Rapport malwarebytes

Question

Bonjour,
Pourriez vous m'aider SVP 
J'ai fait un scan avec malwarebytes et voici le rapport :

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 6.0.6000 

28/12/2008 20:33:53
mbam-log-2008-12-28 (20-33-52).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 151841
Temps écoulé: 54 minute(s), 58 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 14
Fichier(s) infecté(s): 80

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Starware370 (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\Starware370\bin (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\Starware370\icons (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\images (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FRubs (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secureesources (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370 (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\contexts (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Users\AUDREY\Local Settings\Application Data\ueomw_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\AUDREY\Local Settings\Application Data\ueomw_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\AUDREY\Local Settings\Application Data\ueomw.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\AUDREY\Local Settings\Application Data\ueomw.exe (Adware.Navipromo.H) -> Delete on reboot.
C:\Program Files\Starware370\Starware370Config.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\Starware370\Starware370Uninstall.exe (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\Starware370\bin\IELauncher.exe (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\Starware370\icons\star_16.ico (Adware.Starware) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\config.s3db (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\Gfx_fr.bin (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\language (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure
bmw (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\quarantine.s3db (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\skin (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\Spyware-Secure.url (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\Spyware-Secure_trial.exe (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\sqlite3.dll (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\uninst.exe (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\unrar.dll (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR.zip (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\explo_intro.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\explo_menu.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\file.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder_f.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder_o.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\index.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\menu3.js (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\spy.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR	rait_coud.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR	rait_droit.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR	rait_vert.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\fleche.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\folder.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\key.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\menu.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\support.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\images	itle-hepfile.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\dowload-file-antispyware.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\menu.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\scstep2.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FRubs\3differentscan.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FRubs\contactus.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FRubs\found-objects.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FRubs\lexic.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FRubs
avigtabs.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FRubs\quarantine.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secure\help\help_Trial_FRubsegister.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secureesources\cookies_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secureesources\filesDesc_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secureesources\filesDesc_1-12.dic (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secureesources\filesExt_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secureesources\filesMulti_1-12.idx (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secureesources\filesSimple_1-12.idx (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secureesources\malwaresDB_1-12 (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\Spyware-Secureesourcesegister_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\563_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\563_button_1b_over.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\572_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\572_button_1b_over.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\573_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\573_button_1b_over.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\Button_60.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\Button_60.bmp_new (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\Button_70.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\Button_70.bmp_new (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\Button_80.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\Button_80.bmp_new (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\FindIt.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\FindItHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\findithotxp.png (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\finditxp.png (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\logo.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\buttons\logoxp.bmp (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\contexts\error.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\contextselated.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Starware370\contexts	ravel.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware-Secure\Spyware-Secure trial.lnk (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware-Secure\Website.lnk (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.




Merci d'avance !!

darkpoet · Answer

télécharge hijackthis 
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download 

-> enregistre la cible sous .... "le bureau" 

-> Fais un double-clic sur "HJTInstall.exe" afin de lancer l'installation 

-> Clique sur Install ensuite sur "I Accept" 

-> Clique sur" Do a scan system and save log file" 

-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse 

-> 
http://pageperso.aol.fr/balltrap34/Hijenr.gif 
Démo : (Merci a Balltrap34 pour cette réalisation)

howdrey · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:13:21, on 28/12/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16764)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\agi\common\agservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\PSIService.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\EoRezo\EoEngine.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Kiwee Toolbar2\2.6.156\kwtbaim.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\agi\common\_agcutils.pyd
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\2.6.156\KiweeIEToolbar.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar2\2.6.156\KiweeIEToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ueomw] "c:\users\audrey\appdata\local\ueomw.exe" ueomw
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix: 
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUpldfr-fr.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-ddedb4d6eda485a5.spaces.live.com/PhotoUpload/VistaMsnPUpldfr-fr.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217148800847&h=292787890fee6a8dfe024abea7aff93e/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\agi\common\agservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

darkpoet · Answer

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau. 
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 

