PC va redémarrer.

--> Après redémarrage, poste le rapport UsbFix.txt

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque.

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide)
1
1. Desperate internaute
  
  Ca a marche
  
  * Outils mis a jours le 24/12/2008 par Chiquitine29 et Chimay8
  * Recherche effectuée à 2:20:47 le 24/12/2008
  * Windows Vista - Internet Explorer 8.0.6001.18241
  
  --------------- [ Processus actifs ] ----------------
  
  C:\Windows\System32\smss.exe
  C:\Windows\system32\csrss.exe
  C:\Windows\system32\wininit.exe
  C:\Windows\system32\csrss.exe
  C:\Windows\system32\services.exe
  C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsm.exe
  C:\Windows\system32\winlogon.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\LogonUI.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\SLsvc.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\System32\spoolsv.exe
  C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  C:\Windows\system32\svchost.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\Windows\system32\svchost.exe
  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  C:\Windows\system32\userinit.exe
  C:\Windows\system32\Dwm.exe
  C:\Windows\Explorer.EXE
  C:\Windows\system32\taskeng.exe
  C:\Program Files\RegTool\RegTool.exe
  C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe
  C:\Windows\system32\runonce.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\stacsv.exe
  C:\Windows\system32\taskeng.exe
  C:\Windows\system32\svchost.exe
  C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
  C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
  C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
  C:\Windows\system32\conime.exe
  
  --------------- [ Informations lecteurs ] ----------------
  
  C: - Lecteur fixe
  
  --------------- [ Lecteur C ] ----------------
  
  C: - Lecteur fixe
  
  +- Listing des fichiers présents :
  
  [18/09/2006 21:43][--a------] C:\autoexec.bat
  [24/12/2008 01:30][--a------] C:\rapport.txt
  [24/12/2008 01:30][--a------] C:\UsbFix.txt
  [18/09/2006 21:43][--a------] C:\config.sys
  [18/09/2006 21:43][--a------] C:\hiberfil.sys
  [18/09/2006 21:43][--a------] C:\IO.SYS
  [18/09/2006 21:43][--a------] C:\MSDOS.SYS
  [18/09/2006 21:43][--a------] C:\pagefile.sys
  
  --------------- [ Registre / Startup ] ----------------
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  "Userinit"="C:\\Windows\\system32\\userinit.exe"
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
  "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
  MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  WMPNSCFG=C:\Program Files\Windows Media Player\WMPNSCFG.exe
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
  Windows Defender=%ProgramFiles%\Windows Defender\MSASCui.exe -hide
  Apoint=C:\Program Files\Apoint\Apoint.exe
  ISBMgr.exe="C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
  Google Desktop Search="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
  Norton Save and Restore 2.0="C:\Program Files\Norton Save and Restore\Agent\VProTray.exe"
  SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
  Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  AppleSyncNotifier=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
  ccApp="C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  osCheck="C:\Program Files\Norton 360\osCheck.exe"
  NvSvc=RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
  NvCplDaemon=RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
  NvMediaCenter=RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
  TrojanScanner=C:\Program Files\Trojan Remover\Trjscan.exe /boot
  QuickTime Task="C:\Program Files\QuickTime\QTTask.exe" -atboottime
  iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
  <NO NAME>=
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
  Installed=1
  <NO NAME>=
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
  NoChange=1
  Installed=1
  <NO NAME>=
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
  Installed=1
  <NO NAME>=
  
  --------------- [ Registre / Mountpoint2 ] ----------------
  
  Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20d0ef7c-922c-11dc-9ff5-806e6f6e6963}\Shell\AutoRun\command
  
  --------------- [ Nettoyage des disques ] ----------------
  
  Supprimé ! - [12/12/2008 00:57][--a------] C:\Windows\system32\Agent.OMZ.Fix.exe
  Supprimé ! - [31/07/2004 17:50][--a------] C:\Windows\system32\dumphive.exe
  Supprimé ! - [20/09/2008 11:45][--a------] C:\Windows\system32\o4Patch.exe
  Supprimé ! - [05/06/2003 20:13][--a------] C:\Windows\system32\Process.exe
  Supprimé ! - [27/04/2006 16:49][--a------] C:\Windows\system32\SrchSTS.exe
  Supprimé ! - [29/08/2006 18:43][--a------] C:\Windows\system32\swreg.exe
  Supprimé ! - [09/01/2006 09:36][--a------] C:\Windows\system32\swsc.exe
  Supprimé ! - [01/12/2006 05:20][--a------] C:\Windows\system32\swxcacls.exe
  Supprimé ! - [24/12/2008 01:24][--a------] C:\Windows\system32\tmp.reg
  Supprimé ! - [24/12/2008 01:24][--a------] C:\Windows\system32\tmp.txt
  Supprimé ! - [01/10/2008 14:51][--a------] C:\Windows\system32\VACFix.exe
  Supprimé ! - [05/09/2007 23:22][--a------] C:\Windows\system32\VCCLSID.exe
  Supprimé ! - [03/10/2007 23:36][--a------] C:\Windows\system32\WS2Fix.exe
  
  --------------- [ Resumé ] ----------------
  
  -> /!\ Le resultat doit etre interprété par un spécialiste /!\
  
  [18/09/2006 21:43][--a------] C:\autoexec.bat
  
  Joyeuses fetes a tous de la part de T'Chiki et Chimay ...et merci a toutes les personnes ayant,
  de pret ou de loin participé a UsbFix durant l annee 2008 , merci a eux !
  
  --------------- ! Fin du rapport ! ----------------
  
  0
Réponse 2 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

C'est le créateur d'UsbFix ;)
1
Réponse 3 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

Salut,

- Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

- Double-clique sur RSIT.exe afin de lancer le programme.

- Clique sur Continue à l'écran Disclaimer.

- Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : Les rapports sont sauvegardés dans le dossier C:\rsit.
0
1. Desperate internaute
  
