opnnduvs.dll

Question

Bonjour,


Hier, j'ai eu un virus qui m'a installé un programme qui m'affiche "Your computer is infected !" et losque l'on clique sur celui-ci, une page web s'ouvre. Apparement j'ai supprimé une dll : opnnduvs.dll . Je ne sais pas si elle provient de windows ou bien du virus car un message d'erreur affiche au demmarrage de la session : "Fichier de démarrage introuvable : opnnduvs.dll".









Aidez moi !
Cordialement, Yann.

Destrio5 · Accepted Answer

gen-hackman ---> Arrête avec tes points de suspension s'il te plaît.

Les rapports ont été bloqués.

gen-hackman · Answer

salut regarde si tu as ceci :

opnnduvs.txt.bat

yann5 · Answer

nn jlé pas

gen-hackman · Answer

bien........:


Télécharge DDS.scr de sUBs 
https://download.bleepingcomputer.com/sUBs/dds.scr 
Sur le bureau. 
L'outil ne nécessite pas d'installation. 

Lances-le en cliquant sur l'icône dds.scr 

Cette fenêtre DOS va apparaitre: 
https://i75.servimg.com/u/f75/11/05/93/83/ddsdos10.jpg 

Le scan ne doit pas dépasser trois minutes. 
Un premier rapport va s'ouvrir que tu enregistreras sous DDS.txt par défaut sur le bureau. 
Il te sera demandé si tu veux faire le scan optionnel. 
Accepte par Oui 
Un nouveau rapport s'ouvre que tu enregistres sous Attach.txt sur le bureau. 
Tu ne le fourniras que si nécessaire. 
Poste le rapport DDS.txt

yann5 · Answer

Bah je vais essayer ca
milles mercis !!

yann5 · Answer

resultats :

DDS (Version 1.1.0) - NTFSx86
Run by yanou at 11:12:50,92 on 24/12/2008
Internet Explorer: 7.0.6000.16764 BrowserJavaVersion: 1.6.0_10
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.1791.900 [GMT 1:00]