* Lance l'installation du programme en exécutant le fichier téléchargé. 
* Double-clique maintenant sur le raccourci de Toolbar-S&D. 
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 
* Poste le rapport généré. (C:\TB.txt)

howdrey · Answer

ça dure longtemps?

howdrey · Answer

C'est bon s'est lancé !

howdrey · Answer

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6000 ) 
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM) Duo CPU      T2450  @ 2.00GHz )
   BIOS : Default System BIOS
   USER : AUDREY ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:141 Go (Free:108 Go)
   D:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [1] ( 28/12/2008|21:21 )

   [ UAC => 1 ]

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Kiwee Toolbar2
   C:\Program Files\VMNToolbar
   C:\Program Files\VMNToolbar\install.ico
   C:\Program Files\VMNToolbar	buninstall.exe
   C:\Program Files\VMNToolbar	oolbar.ini
   C:\Program Files\VMNToolbar\uninstall.exe
   C:\Program Files\VMNToolbar\vmntoolbar.dll

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="https://actus.sfr.fr"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://actus.sfr.fr"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\AUDREY\AppData\Local\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 28/12/2008|21:24 - Option : [1]

   -----------\  Fin du rapport a 21:24:48,39

darkpoet · Answer

relance toolbarsd et fait option 2 post le rapport svp

howdrey · Answer

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6000 ) 
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM) Duo CPU      T2450  @ 2.00GHz )
   BIOS : Default System BIOS
   USER : AUDREY ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:141 Go (Free:108 Go)
   D:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 28/12/2008|21:28 )

   [ UAC => 1 ]

   -----------\ SUPPRESSION

   Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Kiwee Toolbar2
   Supprime! - C:\Program Files\VMNToolbar\install.ico
   Supprime! - C:\Program Files\VMNToolbar	buninstall.exe
   Supprime! - C:\Program Files\VMNToolbar	oolbar.ini
   Supprime! - C:\Program Files\VMNToolbar\uninstall.exe
   Supprime! - C:\Program Files\VMNToolbar\vmntoolbar.dll
   Supprime! - C:\Program Files\VMNToolbar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="https://actus.sfr.fr"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://actus.sfr.fr"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\AUDREY\AppData\Local\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 28/12/2008|21:24 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 28/12/2008|21:31 - Option : [2]

   -----------\  Fin du rapport a 21:31:46,27

darkpoet · Answer

Navilog1 est un outil dédié aux infections egdaccess/navipromo/instant access/Magic.control Agent 
Les popups "spyware Secure" sont généralement dus à un rootkit présent sur le PC. Malheureusement Ad-Aware et Spybot sont inefficaces dans ce genre d'infections. 

Important : Désactive TeaTimer, le résident de Spybot, il va gêner la désinfection en empêchant la modification des BHO. (si présent) 
# Lancez Spybot > Mode avancé > Outils >> Résident 
# Décochez la case résident "tea timer" et refermez Spybot 


Fais un clic droit sur ce lien : 
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 

Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau. 
Fais un clic droit sur navilog1.zip et choisis "tout extraire" 
Ensuite double clique sur navilog1.exe pour lancer l'installation. 
Une fois l'installation terminée, le fix s'exécutera automatiquement. 
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). 

Laisse-toi guider. Au menu principal, choisis 1 et valides. 
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord) 
Patiente jusqu'au message : 
*** Analyse Termine le ..... *** 
Appuie sur une touche comme demandé, le blocnote va s'ouvrir. 
Copie-colle l'intégralité dans une réponse. Referme le blocnote. 
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt) 
TUTO :: http://www.malekal.com/Adware.Magic_Control.php

howdrey · Answer

Euh il y a un probleme ça me dit que GetPaths.exe a cessé de fonctionner ?

darkpoet · Answer

execute le en tant qu adminstrateur

howdrey · Answer

ça me dit le scan peut durer une dizaine de minutes mais rien ne démarre ?

darkpoet · Answer

attend ca peut durer un peu il faut prendre son mal en patience
tu as plusieurs infection ca prend du temps

howdrey · Answer

Est-ce qu'il faut que je telecharge Catchme.exe?

howdrey · Answer

Il est lancé depuis plus d'une heure c'est normal?

howdrey · Answer

Oui mais comment je dois faire?