  info.txt logfile of random's system information tool 1.05 2008-12-24 00:30:39
  
  ======Uninstall list======
  
  -->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
  -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
  -->C:\Program Files\InstallShield Installation Information\{AFBA0609-EB70-43CB-B11C-294EDADFA101}\setup.exe -runfromtemp -l0x040c -removeonly
  -->MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF}
  -->MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87}
  -->MsiExec.exe /I{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}
  -->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
  -->MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
  -->MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82}
  -->MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
  Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
  Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
  Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
  Adobe Flash Player 9 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
  Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
  Alps Pointing-device for VAIO-->C:\Program Files\Apoint\Uninstap.exe ADDREMOVE
  AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
  Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
  Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
  ArcSoft Magic-i Visual Effects Installer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9AB83A3C-604D-4B4F-AA25-A23A3FC39844}\Setup.exe" -l0x40c
  Atlantis - Sky Patrol -->C:\Big Fish Games\Atlantis - Sky Patrol\Uninstall.exe
  Backup-->MsiExec.exe /I{24DF7221-644B-4C3A-A478-459502D40522}
  Big Fish Games Sudoku-->C:\Big Fish Games\sudoku\Uninstall.exe
  Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
  Browser Address Error Redirector-->regsvr32 /u /s "C:\PROGRA~1\GOOGLE~1\BAE.dll"
  BT Broadband Talk Softphone 2.0-->"C:\Program Files\BT Broadband Talk Softphone\unins000.exe"
  BT Home Hub-->C:\Program Files\BT Home Hub\Uninstall.exe
  Caesar 3-->C:\Windows\IsUn040c.exe -fC:\SIERRA\Caesar3\Uninst.isu
  Canon Camera Support Core Library-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{5662C158-CA24-4228-BF6C-596FADA08682} /l1036
  Canon Camera Window DS for ZoomBrowser EX-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{7B847C9D-6758-45E6-B598-3BD8F43EAE9E}
  Canon Camera Window DVC for ZoomBrowser EX-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{A70D14C6-FF2C-4B8E-A643-7E74EC607614}
  Canon Camera Window for ZoomBrowser EX-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{E73534D5-CC93-4C63-9072-5A9734255C74}
  Canon Internet Library for ZoomBrowser EX-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{954BF446-BBC9-42CC-87A6-EBF0D55CA19A}
  Canon MovieEdit Task for ZoomBrowser EX-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{DEB416DB-4FA9-42B6-84D3-1E0081300C9E}
  Canon PhotoRecord-->MsiExec.exe /X{862983D7-FA08-493E-A9ED-6B7859E069D3}
  Canon RAW Image Task for ZoomBrowser EX-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{A0F34E4E-25F0-4B68-AE8F-EF0C15CB1FED}
  Canon RemoteCapture Task for ZoomBrowser EX-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{28291BD5-92D2-4685-82DC-CCA925C53CCA}
  Canon Utilities PhotoStitch-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\PhotoStitch\Uninst.ini"
  Canon ZoomBrowser EX-->MsiExec.exe /X{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}
  ccCommon-->MsiExec.exe /I{B24E05CC-46FF-4787-BBB8-5CD516AFB118}
  CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
  Centre de Big Fish Games-->C:\Big Fish Games\Uninstall.exe
  Click to DVD 2.0.05 Menu Data-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9E407618-D9CD-4F39-9490-9ED45294073D}\setup.exe" -l0x40c -removeonly
  Click to DVD 2.6.00-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E809063C-51A3-4269-8984-D1EB742F2151}\setup.exe" -l0x40c -removeonly
  DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
  DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
  DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
  DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
  DSD Direct Player-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{533D0A8A-D7E7-4F15-BC9E-FF2916A6BAA7}\setup.exe" -l0x40c -removeonly
  DSD Direct-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{82D5BACA-3619-4D34-99DB-3A65CFB4DA33}\setup.exe" -l0x40c -removeonly
  DSD Playback Plug-in-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{009E7FB7-1775-4D89-8956-F5C9A1C019FC}\setup.exe" -l0x40c -removeonly
  eMule-->"C:\Program Files\eMule\Uninstall.exe"
  GearDrvs-->MsiExec.exe /I{206FD69B-F9FE-4164-81BD-D52552BC9C23}
  Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
  Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
  Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
  HDAUDIO SoftV92 Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_104D0200\UIU32m.exe -U -ISnSZIRXz.inf
  HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
  iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
  Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
  Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
  Lecteur CANALPLAY 2.3-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E9E37358-E3E1-47BA-9E21-375EF3616BC9}\setup.exe" -l0x40c -removeonly
  LiveUpdate (Symantec Corporation)-->MsiExec.exe /x {E80F62FF-5D3C-4A19-8409-9721F2928206} /l*v "C:\ProgramData\LuUninstall.LiveUpdate"
  LiveUpdate (Symantec Corporation)-->MsiExec.exe /X{E80F62FF-5D3C-4A19-8409-9721F2928206}
  Mahjong Towers Eternity -->C:\Big Fish Games\Mahjong Towers Eternity\Uninstall.exe
  Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
  Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
  Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
  Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
  Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
  Microsoft Office OneNote MUI (French) 2007-->MsiExec.exe /X{90120000-00A1-040C-0000-0000000FF1CE}
  Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
  Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
  Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
  Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
  Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
  Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
  Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
  Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
  Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
  Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
  Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
  Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
  Microsoft Works-->MsiExec.exe /I{6B1CB38D-E2E4-4A30-933D-EFDEBA76AD9C}
  MobileMe Control Panel-->MsiExec.exe /I{2604C0F9-BFD3-4BA0-9EB5-22537C648F03}
  MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
  MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
  MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
  MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
  Mystery Case Files - Prime Suspects -->C:\Big Fish Games\Mystery Case Files - Prime Suspects\Uninstall.exe
  Norton 360 (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{2D617065-1C52-4240-B5BC-C0AE12157777}_2_0_0_242\Setup.exe" /X
  Norton 360 HTMLHelp-->MsiExec.exe /I{0BDD3FAD-61CD-4BF3-B9C4-4CEFD43F53F8}
  Norton 360-->MsiExec.exe /I{21829177-4DED-4209-AD08-490B3AC9C01A}
  Norton 360-->MsiExec.exe /I{2D617065-1C52-4240-B5BC-C0AE12157777}
  Norton 360-->MsiExec.exe /I{40DA9A54-48CA-4A2C-AEAF-F67715BB046E}
  Norton 360-->MsiExec.exe /I{63A6E9A9-A190-46D4-9430-2DB28654AFD8}
  Norton 360-->MsiExec.exe /I{F413B69D-4AD6-42AB-AEA5-0548989FAD50}
  Norton Confidential Core-->MsiExec.exe /I{55A6283C-638A-4EE0-B491-51118554BDA2}
  Norton Save and Restore-->MsiExec.exe /X{B0255743-165B-4BD5-8DA8-37DFB993B201}
  NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
  OpenMG Limited Patch 4.7-07-15-19-01-->C:\Program Files\Common Files\Sony Shared\OpenMG\HotFixes\HotFix4.7-07-15-19-01\HotFixSetup\setup.exe /u
  OpenMG Secure Module 4.7.00-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{CCD663AE-610D-4BDF-AAB0-E914B044527D} UNINSTALL
  Outil de restauration de données VAIO-->C:\Program Files\InstallShield Installation Information\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}\setup.exe -runfromtemp -l0x040c -removeonly
  Outil VAIO Media Registration 6.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AF9A04EB-7D8E-41DE-9EDE-4AB9BB2B71B6}\setup.exe" -l0x40c UNINSTALL -removeonly
  Picasa 2-->"C:\Program Files\Picasa2\Uninstall.exe"
  QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
  RegTool-->MsiExec.exe /X{0EF37BF2-CB61-4DB7-A02D-C52D58CCAB3F}
  Roxio Easy Media Creator Home-->MsiExec.exe /I{B7FB0C86-41A4-4402-9A33-912C462042A0}
  Safari-->MsiExec.exe /I{582D2A53-F426-4C5E-A2E6-43C1AB36B907}
  Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
  Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
  Security Update for 2007 Microsoft Office System (KB958439)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6491B8AA-D11C-4648-A461-6234B31EB7E2}
  Security Update for Microsoft Office Excel 2007 (KB958437)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {648FC016-2D6B-4A16-8D87-404533642F4B}
  Security Update for Microsoft Office OneNote 2007 (KB950130)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4}
  Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
  Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
  Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
  Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
  Security Update for Visio 2007 (KB947590)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
  Setting Utility Series-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}\setup.exe" -l0x40c -removeonly
  SigmaTel Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x40c -remove -removeonly
  Skype 3.2-->"C:\Program Files\Skype\Phone\unins000.exe"
  Skype Plugin Manager-->MsiExec.exe /I{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03}
  SonicStage Mastering Studio Audio Filter Custom Preset-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EC37A846-53AC-4DA7-98FA-76A4E74AA900}\setup.exe" -l0x40c -removeonly
  SonicStage Mastering Studio Audio Filter-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DF7DB916-90E5-40F2-9010-B8125EB5FD6F}\setup.exe" -l0x40c -removeonly
  SonicStage Mastering Studio Plugins-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9C1C8A04-F8CA-4472-A92D-4288CE32DE86}\setup.exe" -l0x40c -removeonly
  SonicStage Mastering Studio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6332AFF1-9D9A-429C-AA03-F82749FA4F49}\setup.exe" -l0x40c -removeonly
  Sony Video Shared Library-->C:\Program Files\InstallShield Installation Information\{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}\setup.exe -runfromtemp -l0x040c -removeonly
  SPBBC 32bit-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
  Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
  Spyware Doctor 6.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
  Symantec Real Time Storage Protection Component-->MsiExec.exe /I{D6E6FA4A-5445-4850-8365-CF216C1CBB7A}
  Symantec Technical Support Controls-->MsiExec.exe /I{45690715-80A6-4445-B61D-ADEC5888E8CD}
  Trojan Remover 6.7.4-->"C:\Program Files\Trojan Remover\unins000.exe"
  Update for Microsoft Office Excel 2007 Help (KB957242)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {49E314EE-81FA-4007-8F1A-8D39BDBB4498}
  Update for Office 2007 (KB946691)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
  Utilitaires Sierra-->C:\Program Files\Sierra On-Line\sutil32.exe uninstall
  VAIO Aqua Breeze Wallpaper-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{97BCD719-6ECB-458F-97D6-F38D2E07375E}\setup.exe" -l0x9 -removeonly
  VAIO Camera Capture Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6D2576EC-A0E9-418A-A09A-409933A3B6F4}\setup.exe" -l0x40c -removeonly
  VAIO Content Folder Setting-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{23825B69-36DF-4DAD-9CFD-118D11D80F16}\setup.exe" -l0x40c -removeonly
  VAIO Content Importer / VAIO Content Exporter-->C:\Program Files\InstallShield Installation Information\{68A69CFF-130D-4CDE-AB0E-7374ECB144C8}\setup.exe -runfromtemp -l0x040c -removeonly
  VAIO Content Metadata Intelligent Analyzing Manager-->C:\Program Files\InstallShield Installation Information\{FAA6B94E-78A7-489C-B2DB-050D9FEBFADA}\setup.exe -runfromtemp -l0x040c -removeonly
  VAIO Content Metadata Manager Setting-->C:\Program Files\InstallShield Installation Information\{69351E9E-23ED-41D5-B146-EDBF83C63B66}\setup.exe -runfromtemp -l0x040c -removeonly
  VAIO Content Metadata XML Interface Library-->C:\Program Files\InstallShield Installation Information\{5F5DE5D5-D130-4110-A3A4-69FFB0B14BD9}\setup.exe -runfromtemp -l0x040c -removeonly
  VAIO Control Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{72042FA6-5609-489F-A8EA-3C2DD650F667}\setup.exe" -l0x40c -removeonly
  VAIO Cozy Orange Wallpaper-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A2FF7F5-6F0E-4A5D-A881-39365E718BD6}\setup.exe" -l0x9 -removeonly
  VAIO Entertainment Platform-->C:\Program Files\InstallShield Installation Information\{6B1F20F2-6321-4669-A58C-33DF8E7517FF}\setup.exe -runfromtemp -l0x040c -removeonly
  VAIO Event Service-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0D85ADD-DD61-4B43-87A0-6DA52A211A8B}\setup.exe" -l0x40c -removeonly
  VAIO Launcher-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{15D5C238-4C2E-4AEA-A66D-D6989A4C586B}\setup.exe" -l0x40c -removeonly
  VAIO Media 6.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{560F6B2E-F0DF-44E5-8190-A4A161F0E205}\setup.exe" -l0x40c UNINSTALL -removeonly
  VAIO Media AC3 Decoder 1.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2063C2E8-3812-4BBD-9998-6610F80C1DD4}\Setup.exe" -l0x40c UNINSTALL
  VAIO Media Content Collection 6.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{500162A0-4DD5-460A-BAFD-895AAE48C532}\setup.exe" -l0x40c UNINSTALL -removeonly
  VAIO Media Integrated Server 6.1-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{785EB1D4-ECEC-4195-99B4-73C47E187721}\setup.exe" -l0x40c UNINSTALL -removeonly
  VAIO Media Redistribution 6.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5855C127-1F20-404D-B7FB-1FD84D7EAB5E}\setup.exe" -l0x40c UNINSTALL -removeonly
  VAIO Movie Story Template Data-->C:\Program Files\InstallShield Installation Information\{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}\setup.exe -runfromtemp -l0x040c -removeonly
  VAIO Movie Story-->C:\Program Files\InstallShield Installation Information\{B25563A0-41F4-4A81-A6C1-6DBC0911B1F3}\setup.exe -runfromtemp -l0x040c -removeonly
  VAIO MusicBox Sample Music-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98FC7A64-774B-49B5-B046-4B4EBC053FA9}\setup.exe" -l0x40c -removeonly
  VAIO MusicBox-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4EA55D20-27FB-45D7-8726-147E8A5F6C62}\setup.exe" -l0x40c -removeonly
  VAIO Original Function Setting-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A63E7492-A0BC-4BB9-89A7-352965222380}\setup.exe" -l0x40c -removeonly
  VAIO Original Screen Saver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1BEF9285-5530-426B-A5F1-5836B95C7EB1}\Setup.exe" -l0x40c
  VAIO Power Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{802889F8-6AF5-45A5-9764-CA5B999E50FC}\setup.exe" -l0x40c -removeonly
  VAIO Tender Green Wallpaper-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{934A3213-1CB6-4264-84A2-EE080C017BCA}\setup.exe" -l0x9 -removeonly
  VAIO Update 3-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{48820099-ED7D-424B-890C-9A82EF00656D}\setup.exe" -l0x40c -removeonly
  Virtual Villagers -->C:\Big Fish Games\Virtual Villagers\Uninstall.exe
  WIDCOMM Bluetooth Software 6.1.0.1203-->MsiExec.exe /X{03D1988F-469F-4843-8E6E-E5FE9D17889D}
  Windows Live installer-->MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
  Windows Live Messenger-->MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
  Windows Live Sign-in Assistant-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
  WinDVD for VAIO-->C:\Program Files\InstallShield Installation Information\{20471B27-D702-4FE8-8DEC-0702CC8C0A85}\setup.exe -runfromtemp -l0x040c
  Wireless Switch Setting Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A0F3EF9-68EE-49E9-A05B-ED5B82DF63E5}\setup.exe" -l0x40c -removeonly
  Yahoo! Install Manager-->C:\Windows\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
  Yahoo! Toolbar avec bloqueur de fenêtres pop-up-->C:\PROGRA~1\Yahoo!\Common\unyt.exe
  