AV: Kaspersky Anti-Virus *On-access scanning enabled* (Updated)
AV: avast! antivirus 4.8.1229 [VPS 081103-0] *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwssvc.exe
C:\Program Files\ALO SOFT\ALO CD BURNER\NMSAccessU.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ArticSoft\FileAssurity OpenPGP\bin\FAOPGPMonitor.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
C:\Program Files\Virtual DJ\VDJP.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\TuePub\TuePub.exe
C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
C:\Windows\System32\frmwrk32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\System32\p2phost.exe
C:\Program Files\BitDownload\BitDownload.exe
C:\Users\yanou\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\yanou\AppData\Local\qykgkmc.exe
C:\Users\yanou\AppData\Roaming\gadcom\gadcom.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Program Files\PDFCreator\PDFCreator.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\Windows\system32\ntdll64.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Windows\system32\MDM.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Microsoft Office\Office12\MSPUB.EXE
C:\Program Files\Microsoft Office\Office12\MSPUB.EXE
C:\PROGRA~1\MICROS~2\Office12\MSTORDB.EXE
C:\Users\yanou\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\yanou\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\ntdll64.exe
C:\Windows\system32\ntdll64.exe
C:\Users\yanou\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\yanou\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\ntdll64.exe
C:\Users\yanou\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\yanou\Desktop\dds.scr
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.fr/
uSearch Bar = hxxp://g.msn.fr/0SEFRFR/SAOS02
mDefault_Page_URL = hxxp://fr.fr.acer.yahoo.com
mStart Page = hxxp://fr.fr.acer.yahoo.com
uURLSearchHooks: N/A: {00A6FAF6-072E-44cf-8957-5838F569A31D} - c:\program files\mywebsearch\srchastt\2.bin\MWSSRCAS.DLL
uURLSearchHooks: torrent_search toolbar: {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - c:\program files\torrent_search\tbtorr.dll
uURLSearchHooks: Habbo-FR Toolbar: {c0350ecf-5e90-4d54-a401-9efff47d7fde} - c:\program files\habbo-fr\tbHabb.dll
mURLSearchHooks: Habbo-FR Toolbar: {c0350ecf-5e90-4d54-a401-9efff47d7fde} - c:\program files\habbo-fr\tbHabb.dll
BHO: IE7Pro BHO: {00011268-E188-40DF-A514-835FCD78B1BF} - c:\program files\iepro\iepro.dll
BHO: Yahoo! Toolbar Helper: {02478D38-C3F9-4EFB-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Aide pour le lien d'Adobe PDF Reader: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: mwsBar BHO: {07B18EA1-A523-4961-B6BB-170DE4475CCA} - c:\program files\mywebsearch\bar\2.bin\MWSBAR.DLL
BHO: VMN Toolbar: {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} -
BHO: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - c:\program files\kaspersky lab\kaspersky anti-virus 2009\ievkbd.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Programme d'aide de l'Assistant de connexion Windows Live: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\2.1.1119.1736\swg.dll
BHO: Habbo-FR Toolbar: {c0350ecf-5e90-4d54-a401-9efff47d7fde} - c:\program files\habbo-fr\tbHabb.dll
BHO: PDFCreator Toolbar Helper: {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - c:\program files\pdfcreator toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
BHO: Mjcore Class: {D88E1558-7C2D-407A-953A-C044F5607CEA} - c:\program files\mjcore\Mjcore.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: torrent_search toolbar: {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - c:\program files\torrent_search\tbtorr.dll
TB: Acer eDataSecurity Management: {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - c:\windows\system32\eDStoolbar.dll
TB: Yahoo! Toolbar avec bloqueur de fenêtres pop-up: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: &Google: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
TB: My Web Search: {07B18EA9-A523-4961-B6BB-170DE4475CCA} - c:\program files\mywebsearch\bar\2.bin\MWSBAR.DLL