howdrey · Answer

C'est bon rapport Navilog :

Search Navipromo version 3.7.0 commencé le 28/12/2008 à 22:39:38,94

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6000 ) 
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM) Duo CPU      T2450  @ 2.00GHz )
BIOS : Default System BIOS
USER : AUDREY ( Administrator )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:141 Go (Free:108 Go)
D:\ (CD or DVD)


Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\users\audrey\appdataoaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\AUDREY\AppData\Local\virtualstore\Program Files" ***


*** Recherche dossiers dans "C:\Users\AUDREY\AppData\Roaming" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\AUDREY\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\AUDREY\AppData\Local" *



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ueomw"="\"c:\users\audrey\appdata\local\ueomw.exe\" ueomw"


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\AUDREY\AppData\Local\Microsoft" :


* Dans "C:\Users\AUDREY\AppData\Local" :


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 28/12/2008 à 23:23:12,90 ***

howdrey · Answer

OK merci !!

Voilà le rapport :

Clean Navipromo version 3.7.0 commencé le 28/12/2008 à 23:55:20,53

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6000 ) 
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM) Duo CPU      T2450  @ 2.00GHz )
BIOS : Default System BIOS
USER : AUDREY ( Administrator )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:141 Go (Free:108 Go)
D:\ (CD or DVD)


Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur

 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\Windows\System32" *


* Suppression dans "C:\Users\AUDREY\AppData\Local\Microsoft" *


* Suppression dans "C:\Users\AUDREY\AppData\Local" *



*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans c:\users\audrey\appdataoaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\AUDREY\AppData\Local\virtualstore\Program Files" ***


*** Suppression dossiers dans "C:\Users\AUDREY\AppData\Roaming" ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\AUDREY\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *


C:\Windows\prefetch\ueomw*.pf trouvé ! 
Copie C:\Windows\prefetch\ueomw*.pf réalisée avec succès !
C:\Windows\prefetch\ueomw*.pf supprimé !


* Dans "C:\Users\AUDREY\AppData\Local\Microsoft" *



* Dans "C:\Users\AUDREY\AppData\Local" *



*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !


*** Recherche autres dossiers et fichiers connus ***



*** Nettoyage terminé le 29/12/2008 à  0:07:52,63 ***

crapoulou · Answer

Télécharges Ad-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :
= = = =>>> En cliquant ici <<<= = = =

/!\ Déconnectes toi et fermes toutes applications en cours/!\

● Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. (C:\Program files )
● Double clique sur l'icône Ad-remover située sur ton bureau
● Au menu principal choisi l'option "A"
● Postes le rapport qui apparaît à la fin .

( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )

(CTRL+A Pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note :

"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

howdrey · Answer

Le logiciel marche mais je n'arrive pas a voir le rapport ?

crapoulou · Answer

( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )

howdrey · Answer

Je ne le trouve pas 

Mais je peux te dire que beaucoup de fois il y a eu d'ecrit Accés refusé

crapoulou · Answer

Normal tu as vista, c'est ça de te prendre en cours :S

Désactives l’UAC (User Account Control) le temps de la désinfection.
Démarrer, Panneau de configuration, Comptes d’utilisateurs, Désactiver le contrôle des comptes d’utilisateur.
(Manipulation inverse pour le remettre en fin de désinfection).
(Cela va permettre aux outils de désinfection de travailler correctement).

Puis réessaye.

howdrey · Answer

--------- Logfile of AD-Remover 1.0.8.0 by C_XX ---------

# START at:  0:50:10 | Mon 29/12/2008 | Microsoft® Windows Vista™ Home Premium  (v6.0.6000)
# BOOT MODE: Normal
(!) - UAC is disable

# OPTION: Scan | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

# PC: PC-DE-AUDREY | USER: AUDREY ( Current user is an administrator)

# DRIVE(S): 
- C:\  (File System: NTFS)

# Internet Explorer v7.0.6000.16764

--------- [ RUNNING PROCESSES: 67 ] ---------

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehtray.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Kiwee Toolbar2\2.6.156\kwtbaim.exe
C:\Program Files\agi\common\agservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\PSIService.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32	askeng.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\conime.exe
C:\Windows\system32
tvdm.exe
C:\Windows\system32\msfeedssync.exe