  System event log
  
  Computer Name: Hache_4
  Event Code: 7036
  Message: Le service Windows CardSpace est entré dans l'état : en cours d'exécution.
  Record Number: 73931
  Source Name: Service Control Manager
  Time Written: 20081223232936.000000-000
  Event Type: Information
  User:
  
  Computer Name: Hache_4
  Event Code: 7036
  Message: Le service LiveUpdate est entré dans l'état : en cours d'exécution.
  Record Number: 73932
  Source Name: Service Control Manager
  Time Written: 20081223233655.000000-000
  Event Type: Information
  User:
  
  Computer Name: Hache_4
  Event Code: 7036
  Message: Le service LiveUpdate est entré dans l'état : arrêté.
  Record Number: 73933
  Source Name: Service Control Manager
  Time Written: 20081223233704.000000-000
  Event Type: Information
  User:
  
  Computer Name: Hache_4
  Event Code: 7036
  Message: Le service LogMeIn Rescue est entré dans l'état : arrêté.
  Record Number: 73934
  Source Name: Service Control Manager
  Time Written: 20081223234003.000000-000
  Event Type: Information
  User:
  
  Computer Name: Hache_4
  Event Code: 7036
  Message: Le service Windows CardSpace est entré dans l'état : arrêté.
  Record Number: 73935
  Source Name: Service Control Manager
  Time Written: 20081224002936.000000-000
  Event Type: Information
  User:
  
  Application event log
  
  Computer Name: Hache_4
  Event Code: 101
  Message: Information Level: success
  
  Scheduler launched Automatic LiveUpdate.
  Record Number: 19734
  Source Name: Automatic LiveUpdate Scheduler
  Time Written: 20081223233654.000000-000
  Event Type: Information
  User: AUTORITE NT\SYSTEM
  