TB: torrent_search toolbar: {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - c:\program files\torrent_search\tbtorr.dll
TB: PDFCreator Toolbar: {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - c:\program files\pdfcreator toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
TB: Habbo-FR Toolbar: {c0350ecf-5e90-4d54-a401-9efff47d7fde} - c:\program files\habbo-fr\tbHabb.dll
TB: VMN Toolbar: {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} -
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Acer Tour Reminder]
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [CollaborationHost] c:\windows\system32\p2phost.exe -s
uRun: [BitDownload] "c:\program files\bitdownload\BitDownload.exe" /minimized
uRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\2.bin\mwsoemon.exe
uRun: [Google Update] "c:\users\yanou\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [qykgkmc] "c:\users\yanou\appdata\local\qykgkmc.exe" qykgkmc
uRun: [gadcom] "c:\users\yanou\appdata\roaming\gadcom\gadcom.exe" 61A847B5BBF72810339E3F466188719AB689201522886B092CBD44BD8689220221DD3257
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [Acer Empowering Technology Monitor] c:\acer\empowering technology\SysMonitor.exe
mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\eDSloader.exe
mRun: [WarReg_PopUp] c:\acer\wr_popup\WarReg_PopUp.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [FAOPGPMonitor] "c:\program files\articsoft\fileassurity openpgp\bin\FAOPGPMonitor.exe"
mRun: [WinampAgent] "c:\program files\winamp\Winampa.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2009\avp.exe"
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [MyWebSearch Plugin] rundll32 c:\progra~1\mywebs~1\bar\2.bin\M3PLUGIN.DLL,UPF
mRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\2.bin\mwsoemon.exe
mRun: [mobiswing] c:\program files\virtual dj\VDJP.exe
mRun: [My Web Search Bar Search Scope Monitor] "c:\progra~1\mywebs~1\bar\2.bin\m3SrchMn.exe" /m=2 /w
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [LESS CITY AMEN SETUP] "c:\programdata\body pure 32.kgd60w7"
mRun: [Real Popup-Killer] c:\tuepub\TuePub.exe
mRun: [ALUAlert] "c:\program files\symantec\liveupdate\ALuNotify.exe" "/LOWDISKSPACE C"
mRun: [Error mail] "c:\programdata\Upload Bags Bags.kzuzxe"
mRun: [Framework Windows] frmwrk32.exe
mRun: [MSServer] rundll32.exe c:\windows\system32\opnNDuvS.dll,#1
StartupFolder: c:\users\yanou\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\users\yanou\appdata\roaming\microsoft\windows\start menu\programs\startup\robot.bat
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\empowe~1.lnk - c:\acer\empowering technology\eAPLauncher.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\pcmmed~1.lnk - c:\program files\acer arcade live\acer homemedia connect\kernel\dms\PCMMediaSharing.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\pdfcre~1.lnk - c:\program files\pdfcreator\PDFCreator.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: EnableLUA = 0 (0x0)
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk142YYFR
IE: E&xporter vers Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - {B119EB0C-C021-46CF-85B0-34A760E0D5FE} - c:\program files\iepro\iepro.dll
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky anti-virus 2009\SCIEPlgn.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
LSP: c:\users\yanou\appdata\local\temp\ntdll64.dll
LSP: c:\windows\system32\wpclsp.dll
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: c:\progra~1\google\google~4\goec62~1.dll,c:\progra~1\kasper~1\kasper~1\mzvkbd.dll
c:\windows\system32\opnNDuvS.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\yanou\appdata\roaming\mozilla\firefox\profiles\r8nx006x.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://google.fr/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\program files\mozilla firefox\extensions\talkback@mozilla.org\components\qfaservices.dll
FF - component: c:\users\yanou\appdata\roaming\mozilla\firefox\profiles\r8nx006x.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampPlayer.dll