-----------------------------------


+-----------------------| Boonty/Boonty Games Elements found :

"Boonty Games" (service)
.
"HKEY_CURRENT_USER\SOFTWARE\Boonty"
"HKEY_LOCAL_MACHINE\Software\Boonty"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Boonty Games"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Boonty Games"
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Boonty Games"
.
[04/10/2008 19:43|d--------] C:\Boonty
[04/10/2008 19:45|d--------] C:\Boonty\COMPON~1
[04/10/2008 19:43|d--------] C:\Boonty\Games
[04/10/2008 19:43|--a------] C:\Boonty\COMPON~1\7_SINS~1.EXE
[04/10/2008 19:44|d--------] C:\PROGRA~1\COMMON~1\BOONTY~1
[04/10/2008 19:44|d--------] C:\PROGRA~1\COMMON~1\BOONTY~1\Service
[04/10/2008 19:44|--a------] C:\PROGRA~1\COMMON~1\BOONTY~1\Service\Boonty.exe
[04/10/2008 19:44|d--------] C:\PROGRA~2\BOONTY
[04/10/2008 19:44|d--------] C:\PROGRA~2\BOONTY\Licenses
[04/10/2008 19:45|-r-------] C:\PROGRA~2\BOONTY\Licenses\B392B000.dat
[04/10/2008 19:44|d--------] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BOONTY~1
[04/10/2008 19:45|d--------] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BOONTY~1\TLCHAR~1
[04/10/2008 19:45|--a------] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BOONTY~1\TLCHAR~1\DSINST~1.LNK
[04/10/2008 19:45|--a------] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BOONTY~1\TLCHAR~1\TLCHAR~1.LNK
[04/10/2008 19:45|--a------] C:\Users\AUDREY\AppData\Roaming\MICROS~1\Windows\Cookies\AUE429~1.TXT
[04/10/2008 19:45|--a------] C:\Users\AUDREY\AppData\Roaming\MICROS~1\Windows\Cookies\AUA0ED~1.TXT

+-----------------------| Eorezo Elements found :