  Computer Name: Hache_4
  Event Code: 101
  Message: Information Level: success
  
  Automatic LiveUpdate has terminated.
  Record Number: 19735
  Source Name: Automatic LiveUpdate Scheduler
  Time Written: 20081223233706.000000-000
  Event Type: Information
  User: AUTORITE NT\SYSTEM
  
  Computer Name: Hache_4
  Event Code: 101
  Message: Information Level: success
  
  The next run has been scheduled to occur at approximately 12:38 AM.
  Record Number: 19736
  Source Name: Automatic LiveUpdate Scheduler
  Time Written: 20081223233706.000000-000
  Event Type: Information
  User: AUTORITE NT\SYSTEM
  
  Computer Name: Hache_4
  Event Code: 518
  Message: Le service Windows CardSpace est inactif depuis un certain temps. Il a été fermé pour que les ressources soient disponibles pour d’autres programmes.
  Record Number: 19737
  Source Name: CardSpace 3.0.0.0
  Time Written: 20081224002935.000000-000
  Event Type: Information
  User: AUTORITE NT\SYSTEM
  
  Computer Name: Hache_4
  Event Code: 0
  Message: Le service s'est arrêté avec succès.
  Record Number: 19738
  Source Name: idsvc
  Time Written: 20081224002936.000000-000
  Event Type: Information
  User:
  
  Security event log
  
  Computer Name: Hache_4
  Event Code: 5038
  Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.
  
  Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
  Record Number: 25768
  Source Name: Microsoft-Windows-Security-Auditing
  Time Written: 20081224003035.842534-000
  Event Type: Échec de l'audit
  User:
  
  Computer Name: Hache_4
  Event Code: 5038
  Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.
  
  Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
  Record Number: 25769
  Source Name: Microsoft-Windows-Security-Auditing
  Time Written: 20081224003035.858134-000
  Event Type: Échec de l'audit
  User:
  
  Computer Name: Hache_4
  Event Code: 5038
  Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.
  
  Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
  Record Number: 25770
  Source Name: Microsoft-Windows-Security-Auditing
  Time Written: 20081224003035.889334-000
  Event Type: Échec de l'audit
  User:
  
  Computer Name: Hache_4
  Event Code: 5038
  Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.
  
  Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
  Record Number: 25771
  Source Name: Microsoft-Windows-Security-Auditing
  Time Written: 20081224003035.920534-000
  Event Type: Échec de l'audit
  User:
  
  Computer Name: Hache_4
  Event Code: 5038
  Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.
  
  Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
  Record Number: 25772
  Source Name: Microsoft-Windows-Security-Auditing
  Time Written: 20081224003035.936134-000
  Event Type: Échec de l'audit
  User:
  
  ======Environment variables======
  
  "ComSpec"=%SystemRoot%\system32\cmd.exe
  "FP_NO_HOST_CHECK"=NO
  "OS"=Windows_NT
  "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\QuickTime\QTSystem\
  "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
  "PROCESSOR_ARCHITECTURE"=x86
  "TEMP"=%SystemRoot%\TEMP
  "TMP"=%SystemRoot%\TEMP
  "USERNAME"=SYSTEM
  "windir"=%SystemRoot%
  "PROCESSOR_LEVEL"=6
  "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
  "PROCESSOR_REVISION"=0f0d
  "NUMBER_OF_PROCESSORS"=2
  "configsetroot"=%SystemRoot%\ConfigSetRoot
  "RoxioCentral"=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\
  "CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
  "QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
  
  -----------------EOF-----------------
  
  et aussi
  
  Logfile of random's system information tool 1.05 (written by random/random)
  Run by ****** at 2008-12-24 00:30:20
  Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
  System drive C: has 92 GB (65%) free of 142 GB
  Total RAM: 2046 MB (48% free)
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 00:30:36, on 24/12/2008
  Platform: Windows Vista SP1 (WinNT 6.00.1905)
  MSIE: Internet Explorer v8.00 (8.00.6001.18241)
  Boot mode: Normal
  
  Running processes:
  C:\Windows\system32\Dwm.exe
  C:\Windows\Explorer.EXE
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Apoint\Apoint.exe
  C:\Program Files\Sony\ISB Utility\ISBMgr.exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  C:\Windows\system32\taskeng.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  C:\Windows\System32\rundll32.exe
  C:\Windows\system32\taskeng.exe
  C:\Program Files\RegTool\RegTool.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\Windows Media Player\wmpnscfg.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
  C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
  C:\Windows\System32\rundll32.exe
  C:\Program Files\Apoint\ApMsgFwd.exe
  C:\Windows\System32\mobsync.exe
  C:\Program Files\Apoint\Apntex.exe
  C:\Windows\system32\conime.exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  C:\Program Files\Safari\Safari.exe
  C:\Users\NICOLA~1\AppData\Local\Temp\Saf3EC4.tmp\RSIT.exe
  C:\Program Files\trend micro\******.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
  O1 - Hosts: ::1 localhost
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
  O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
  O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
  O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
  O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
  O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
  O4 - HKLM\..\Run: [Norton Save and Restore 2.0] "C:\Program Files\Norton Save and Restore\Agent\VProTray.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
  O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
  O4 - Global Startup: BTTray.lnk = ?
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
  O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
  O13 - Gopher Prefix:
  O15 - Trusted Zone: *.canalplay.com
  O15 - Trusted Zone: *.canalplusactive.com
  O15 - Trusted Zone: *.canalplay.com (HKLM)
  O15 - Trusted Zone: *.canalplusactive.com (HKLM)
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
  O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
  O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
  O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
  O23 - Service: Norton Save and Restore - Symantec Corporation - C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe
  O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
  O23 - Service: Service CANALPLAY - Canal+ Active - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
  O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
  O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\stacsv.exe
  O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
  O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
  O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
  O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
  O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
  O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
  O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
  O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
  O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
  O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
  O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
  O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
  O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
  O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
  O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
  O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
  
  0
Réponse 4 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

Poste seulement le rapport log.
0
1. Desperate internaute
  
  Logfile of random's system information tool 1.05 (written by random/random)
  Run by ****** at 2008-12-24 00:30:20
  Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
  System drive C: has 92 GB (65%) free of 142 GB
  Total RAM: 2046 MB (48% free)
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 00:30:36, on 24/12/2008
  Platform: Windows Vista SP1 (WinNT 6.00.1905)
  MSIE: Internet Explorer v8.00 (8.00.6001.18241)
  Boot mode: Normal
  
  Running processes:
  C:\Windows\system32\Dwm.exe
  C:\Windows\Explorer.EXE
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Apoint\Apoint.exe
  C:\Program Files\Sony\ISB Utility\ISBMgr.exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  C:\Windows\system32\taskeng.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  C:\Windows\System32\rundll32.exe
  C:\Windows\system32\taskeng.exe
  C:\Program Files\RegTool\RegTool.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\Windows Media Player\wmpnscfg.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
  C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
  C:\Windows\System32\rundll32.exe
  C:\Program Files\Apoint\ApMsgFwd.exe
  C:\Windows\System32\mobsync.exe
  C:\Program Files\Apoint\Apntex.exe
  C:\Windows\system32\conime.exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  C:\Program Files\Safari\Safari.exe
  C:\Users\NICOLA~1\AppData\Local\Temp\Saf3EC4.tmp\RSIT.exe
  C:\Program Files\trend micro\******.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
  O1 - Hosts: ::1 localhost
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
  O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
  O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
  O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
  O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
  O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
  O4 - HKLM\..\Run: [Norton Save and Restore 2.0] "C:\Program Files\Norton Save and Restore\Agent\VProTray.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
  O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
  O4 - Global Startup: BTTray.lnk = ?
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
  O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O8 - Extra context menu item: Envoyer l'ℑ au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
  O13 - Gopher Prefix:
  O15 - Trusted Zone: *.canalplay.com
  O15 - Trusted Zone: *.canalplusactive.com
  O15 - Trusted Zone: *.canalplay.com (HKLM)
  O15 - Trusted Zone: *.canalplusactive.com (HKLM)
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
  O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
  O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
  O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
  O23 - Service: Norton Save and Restore - Symantec Corporation - C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe
  O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
  O23 - Service: Service CANALPLAY - Canal+ Active - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
  O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
  O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\stacsv.exe
  O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
  O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
  O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
  O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
  O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
  O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
  O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
  O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
  O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
  O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
  O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
  O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
  O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
  O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
  O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
  O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
  End of file - 12647 bytes
  