[color=red]ATTENTION: FIREFOX POLICES IS IN FORCE /color
pref(dom.disable_open_during_load, false);c:\program files\mozilla firefox\greprefs\all.js - pref("general.useragent.contentlocale", "chrome://navigator-region/locale/region.properties");
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.tabs.warnOnCloseOther", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.tabs.loadGroup", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.tabs.loadOnNewTab", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.windows.loadOnNewWindow", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.default.HTMLDocument.open.get", "allAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.default.Window.Components", "allAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.default.Window.document.get", "allAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.disable_window_open_feature.resizable", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.max-connections", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.max-connections-per-server", 8);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.max-persistent-connections-per-server", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.max-persistent-connections-per-proxy", 4);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.accept.default", "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5");
c:\program files\mozilla firefox\greprefs\all.js - pref("network.dns.ipv4OnlyDomains", ".doubleclick.net");
c:\program files\mozilla firefox\greprefs\all.js - pref("network.standard-url.encode-utf8", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.image.warnAboutImages", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.cookie.p3p", "ffffaaaa");
c:\program files\mozilla firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\mozilla firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\mozilla firefox\greprefs\all.js - pref("ime.password.onFocus.dontCare", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ime.password.onBlur.dontCare", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.warn_entering_secure", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.warn_leaving_secure", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.warn_submit_insecure", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.OCSP.enabled", 0);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ui.enable", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("app.update.nagTimer.download", 86400);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("app.update.nagTimer.restart", 1800);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.update.url", "chrome://mozapps/locale/extensions/extensions.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.getMoreExtensionsURL", "http://%LOCALE%.add-ons.mozilla.com/%LOCALE%/%APP%/%VERSION%/extensions/");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.getMoreThemesURL", "http://%LOCALE%.add-ons.mozilla.com/%LOCALE%/%APP%/%VERSION%/themes/");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.hideGoButton", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.search.order.Yahoo.1", "chrome://branding/content/searchconfig.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.search.order.Yahoo.2", "chrome://branding/content/searchconfig.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.search.order.Yahoo", "chrome://branding/content/searchconfig.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.disable_window_open_feature.location", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.item.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.item.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.item.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.item.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.item.cookies", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.item.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.item.siteprefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.item.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("network.cookie.enableForCurrentSessionOnly", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("alerts.height", 50);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.warn_entering_secure.show_once", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.warn_leaving_secure.show_once", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.warn_submit_insecure.show_once", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&appver={moz:version}&");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&appver={moz:version}&");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.EULA.2.accepted", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.EULA.version", 2);