"HKEY_CLASSES_ROOT\EoRezoBHO.EoBho"
"HKEY_CLASSES_ROOT\EoRezoBHO.EoBho.1"
"HKEY_CLASSES_ROOT\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}"
"HKEY_CLASSES_ROOT\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}"
"HKEY_CURRENT_USER\SOFTWARE\EoRezo"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1"
.
[31/05/2008 20:52|d--------] C:\PROGRA~1\EoRezo
[27/06/2007 13:56|--a------] C:\PROGRA~1\EoRezo\CONFME~1.CYP
[31/05/2008 20:52|d--------] C:\PROGRA~1\EoRezo\EoAdv
[16/04/2008 11:01|--a------] C:\PROGRA~1\EoRezo\EoEngine.exe
[31/05/2008 20:52|--a------] C:\PROGRA~1\EoRezo\eoEngine.url
[04/03/2008 15:13|--a------] C:\PROGRA~1\EoRezo\EOMULT~1.DLL
[15/06/2007 14:49|--a------] C:\PROGRA~1\EoRezo\EOREZO~1.DLL
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\EOREZO~3.DLL
[09/05/2007 16:57|--a------] C:\PROGRA~1\EoRezo\EO6119~1.DLL
[15/06/2007 14:49|--a------] C:\PROGRA~1\EoRezo\EO611D~1.DLL
[06/07/2007 15:55|--a------] C:\PROGRA~1\EoRezo\EO6111~1.DLL
[14/08/2007 13:45|--a------] C:\PROGRA~1\EoRezo\EO6115~1.DLL
[03/09/2007 12:22|--a------] C:\PROGRA~1\EoRezo\EO4511~1.DLL
[04/03/2008 15:14|--a------] C:\PROGRA~1\EoRezo\EO4515~1.DLL
[07/01/2008 12:07|--a------] C:\PROGRA~1\EoRezo\EO5519~1.DLL
[04/03/2008 12:31|--a------] C:\PROGRA~1\EoRezo\EO551D~1.DLL
[05/03/2008 17:39|--a------] C:\PROGRA~1\EoRezo\EO5511~1.DLL
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\EOREZO~2.DLL
[09/05/2007 16:57|--a------] C:\PROGRA~1\EoRezo\EOREZO~4.DLL
[15/06/2007 14:49|--a------] C:\PROGRA~1\EoRezo\EO5CF5~1.DLL
[06/07/2007 15:55|--a------] C:\PROGRA~1\EoRezo\EO6CF9~1.DLL
[14/08/2007 12:11|--a------] C:\PROGRA~1\EoRezo\EO6CFD~1.DLL
[24/08/2007 16:15|--a------] C:\PROGRA~1\EoRezo\EO400A~1.DLL
[04/03/2008 15:14|--a------] C:\PROGRA~1\EoRezo\EO400E~1.DLL
[04/03/2008 12:31|--a------] C:\PROGRA~1\EoRezo\EO4002~1.DLL
[20/03/2008 12:57|--a------] C:\PROGRA~1\EoRezo\EO4006~1.DLL
[02/04/2008 15:07|--a------] C:\PROGRA~1\EoRezo\EO500A~1.DLL
[16/04/2008 11:00|--a------] C:\PROGRA~1\EoRezo\EO500E~1.DLL
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\FREEIM~1.DLL
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\Host.cyp
[17/08/2007 15:36|--a------] C:\PROGRA~1\EoRezo\ICON_E~1.ICO
[31/05/2008 20:52|d--------] C:\PROGRA~1\EoRezo\lang
[27/03/2008 13:56|--a------] C:\PROGRA~1\EoRezo\MNGINS~1.DLL
[31/05/2008 20:52|--a------] C:\PROGRA~1\EoRezo\unins000.dat
[31/05/2008 20:52|--a------] C:\PROGRA~1\EoRezo\unins000.exe
[21/12/2007 10:23|--a------] C:\PROGRA~1\EoRezo\user.cyp
[09/05/2007 16:57|--a------] C:\PROGRA~1\EoRezo\EoAdv\EoAdv.dll
[31/05/2008 20:52|--a------] C:\PROGRA~1\EoRezo\EoAdv\eoAdv.url
[31/05/2008 20:52|d--------] C:\PROGRA~1\EoRezo\EoAdv	mp
[25/01/2007 09:22|--a------] C:\PROGRA~1\EoRezo\EoAdv	mp\EOREZO~1.584
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\lang\IHM_EO~3.XML
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\lang\IH935B~1.XML
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\lang\IHM_EO~1.XML
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\lang\IH0447~1.XML
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\lang\IHM_EO~2.XML
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\lang\IHM_EO~4.XML
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\lang\lang_en.xml
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\lang\lang_es.xml
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\lang\lang_fr.xml
[26/06/2007 14:33|--a------] C:\PROGRA~1\EoRezo\lang\lang_it.xml
[28/12/2008 23:28|d--------] C:\Users\AUDREY\AppData\Roaming\EoRezo
[28/12/2008 22:47|--a------] C:\Users\AUDREY\AppData\Roaming\EoRezo\cmhost.cyp
[28/12/2008 23:28|--a------] C:\Users\AUDREY\AppData\Roaming\EoRezo\CONFME~1.CYP
[04/12/2008 20:27|d--------] C:\Users\AUDREY\AppData\Roaming\EoRezo\db
[28/12/2008 23:28|d--------] C:\Users\AUDREY\AppData\Roaming\EoRezo\EODESK~1
[28/12/2008 22:47|--a------] C:\Users\AUDREY\AppData\Roaming\EoRezo\host.cyp
[28/12/2008 22:47|--a------] C:\Users\AUDREY\AppData\Roaming\EoRezo\user.cyp
[04/12/2008 20:27|--a------] C:\Users\AUDREY\AppData\Roaming\EoRezo\db\cat.cyp
[28/12/2008 23:28|--a------] C:\Users\AUDREY\AppData\Roaming\EoRezo\EODESK~1\config.xml
[28/12/2008 23:28|--a------] C:\Users\AUDREY\AppData\Roaming\EoRezo\EODESK~1\EODESK~1.HTM
[28/12/2008 23:28|--a------] C:\Users\AUDREY\AppData\Roaming\EoRezo\EODESK~1\USERCO~1.XML
[31/05/2008 20:52|d--------] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\EoRezo
[31/05/2008 20:52|--a------] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\EoRezo\EoEngine.lnk
[03/12/2008 11:15|--a------] C:\Users\AUDREY\AppData\Roaming\MICROS~1\Windows\Cookies\AU5E73~1.TXT