  ======Scheduled tasks folder======
  
  C:\Windows\tasks\RegTool Scan.job
  
  C:\Windows\tasks\RegTool Startup.job
  
  ======Registry dump======
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
  
  Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-11-29 436288]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
  
  Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
  
  Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-09-15 1562960]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
  
  C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll [2008-06-30 349552]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
  
  Symantec Intrusion Prevention - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll [2008-12-04 116088]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
  
  Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-17 320920]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
  
  Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
  
  Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2007-07-23 2436160]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
  
  CBrowserHelperObject Object - C:\PROGRA~1\GOOGLE~1\BAE.dll [2006-06-23 98304]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
  
  Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-17 34816]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  
  {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2007-07-23 2436160]
  
  {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Show Norton Toolbar - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll [2008-06-30 349552]
  
  {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar avec bloqueur de fenêtres pop-up - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-11-29 436288]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  
  "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
  
  "Apoint"=C:\Program Files\Apoint\Apoint.exe [2007-06-10 118784]
  
  "ISBMgr.exe"=C:\Program Files\Sony\ISB Utility\ISBMgr.exe [2007-06-11 317560]
  
  "Google Desktop Search"=C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-10-01 29744]
  
  "Norton Save and Restore 2.0"=C:\Program Files\Norton Save and Restore\Agent\VProTray.exe [2007-02-13 2020968]
  
  "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-17 136600]
  
  "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
  
  "AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-10-01 111936]
  
  "ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2008-10-17 51048]
  
  "osCheck"=C:\Program Files\Norton 360\osCheck.exe [2008-02-26 988512]
  
  "NvSvc"=C:\Windows\system32\nvsvc.dll [2007-06-28 86016]
  
  "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-06-28 8429568]
  
  "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-06-28 81920]
  
  "TrojanScanner"=C:\Program Files\Trojan Remover\Trjscan.exe [2008-11-29 1231752]
  
  "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696]
  
  "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  
  "MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
  
  "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]
  
  "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]
  
  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
  
  BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  
  "AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL"
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\VESWinlogon]
  
  C:\Windows\system32\VESWinlogon.dll [2007-07-12 98304]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  
  "NoSecCPL"=0
  
  "NoDispCPL"=0
  
  "NoDispScrSavPage"=0
  
  "NoDispAppearancePage"=0
  
  "NoDispSettingsPage"=0
  
  "NoDevMgrPage"=0
  
  "NoConfigPage"=0
  
  "NoVirtMemPage"=0
  
  "NoFileSysPage"=0
  
  "NoNetSetup"=0
  
  "NoNetSetupIDPage"=0
  
  "NoNetSetupSecurityPage"=0
  
  "NoWorkgroupContents"=0
  
  "NoEntireNetwork"=0
  
  "NoFileSharingControl"=0
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  
  "dontdisplaylastusername"=0
  
  "legalnoticecaption"=
  
  "legalnoticetext"=
  
  "shutdownwithoutlogon"=1
  
  "undockwithoutlogon"=1
  
  "EnableUIADesktopToggle"=0
  
  "DisableTaskMgr"=0
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
  
  "NoDriveTypeAutoRun"=145
  
  "NoFolderOptions"=00000000
  
  "RestrictRun"=0
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
  
  "NoFolderOptions"=
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20d0ef7c-922c-11dc-9ff5-806e6f6e6963}]
  
  shell\AutoRun\command - F:\CDStart.Exe
  
  shell\Install\command - F:\Stub.exe
  
  ======File associations======
  
  .js - edit - C:\Windows\System32\Notepad.exe %1
  
  .js - open - C:\Windows\System32\WScript.exe "%1" %*
  
  ======List of files/folders created in the last 1 months======
  
  2008-12-24 00:30:25 ----D---- C:\Program Files\trend micro
  
  2008-12-24 00:30:20 ----D---- C:\rsit
  
  2008-12-23 07:27:18 ----D---- C:\Program Files\Microsoft Silverlight
  
  2008-12-22 23:35:21 ----D---- C:\ProgramData\Yahoo! Companion
  
  2008-12-21 13:25:28 ----D---- C:\Program Files\uTorrent
  
  2008-12-21 13:25:19 ----D---- C:\Users\******\AppData\Roaming\uTorrent
  
  2008-12-17 21:04:54 ----D---- C:\Windows\system32\N360_BACKUP
  
  2008-12-17 20:52:10 ----D---- C:\Program Files\Bonjour
  
  2008-12-17 20:51:03 ----D---- C:\Program Files\iPod
  
  2008-12-17 20:50:58 ----D---- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
  
  2008-12-17 20:50:58 ----D---- C:\Program Files\iTunes
  
  2008-12-17 20:48:54 ----D---- C:\Program Files\QuickTime
  
  2008-12-17 20:28:04 ----A---- C:\Windows\system32\deploytk.dll
  
  2008-12-17 20:28:03 ----A---- C:\Windows\system32\javaws.exe
  
  2008-12-17 20:28:03 ----A---- C:\Windows\system32\javaw.exe
  
  2008-12-17 20:28:03 ----A---- C:\Windows\system32\java.exe
  
  2008-12-17 20:08:05 ----A---- C:\Windows\system32\tzres.dll
  
  2008-12-17 19:58:42 ----A---- C:\Windows\system32\gdi32.dll
  
  2008-12-17 19:58:31 ----A---- C:\Windows\system32\Apphlpdm.dll
  
  2008-12-17 19:58:27 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
  
  2008-12-17 19:58:13 ----A---- C:\Windows\system32\shell32.dll
  
  2008-12-17 19:57:59 ----A---- C:\Windows\system32\mshtml.dll
  
  2008-12-17 19:57:54 ----A---- C:\Windows\explorer.exe
  
  2008-12-17 19:57:51 ----A---- C:\Windows\system32\mf.dll
  
  2008-12-17 19:57:50 ----A---- C:\Windows\system32\WMVCORE.DLL
  
  2008-12-17 19:57:49 ----A---- C:\Windows\system32\WMNetMgr.dll
  
  2008-12-17 19:57:49 ----A---- C:\Windows\system32\logagent.exe
  
  2008-12-12 11:18:16 ----A---- C:\Windows\system32\dns-sd.exe
  
  2008-12-12 11:11:46 ----A---- C:\Windows\system32\dnssd.dll
  
  2008-12-05 20:36:19 ----D---- C:\Users\******\AppData\Roaming\Malwarebytes
  
  2008-12-05 20:36:13 ----D---- C:\ProgramData\Malwarebytes
  
  2008-12-05 20:36:13 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
  
  2008-12-05 20:32:34 ----D---- C:\Program Files\Yahoo!
  