============= SERVICES / DRIVERS ===============

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 32784]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-9-5 78416]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\drivers\klim6.sys [2008-3-26 20496]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-9-5 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2008-9-5 51280]
R2 MyWebSearchService;My Web Search Service;c:\progra~1\mywebs~1\bar\2.bin\mwssvc.exe [2008-9-13 28762]
S2 asc3550p;asc3550p;c:\windows\system32\drivers\asc3550p.sys [2006-11-2 42688]
S3 CoachVid;CoachVid;c:\windows\system32\drivers\CoachVc.sys [2008-4-17 45344]
S3 UPnPService;UPnPService;c:\program files\common files\magix shared\upnpservice\UPnPService.exe [2008-1-28 544768]
S3 YMIDUSBW;Yamaha USB-MIDI Driver (WDM);c:\windows\system32\drivers\ymidusbw.sys [2008-10-25 32720]

============== File Associations ===============

regfile="regedit.exe" "%1"

=============== Created Last 30 ================

2008-12-22 20:35 <DIR> --d----- c:\program files\American Conquest Demo
2008-12-22 20:06 461 a------- c:\windows\system32\win32hlp.cnf
2008-12-22 20:06 <DIR> --d----- c:\program files\Mjcore
2008-12-22 20:06 4,785 a------- c:\windows\system32\warning.gif
2008-12-22 20:06 1,347 a------- c:\windows\system32\ahtn.htm
2008-12-22 20:06 <DIR> --d----- c:\users\yanou\appdata\roaming\gadcom
2008-12-22 20:06 111,616 a------- c:\windows\system32\ntdll64.exe
2008-12-22 20:06 1 a------- c:\windows\system32\uniq.tll
2008-12-22 20:06 1 a------- c:\windows\system32\test.ttt
2008-12-22 20:06 23,552 a------- c:\windows\system32\frmwrk32.exe
2008-12-22 20:05 45,056 a------- c:\windows\system32\iiFwTLcc.dll
2008-12-22 15:35 860,211 a--s---- c:\windows\system32\XSIFtk-3.6.2.1.dll
2008-12-22 15:35 <DIR> --d----- c:\program files\NaturalMotion
2008-12-21 19:33 <DIR> --d----- c:\program files\Macromedia
2008-12-21 09:55 <DIR> --d----- c:\program files\ModPlug
2008-12-20 12:04 54,156 a---h--- c:\windows\QTFont.qfn
2008-12-20 12:04 1,409 a------- c:\windows\QTFont.for
2008-12-19 21:32 19 a------- c:\windows\system32\shutdown.bat
2008-12-19 20:33 <DIR> --d----- c:\program files\ASIO4ALL v2
2008-12-19 20:33 <DIR> --d----- c:\program files\VstPlugins
2008-12-19 20:32 1,294,336 a------- c:\windows\system32\vorbis.acm
2008-12-19 20:30 <DIR> --d----- c:\program files\Image-Line
2008-12-19 19:36 1,383,424 a------- c:\windows\system32\mshtml.tlb
2008-12-17 13:29 <DIR> --d----- c:\users\yanou\appdata\roaming\Jasc
2008-12-17 13:27 <DIR> --d----- c:\program files\Jasc Software Inc
2008-12-12 18:54 51 a------- c:\windows\system32\heure.bat
2008-12-12 13:55 <DIR> --d----- c:\program files\Microzoft Windowz ++
2008-12-12 12:11 <DIR> --d----- c:\program files\Conduit
2008-12-12 12:11 <DIR> --d----- c:\program files\Habbo-FR
2008-12-12 10:06 2,048 a------- c:\windows\system32\tzres.dll
2008-12-11 20:13 <DIR> --d----- c:\program files\proxy dash
2008-12-11 17:11 2,855,424 a------- c:\windows\system32\mf.dll
2008-12-11 17:11 996,352 a------- c:\windows\system32\WMNetMgr.dll
2008-12-11 17:11 98,816 a------- c:\windows\system32\mfps.dll
2008-12-11 17:11 94,720 a------- c:\windows\system32\logagent.exe
2008-12-11 17:11 52,736 a------- c:\windows\system32\rrinstaller.exe
2008-12-11 17:11 24,576 a------- c:\windows\system32\mfpmp.exe
2008-12-11 17:11 2,048 a------- c:\windows\system32\mferror.dll
2008-12-05 13:16 268 ac--h--- C:\sqmdata19.sqm
2008-12-05 13:16 244 ac--h--- C:\sqmnoopt19.sqm
2008-12-01 18:20 253,139 a------- c:\windows\PDFCreator_Toolbar_Uninstaller_9152.exe
2008-12-01 18:20 <DIR> --d----- c:\program files\PDFCreator Toolbar
2008-12-01 18:20 137,000 a------- c:\windows\system32\MSMAPI32.OCX
2008-12-01 18:20 116,224 a------- c:\windows\system32\pdfcmnnt.dll
2008-12-01 18:20 141,312 a------- c:\windows\system32\MSCMCFR.DLL
2008-12-01 18:20 23,552 a------- c:\windows\system32\MSMPIDE.DLL
2008-12-01 18:20 <DIR> --d----- c:\program files\PDFCreator
2008-11-29 19:23 268 ac--h--- C:\sqmdata18.sqm
2008-11-29 19:23 244 ac--h--- C:\sqmnoopt18.sqm
2008-11-29 14:30 1,524,736 a------- c:\windows\system32\wucltux.dll
2008-11-29 14:29 83,456 a------- c:\windows\system32\wudriver.dll
2008-11-29 14:29 162,064 a------- c:\windows\system32\wuwebv.dll
2008-11-29 14:29 31,232 a------- c:\windows\system32\wuapp.exe
2008-11-25 20:34 410,976 a------- c:\windows\system32\deploytk.dll