+-----------------------| Everest Poker Elements found :

.
[18/11/2007 14:44|d--------] C:\PROGRA~1\EVERES~1
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\casino.exe
[18/11/2007 14:38|--a------] C:\PROGRA~1\EVERES~1\CStart.exe
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data
[18/11/2007 14:38|--a------] C:\PROGRA~1\EVERES~1\EVERES~1.EXE
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\gvbase.dll
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\gvcrt.dll
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\GVGFX-~1.DLL
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\gvgfx.dll
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\gvmain.dll
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\gvmain.exe
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\GVNETW~1.DLL
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\gvsound.dll
[18/11/2007 14:38|--a------] C:\PROGRA~1\EVERES~1\init.ini
[18/11/2007 14:44|--a------] C:\PROGRA~1\EVERES~1\log.dat
[18/11/2007 14:44|--a------] C:\PROGRA~1\EVERES~1\settings.ini
[18/11/2007 14:44|--a------] C:\PROGRA~1\EVERES~1	oc_fr.ini
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\var
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\cpanel
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\fonts
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\mp-lobby
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\mp-poker
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\shared
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\startup
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\cpanel\shared.gvt
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\fonts\kgp-en.ttf
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\mp-lobby\fr.gvt
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\mp-lobby\shared.gvt
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\mp-poker\BACKGR~1
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\mp-poker\fr
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\mp-poker\shared.gvt
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\mp-poker\BACKGR~1\default.gvt
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\mp-poker\fr\bitmaps.gvt
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\mp-poker\fr\MP-POK~1.TXT
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\mp-poker\fr\MP-POK~2.TXT
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\shared\fr
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\shared\shared
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\shared\fr\country.txt
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\shared\fr\language.txt
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\shared\fr\ordinal.txt
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\shared\shared\bitmaps
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\shared\shared\sounds
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\shared\shared\bitmaps\BTN_SC~1.GVT
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\shared\shared\bitmaps\check.art
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\shared\shared\bitmaps\chips.art
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\shared\shared\sounds\button.ogg
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\shared\shared\sounds\carddeal.ogg
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\shared\shared\sounds\cardflip.ogg
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\shared\shared\sounds\CHIPCL~1.OGG
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\startup\en
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\startup\fr
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\startup\shared
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\startup\en\STARTU~1.TXT
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\startup\fr\cstart.txt
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\startup\fr\STARTU~1.TXT
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\startup\shared\bitmaps
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\startup\shared\icons
[18/11/2007 14:39|d--------] C:\PROGRA~1\EVERES~1\data\startup\shared\sounds
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\startup\shared\bitmaps\SPLASH~1.ART
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\startup\shared\icons\ep.ico
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\data\startup\shared\sounds\alert.ogg
[18/11/2007 14:39|--a------] C:\PROGRA~1\EVERES~1\var\CONTEN~1.DAT
[18/11/2007 14:39|d--------] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\EVERES~1
[18/11/2007 14:39|--a------] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\EVERES~1\EVERES~1.LNK
[18/11/2007 14:39|--a------] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\EVERES~1\UNINST~1.LNK

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found :

.