  2008-12-05 20:32:26 ----D---- C:\Program Files\CCleaner
  
  2008-12-05 16:07:14 ----A---- C:\Windows\system32\ztvunrar36.dll
  
  2008-12-05 16:07:14 ----A---- C:\Windows\system32\ztvunace26.dll
  
  2008-12-05 16:07:14 ----A---- C:\Windows\system32\ztvcabinet.dll
  
  2008-12-05 16:07:14 ----A---- C:\Windows\system32\UNRAR3.dll
  
  2008-12-05 16:07:14 ----A---- C:\Windows\system32\unacev2.dll
  
  2008-12-05 16:07:10 ----D---- C:\Users\******\AppData\Roaming\Simply Super Software
  
  2008-12-05 16:07:10 ----D---- C:\ProgramData\Simply Super Software
  
  2008-12-05 16:07:10 ----D---- C:\Program Files\Trojan Remover
  
  2008-12-05 15:53:41 ----AD---- C:\ProgramData\TEMP
  
  2008-12-05 15:53:33 ----D---- C:\Users\******\AppData\Roaming\PC Tools
  
  2008-12-05 15:53:33 ----D---- C:\Program Files\Spyware Doctor
  
  2008-12-05 15:35:17 ----D---- C:\ProgramData\WindowsSearch
  
  2008-12-05 15:12:08 ----D---- C:\VundoFix Backups
  
  2008-12-05 14:19:35 ----D---- C:\Users\*****\AppData\Roaming\RegTool
  
  2008-12-05 14:19:06 ----D---- C:\Program Files\RegTool
  
  2008-12-05 14:07:54 ----A---- C:\Windows\system32\msshooks.dll
  
  2008-12-05 14:07:54 ----A---- C:\Windows\system32\msscb.dll
  
  2008-12-05 14:07:49 ----A---- C:\Windows\system32\SearchFilterHost.exe
  
  2008-12-05 14:07:49 ----A---- C:\Windows\system32\propdefs.dll
  
  2008-12-05 14:07:49 ----A---- C:\Windows\system32\mssitlb.dll
  
  2008-12-05 14:07:48 ----A---- C:\Windows\system32\thawbrkr.dll
  
  2008-12-05 14:07:48 ----A---- C:\Windows\system32\srchadmin.dll
  
  2008-12-05 14:07:48 ----A---- C:\Windows\system32\propsys.dll
  
  2008-12-05 14:07:48 ----A---- C:\Windows\system32\msstrc.dll
  
  2008-12-05 14:07:48 ----A---- C:\Windows\system32\mssprxy.dll
  
  2008-12-05 14:07:48 ----A---- C:\Windows\system32\msshsq.dll
  
  2008-12-05 14:07:48 ----A---- C:\Windows\system32\korwbrkr.dll
  
  2008-12-05 14:07:47 ----A---- C:\Windows\system32\xmlfilter.dll
  
  2008-12-05 14:07:47 ----A---- C:\Windows\system32\wsepno.dll
  
  2008-12-05 14:07:47 ----A---- C:\Windows\system32\rtffilt.dll
  
  2008-12-05 14:07:47 ----A---- C:\Windows\system32\offfilt.dll
  
  2008-12-05 14:07:47 ----A---- C:\Windows\system32\nlhtml.dll
  
  2008-12-05 14:07:47 ----A---- C:\Windows\system32\msscntrs.dll
  
  2008-12-05 14:07:47 ----A---- C:\Windows\system32\mimefilt.dll
  
  2008-12-05 14:07:47 ----A---- C:\Windows\system32\chtbrkr.dll
  
  2008-12-05 14:07:47 ----A---- C:\Windows\system32\chsbrkr.dll
  
  2008-12-05 14:07:46 ----A---- C:\Windows\system32\tquery.dll
  
  2008-12-05 14:07:46 ----A---- C:\Windows\system32\SearchProtocolHost.exe
  
  2008-12-05 14:07:46 ----A---- C:\Windows\system32\SearchIndexer.exe
  
  2008-12-05 14:07:46 ----A---- C:\Windows\system32\mssvp.dll
  
  2008-12-05 14:07:46 ----A---- C:\Windows\system32\mssrch.dll
  
  2008-12-05 14:07:46 ----A---- C:\Windows\system32\mssphtb.dll
  
  2008-12-05 14:07:46 ----A---- C:\Windows\system32\mssph.dll
  
  2008-12-05 13:06:50 ----D---- C:\ProgramData\Spybot - Search & Destroy
  
  2008-12-05 13:06:50 ----D---- C:\Program Files\Spybot - Search & Destroy
  
  2008-12-05 13:00:59 ----A---- C:\Windows\system32\rpcrt4.dll
  
  2008-12-05 13:00:57 ----A---- C:\Windows\system32\pacerprf.dll
  
  2008-12-05 13:00:55 ----A---- C:\Windows\system32\wersvc.dll
  
  2008-12-05 13:00:55 ----A---- C:\Windows\system32\Faultrep.dll
  
  2008-12-05 13:00:53 ----A---- C:\Windows\system32\emdmgmt.dll
  
  2008-12-05 13:00:53 ----A---- C:\Windows\system32\dataclen.dll
  
  2008-12-05 13:00:52 ----A---- C:\Windows\system32\cdd.dll
  
  2008-12-05 13:00:48 ----A---- C:\Windows\system32\wshext.dll
  
  2008-12-05 13:00:48 ----A---- C:\Windows\system32\wscript.exe
  
  2008-12-05 13:00:48 ----A---- C:\Windows\system32\vbscript.dll
  
  2008-12-05 13:00:48 ----A---- C:\Windows\system32\scrrun.dll
  
  2008-12-05 13:00:48 ----A---- C:\Windows\system32\scrobj.dll
  
  2008-12-05 13:00:48 ----A---- C:\Windows\system32\cscript.exe
  
  2008-12-04 21:14:10 ----A---- C:\Windows\system32\mshtmler.dll
  
  2008-12-04 21:14:10 ----A---- C:\Windows\system32\mshtmled.dll
  
  2008-12-04 21:14:10 ----A---- C:\Windows\system32\ieui.dll
  
  2008-12-04 21:14:10 ----A---- C:\Windows\system32\admparse.dll
  
  2008-12-04 21:14:09 ----A---- C:\Windows\system32\pngfilt.dll
  
  2008-12-04 21:14:09 ----A---- C:\Windows\system32\msls31.dll
  
  2008-12-04 21:14:09 ----A---- C:\Windows\system32\jsproxy.dll
  
  2008-12-04 21:14:09 ----A---- C:\Windows\system32\iernonce.dll
  
  2008-12-04 21:14:09 ----A---- C:\Windows\system32\corpol.dll
  
  2008-12-04 21:14:09 ----A---- C:\Windows\system32\advpack.dll
  
  2008-12-04 21:14:08 ----A---- C:\Windows\system32\PrivacIE.dll
  
  2008-12-04 21:14:08 ----A---- C:\Windows\system32\msrating.dll
  
  2008-12-04 21:14:08 ----A---- C:\Windows\system32\msfeedsbs.dll
  
  2008-12-04 21:14:08 ----A---- C:\Windows\system32\licmgr10.dll
  
  2008-12-04 21:14:08 ----A---- C:\Windows\system32\inseng.dll
  
  2008-12-04 21:14:08 ----A---- C:\Windows\system32\imgutil.dll
  
  2008-12-04 21:14:08 ----A---- C:\Windows\system32\iesetup.dll
  
  2008-12-04 21:14:08 ----A---- C:\Windows\system32\ieapfltr.dll
  
  2008-12-04 21:14:07 ----A---- C:\Windows\system32\webcheck.dll
  
  2008-12-04 21:14:07 ----A---- C:\Windows\system32\occache.dll
  
  2008-12-04 21:14:07 ----A---- C:\Windows\system32\mstime.dll
  
  2008-12-04 21:14:07 ----A---- C:\Windows\system32\msfeeds.dll
  
  2008-12-04 21:14:07 ----A---- C:\Windows\system32\ieaksie.dll
  
  2008-12-04 21:14:07 ----A---- C:\Windows\system32\ieakeng.dll
  
  2008-12-04 21:14:07 ----A---- C:\Windows\system32\dxtrans.dll
  
  2008-12-04 21:14:07 ----A---- C:\Windows\system32\dxtmsft.dll
  
  2008-12-04 21:14:06 ----A---- C:\Windows\system32\WinFXDocObj.exe
  
  2008-12-04 21:14:06 ----A---- C:\Windows\system32\wextract.exe
  
  2008-12-04 21:14:06 ----A---- C:\Windows\system32\url.dll
  
  2008-12-04 21:14:06 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
  
  2008-12-04 21:14:06 ----A---- C:\Windows\system32\SetDepNx.exe
  
  2008-12-04 21:1
  
  0
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Réponse 5 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