==================== Find3M ====================

2008-12-22 21:48 10,934,816 a--sh--- c:\windows\system32\drivers\fidbox.dat
2008-12-22 21:48 1,474,592 a--sh--- c:\windows\system32\drivers\fidbox2.dat
2008-12-22 21:48 87,556 a--sh--- c:\windows\system32\drivers\fidbox.idx
2008-12-22 21:48 7,168 a--sh--- c:\windows\system32\drivers\fidbox2.idx
2008-12-20 15:10 690,594 a------- c:\windows\system32\perfh00C.dat
2008-12-20 15:10 117,366 a------- c:\windows\system32\perfc00C.dat
2008-12-13 10:09 174 a--sh--- c:\program files\desktop.ini
2008-12-05 13:05 8,224 a------- c:\windows\system32\GDIPFONTCACHEV1.DAT
2008-11-29 14:21 162,604 a---h--- c:\windows\system32\mlfcache.dat
2008-11-01 04:33 1,687,040 a------- c:\windows\system32\gameux.dll
2008-11-01 04:33 52,736 a------- c:\windows\apppatch\iebrshim.dll
2008-11-01 04:33 2,144,256 a------- c:\windows\apppatch\AcGenral.dll
2008-11-01 04:33 537,600 a------- c:\windows\apppatch\AcLayers.dll
2008-11-01 04:33 449,536 a------- c:\windows\apppatch\AcSpecfc.dll
2008-11-01 04:33 173,056 a------- c:\windows\apppatch\AcXtrnal.dll
2008-11-01 04:33 28,672 a------- c:\windows\system32\Apphlpdm.dll
2008-11-01 00:38 4,247,552 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2008-11-01 00:23 2,560 a------- c:\windows\apppatch\AcRes.dll
2008-10-29 07:20 2,923,520 a------- c:\windows\explorer.exe
2008-10-25 18:26 51,200 a------- c:\windows\inf\infpub.dat
2008-10-25 18:26 86,016 a------- c:\windows\inf\infstrng.dat
2008-10-25 18:26 86,016 a------- c:\windows\inf\infstor.dat
2008-10-21 06:16 297,472 a------- c:\windows\system32\gdi32.dll
2008-10-16 05:40 826,368 a------- c:\windows\system32\wininet.dll
2008-10-16 05:40 56,320 a------- c:\windows\system32\iesetup.dll
2008-10-16 05:40 26,624 a------- c:\windows\system32\ieUnatt.exe
2008-09-30 16:43 1,286,152 a------- c:\windows\system32\msxml4.dll
2008-07-19 20:20 357 a------- c:\users\yanou\.cb_layout.bin
2008-06-11 13:27 665,600 a------- c:\windows\inf\drvindex.dat
2007-12-24 18:40 119 a------- c:\users\yanou\BackupResult.DAT
2007-11-11 12:50 0 a------- c:\users\yanou\appdata\roaming\wklnhst.dat
2006-11-02 16:45 340,236 a------- c:\windows\inf\perflib\040c\perfi.dat
2006-11-02 16:45 340,236 a------- c:\windows\inf\perflib\040c\perfh.dat
2006-11-02 16:45 37,390 a------- c:\windows\inf\perflib\040c\perfd.dat
2006-11-02 16:45 37,390 a------- c:\windows\inf\perflib\040c\perfc.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
2008-09-01 16:09 16,384 a--sh--- c:\windows\temp\cookies\index.dat
2008-09-01 16:09 32,768 a--sh--- c:\windows\temp\fichiers internet temporaires\content.ie5\index.dat
2008-09-01 16:09 32,768 a--sh--- c:\windows\temp\history\history.ie5\index.dat

============= FINISH: 11:14:05,77 ===============

gen-hackman · Answer

j'attends ton rapport...........................

yann5 · Answer

DSL PROBLEME REGLE

gen-hackman · Answer

bonjour peux tu me dire comment tu as fait ?ca pourrait aider........

Destrio5 · Answer

Ton PC est bourré d'infections.

---> Désactive l'UAC le temps de la désinfection :
http://www.commentcamarche.net/faq/sujet 8343 vista desactiver l uac

- Télécharge Navilog1 (de IL-MAFIOSO) et enregistre-le sur le bureau : 
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 

- Double-clique sur Navilog1.exe afin de lancer l'installation

- Si le fix ne se lance pas automatiquement après son installation, double-clique sur Navilog1 présent sur le bureau

- Appuie sur F ou f  puis valide par Entrée

- Appuie sur une touche de ton clavier à chaque fois que cela est demandé, tu arriveras au menu des options

- Choisis l'option 1 et appuie sur la touche Entrée pour valider ton choix

- Patiente jusqu'au message : *** Analyse terminée le ..... ***

- Le scan fini, le bloc-notes contenant le rapport sera affiché, poste le contenu de ce rapport dans ta prochaine réponse

- Si le résultat du scan ne s'affiche pas, tu le trouveras dans C:\fixnavi.txt

N'utilise pas l'option 2, 3 et 4 sans notre accord, des fichiers légitimes peuvent être inclus dans ce scan.

Utilisateur anonyme · Answer

Hello
Pour suivre ;)
++

Opnnduvs.dll <== DLL Windows ou de virus ??

11 réponses

Votre réponse

Newsletters