Tu as le rapport de MBAM ?
0
1. Desperate internaute
  
  le voici
  
  Malwarebytes' Anti-Malware 1.31
  Version de la base de données: 1464
  Windows 6.0.6001 Service Pack 1
  
  24/12/2008 01:03:59
  mbam-log-2008-12-24 (01-03-59).txt
  
  Type de recherche: Examen rapide
  Eléments examinés: 48930
  Temps écoulé: 2 minute(s), 39 second(s)
  
  Processus mémoire infecté(s): 0
  Module(s) mémoire infecté(s): 0
  Clé(s) du Registre infectée(s): 1
  Valeur(s) du Registre infectée(s): 0
  Elément(s) de données du Registre infecté(s): 0
  Dossier(s) infecté(s): 0
  Fichier(s) infecté(s): 0
  
  Processus mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Module(s) mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Clé(s) du Registre infectée(s):
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3b8fb116-d358-48a3-a5c7-db84f15cbb04} (Trojan.Zlob) -> Quarantined and deleted successfully.
  
  Valeur(s) du Registre infectée(s):
  (Aucun élément nuisible détecté)
  
  Elément(s) de données du Registre infecté(s):
  (Aucun élément nuisible détecté)
  
  Dossier(s) infecté(s):
  (Aucun élément nuisible détecté)
  
  Fichier(s) infecté(s):
  (Aucun élément nuisible détecté)
  
  0
Réponse 6 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

- Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) sur ton Bureau.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

- Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée.

- Un rapport sera généré, poste-le dans ta prochaine réponse.

[*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix.
0
1. Desperate internaute
  
  le voici - en effet Norton n aime pas trop....
  
  SmitFraudFix v2.387
  
  Scan done at 1:08:17,73, 24/12/2008
  Run from C:\Program Files\Safari\SmitfraudFix
  OS: Microsoft Windows [version 6.0.6001] - Windows_NT
  The filesystem type is NTFS
  Fix run in normal mode
  
  »»»»»»»»»»»»»»»»»»»»»»»» Process
  
  C:\Windows\system32\csrss.exe
  C:\Windows\system32\wininit.exe
  C:\Windows\system32\csrss.exe
  C:\Windows\system32\services.exe
  C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsm.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\winlogon.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\SLsvc.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\System32\spoolsv.exe
  C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\Dwm.exe
  C:\Windows\Explorer.EXE
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\Windows\system32\svchost.exe
  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Apoint\Apoint.exe
  C:\Program Files\Sony\ISB Utility\ISBMgr.exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe
  C:\Windows\system32\taskeng.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\stacsv.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\System32\rundll32.exe
  C:\Windows\system32\taskeng.exe
  C:\Program Files\RegTool\RegTool.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\Windows Media Player\wmpnscfg.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
  C:\Windows\system32\taskeng.exe
  C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
  C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
  C:\Windows\System32\rundll32.exe
  C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\SearchIndexer.exe
  C:\Windows\system32\DRIVERS\xaudio.exe
  C:\Windows\system32\WUDFHost.exe
  C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
  C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
  C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
  C:\Program Files\Windows Media Player\wmpnetwk.exe
  C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
  C:\Program Files\Apoint\ApMsgFwd.exe
  C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
  C:\Windows\System32\mobsync.exe
  C:\Program Files\Apoint\Apntex.exe
  C:\Windows\system32\conime.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  C:\Program Files\Safari\Safari.exe
  C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
  C:\Windows\system32\NOTEPAD.EXE
  C:\Windows\system32\cmd.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  
  »»»»»»»»»»»»»»»»»»»»»»»» hosts
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\******
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\NICOLA~1\AppData\Local\Temp
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\******\Application Data
  
  »»»»»»»»»»»»»»»»»»»»»»»» Start Menu
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\NICOLA~1\FAVORI~1
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
  
  C:\Program Files\Google\googletoolbar1.dll FOUND !
  
  »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
  
  »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
  !!!Attention, following keys are not inevitably infected!!!
  
  o4Patch
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
  !!!Attention, following keys are not inevitably infected!!!
  
  IEDFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
  !!!Attention, following keys are not inevitably infected!!!
  
  Agent.OMZ.Fix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  +--------------------------------------------------+
  Suspicious item found: B410BD4C4D4A50FC
  
  »»»»»»»»»»»»»»»»»»»»»»»» VACFix
  !!!Attention, following keys are not inevitably infected!!!
  
  VACFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
  !!!Attention, following keys are not inevitably infected!!!
  
  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
  !!!Attention, following keys are not inevitably infected!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  "AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~1\\GOEC62~1.DLL"
  "LoadAppInit_DLLs"=dword:00000001
  
  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
  !!!Attention, following keys are not inevitably infected!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  "Userinit"="C:\\Windows\\system32\\userinit.exe"
  "System"=""
  
  »»»»»»»»»»»»»»»»»»»»»»»» RK
  
  »»»»»»»»»»»»»»»»»»»»»»»» DNS
  
  Description: Intel(R) PRO/Wireless 3945ABG Network Connection
  DNS Server Search Order: 192.168.1.254
  
  HKLM\SYSTEM\CCS\Services\Tcpip\..\{5DBF4FF1-602E-4BE8-9B2A-76B281AF989F}: DhcpNameServer=192.168.1.254
  
  »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
  
  »»»»»»»»»»»»»»»»»»»»»»»» End
  
  0
Réponse 7 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

- Redémarre ton ordinateur en mode sans échec :
https://blog.sosordi.net/

- Double-clique sur SmitfraudFix.exe, choisis l'option 2 et Entrée.

- Réponds O (Oui) à ces deux questions si elles te sont posées :

Voulez-vous nettoyer le registre ?
Corriger le fichier infecté ?

- Un rapport sera généré, sauvegarde-le sur le Bureau.

- Redémarre en mode normal.

- Poste le rapport SmitfraudFix.
0
1. Desperate internaute
  
  ca n a pas marche
  Le fichier 404 etait introuvable
  SmitFraud met acces refuse maintenant
  
  0
Réponse 8 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

Tu n'as pas besoin de télécharger SmitfraudFix en mode sans échec puisque tu l'as déjà téléchargé.
0
1. Desperate internaute
  
  et tu proposes koi maintenant ? impossible d obtenir le rapport de SMITFRAUD
  
  0
Réponse 9 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

En fait, je n'ai pas compris ce que tu avais fait.
0
1. Desperate internaute
  
  ben j ai suivi ta procedure
  quand j etais en mode sans echec j ai clique Yes a la premiere question
  l ecran de commandes est devenu rouge et l ordinateur a redemarre brutalement en mode normal
  maintenant je relance SMITFRaud et ca dit acces refuse
  
  0
Réponse 10 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

Fais un scan MBAM et poste le rapport.
0
1. Desperate internaute
  
  Un nouveau message
  
  Malwarebytes' Anti-Malware 1.31
  Version de la base de données: 1464
  Windows 6.0.6001 Service Pack 1
  
  24/12/2008 01:50:25
  mbam-log-2008-12-24 (01-50-25).txt
  
  Type de recherche: Examen rapide
  Eléments examinés: 48934
  Temps écoulé: 2 minute(s), 35 second(s)
  
  Processus mémoire infecté(s): 0
  Module(s) mémoire infecté(s): 0
  Clé(s) du Registre infectée(s): 0
  Valeur(s) du Registre infectée(s): 0
  Elément(s) de données du Registre infecté(s): 0
  Dossier(s) infecté(s): 0
  Fichier(s) infecté(s): 1
  
  Processus mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Module(s) mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Clé(s) du Registre infectée(s):
  (Aucun élément nuisible détecté)
  
  Valeur(s) du Registre infectée(s):
  (Aucun élément nuisible détecté)
  
  Elément(s) de données du Registre infecté(s):
  (Aucun élément nuisible détecté)
  
  Dossier(s) infecté(s):
  (Aucun élément nuisible détecté)
  
  Fichier(s) infecté(s):
  C:\Pass2.cmd (Trojan.Agent) -> Quarantined and deleted successfully.
  
  0
Réponse 11 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

--> Télécharge UsbFix (de Chiquitine29) sur ton Bureau :
http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

--> Lance l'installation avec les paramètres par défaut.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir.

--> Double-clique sur le raccourci UsbFix sur ton Bureau.

--> Choisis l'option 1 (Nettoyage).

--> Le PC va redémarrer.

--> Après redémarrage, poste le rapport UsbFix.txt

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque.

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide)
0
1. Desperate internaute
  
  2 petites questions
  
  pkoi SMITFRAUD a plante ?
  je n ai aucun peripherique externe ....
  
  0
Réponse 12 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

Pas grave ;)
0
1. Desperate internaute
  
  pdt l execution j ai eu une serie de 'Acces refuse' et il n'y a aucune trace du fichier en question
  
  0
Réponse 13 / 29
Utilisateur anonyme

Hola,

solamente para ver algo

besos
0
1. Desperate internaute
  
  translation?
  
  0
Réponse 14 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

Bien ;)

Tu peux retélécharger SmitfraudFix ?
0
1. Desperate internaute
  
  voici le rapport chef
  
  OS: Microsoft Windows [version 6.0.6001] - Windows_NT
  The filesystem type is NTFS
  Fix run in normal mode
  
  »»»»»»»»»»»»»»»»»»»»»»»» Process
  
  C:\Windows\system32\csrss.exe
  C:\Windows\system32\wininit.exe
  C:\Windows\system32\csrss.exe
  C:\Windows\system32\services.exe
  C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsm.exe
  C:\Windows\system32\winlogon.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\SLsvc.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\System32\spoolsv.exe
  C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  C:\Windows\system32\svchost.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\Windows\system32\svchost.exe
  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
  C:\Windows\system32\Dwm.exe
  C:\Windows\Explorer.EXE
  C:\Windows\system32\taskeng.exe
  C:\Program Files\RegTool\RegTool.exe
  C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\stacsv.exe
  C:\Windows\system32\taskeng.exe
  C:\Windows\system32\svchost.exe
  C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
  C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
  C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
  C:\Windows\system32\conime.exe
  C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\SearchIndexer.exe
  C:\Windows\system32\DRIVERS\xaudio.exe
  C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
  C:\Windows\system32\WUDFHost.exe
  C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
  C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
  C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
  C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Apoint\Apoint.exe
  C:\Program Files\Sony\ISB Utility\ISBMgr.exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  C:\Program Files\Apoint\ApMsgFwd.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
  C:\Windows\System32\rundll32.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\Windows Media Player\wmpnscfg.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
  C:\Program Files\Safari\Safari.exe
  C:\Windows\System32\rundll32.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  C:\Program Files\Windows Media Player\wmpnetwk.exe
  C:\Program Files\Apoint\Apntex.exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  C:\Program Files\iPod\bin\iPodService.exe
  \\?\C:\Windows\system32\wbem\WMIADAP.EXE
  C:\Windows\system32\cmd.exe
  C:\Windows\system32\SearchProtocolHost.exe
  C:\Windows\system32\SearchFilterHost.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  
  »»»»»»»»»»»»»»»»»»»»»»»» hosts
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\*****
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\NICOLA~1\AppData\Local\Temp
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Nicolas Laczny\Application Data
  
  »»»»»»»»»»»»»»»»»»»»»»»» Start Menu
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\NICOLA~1\FAVORI~1
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
  
  »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
  
  »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
  !!!Attention, following keys are not inevitably infected!!!
  
  o4Patch
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
  !!!Attention, following keys are not inevitably infected!!!
  
  IEDFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
  !!!Attention, following keys are not inevitably infected!!!
  
  Agent.OMZ.Fix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  +--------------------------------------------------+
  Suspicious item found: B410BD4C4D4A50FC
  
  »»»»»»»»»»»»»»»»»»»»»»»» VACFix
  !!!Attention, following keys are not inevitably infected!!!
  
  VACFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
  !!!Attention, following keys are not inevitably infected!!!
  
  404Fix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
  !!!Attention, following keys are not inevitably infected!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  "AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~1\\GOEC62~1.DLL"
  "LoadAppInit_DLLs"=dword:00000001
  
  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
  !!!Attention, following keys are not inevitably infected!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  "Userinit"="C:\\Windows\\system32\\userinit.exe"
  "System"=""
  
  »»»»»»»»»»»»»»»»»»»»»»»» RK
  
  »»»»»»»»»»»»»»»»»»»»»»»» DNS
  
  Description: Intel(R) PRO/Wireless 3945ABG Network Connection
  DNS Server Search Order: 192.168.1.254
  
  HKLM\SYSTEM\CCS\Services\Tcpip\..\{5DBF4FF1-602E-4BE8-9B2A-76B281AF989F}: DhcpNameServer=192.168.1.254
  
  »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
  
  »»»»»»»»»»»»»»»»»»»»»»»» End
  
  0
Réponse 15 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

Pour lancer SmitfraudFix, clique droit sur SmitfraudFix et choisis Exécuter en tant qu'administrateur.
0
1. Desperate internaute
  
  ok donc je dois nettoyer avec smidfraud?
  
  0
Réponse 16 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

Oui.
0
1. Desperate internaute
  
  voici le nveau rapport
  
  OS: Microsoft Windows [version 6.0.6001] - Windows_NT
  The filesystem type is NTFS
  Fix run in safe mode
  
  »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» Killing process
  
  »»»»»»»»»»»»»»»»»»»»»»»» hosts
  
  127.0.0.1 localhost
  ::1 localhost
  
  »»»»»»»»»»»»»»»»»»»»»»»» VACFix
  
  VACFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
  
  S!Ri's WS2Fix: LSP not Found.
  
  »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
  
  GenericRenosFix by S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
  
  »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
  
  IEDFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
  
  Agent.OMZ.Fix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  +--------------------------------------------------+
  Suspicious item found: B410BD4C4D4A50FC
  
  »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
  
  404Fix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  »»»»»»»»»»»»»»»»»»»»»»»» RK
  
  »»»»»»»»»»»»»»»»»»»»»»»» DNS
  
  HKLM\SYSTEM\CCS\Services\Tcpip\..\{5DBF4FF1-602E-4BE8-9B2A-76B281AF989F}: DhcpNameServer=192.168.1.254
  
  »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
  
  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
  !!!Attention, following keys are not inevitably infected!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  "System"=""
  
  »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
  
  Registry Cleaning done.
  
  »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» End
  
  0
Réponse 17 / 29
Utilisateur anonyme

si hi hi

désolé -;)

bonnes suite a tous les deux

des bisous
0
1. Desperate internaute
  
  merci !
  
  0
Réponse 18 / 29
Utilisateur anonyme

de rien desperte

@+ sur CCM et bonnes fetes
0
Réponse 19 / 29
Destrio5 Messages postés 99820 Date d'inscription Statut Modérateur Dernière intervention 10 324

Encore du Zlob.
0
1. Desperate internaute
  
  que faut il faire alors? a ton fait tout ca pour identifier le virus/spyware or whatsoever?
  
  0
Réponse 20 / 29
Utilisateur anonyme

tans que c pas du zgeg hi hi

que veux tu dire willy ?
0

Trojan / Zlob? / ...

29 réponses

Discussions similaires

Newsletters