+-----------------------| It's TV Elements found :

"HKEY_CURRENT_USER\Software\ItsLabel\ItsTV"
"HKEY_LOCAL_MACHINE\SOFTWARE\ItsLabel"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ItsTV_is1"
"HKEY_USERS\S-1-5-21-1033721620-3049051530-2943172277-1002\Software\ItsLabel"
.
[31/05/2008 20:53|d--------] C:\PROGRA~1\ItsLabel
[26/04/2007 15:19|--a------] C:\PROGRA~1\ItsLabel\ItsTV.exe
[31/05/2008 20:53|--a------] C:\PROGRA~1\ItsLabel\ItsTV.url
[26/04/2007 17:54|--a------] C:\PROGRA~1\ItsLabel\ItsTV.xml
[19/04/2007 16:54|--a------] C:\PROGRA~1\ItsLabel\Loading.swf
[31/05/2008 20:53|--a------] C:\PROGRA~1\ItsLabel\unins000.dat
[31/05/2008 20:53|--a------] C:\PROGRA~1\ItsLabel\unins000.exe
[31/05/2008 21:30|d--------] C:\Users\AUDREY\AppData\Roaming\ItsLabel
[28/12/2008 18:23|d--------] C:\Users\AUDREY\AppData\Roaming\ItsLabel\ItsTV
[19/12/2008 17:34|--a------] C:\Users\AUDREY\AppData\Roaming\ItsLabel\ItsTV\itsTV.xml
[31/05/2008 20:53|d--------] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\ItsLabel
[31/05/2008 20:53|--a------] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\ItsLabel\ItsTV.lnk

+-----------------------| Sweetim Elements found :

.

+-----------------------| ADDED SCAN :



+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

...\h2girbgf.default\prefs.js :

~~~~ Mozilla FireFox version 3.0.1 ~~~~

* Browser Search Default Engine:  "Live Search"
* Browser Search Selected Engine:  "Live Search"
* Browser Search Default Url:  "https://www.bing.com/?scope=web&mkt=fr-FR&FORM=IEFM1"
* Browser Startup HomePage:  "https://www.msn.com/fr-fr/?ocid=iehp"

+----------+


+---------------------------------------------------------------------------+

+--[HKEY_CURRENT_USER\..\Run]

Sidebar    REG_SZ    C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
(par d‚faut)    REG_SZ    
StartCCC    REG_SZ    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
msnmsgr    REG_SZ    "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
swg    REG_SZ    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
ehTray.exe    REG_SZ    C:\Windows\ehome\ehTray.exe

+--[HKEY_LOCAL_MACHINE\..\Run]

SynTPEnh    REG_SZ    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
RtHDVCpl    REG_SZ    RtHDVCpl.exe
(par d‚faut)    REG_SZ    
Google Desktop Search    REG_SZ    "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
Adobe Reader Speed Launcher    REG_SZ    "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
SunJavaUpdateSched    REG_SZ    "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
QuickTime Task    REG_SZ    "C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper    REG_SZ    "C:\Program Files\iTunes\iTunesHelper.exe"
ISTray    REG_SZ    "C:\Program Files\Spyware Doctor\pctsTray.exe"

+--[HKEY_USERS\.DEFAULT\..\Run]

Picasa Media Detector    REG_SZ    C:\Program Files\Picasa2\PicasaMediaDetector.exe

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://go.microsoft.com/fwlink/?LinkId=69157

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://www.msn.com/

+---------------------------------------------------------------------------+

- "C:\AD-report-Scan-29.12.2008.log" (~18204 bytes)

# END at:  0:51:57 | 29/12/2008 - Time elapsed: 1 minute, 47 seconds 

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 302 lines ]
+---------------------------------------------------------------------------+

crapoulou · Answer

▶ ! Déconnecte toi et fermes toutes applications en cours ! ▶ Relance "Ad-remover" : au menu principal choisi l'option "B". = = = =>>> Comme sur cette image <<<= = = = ▶ Ensuite coche: Boonty Eorezo Everest Poker It's TV En tapant chaque numéro puis entrée ▶ Puis "S" ▶ le programme va travailler ... ▶ Postes le rapport qui apparaît à la fin + un nouvel Hijackthis pour analyse ... ( le rapport est sauvegardé aussi sous C:\Ad-report.log ) /!\ Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides) /!\

howdrey · Answer

--------- Logfile of AD-Remover 1.0.8.0 by C_XX ---------

*** Limited to ***

Boonty/BoontyGames
Eorezo
Everest Poker
It's TV

******************

# START at:  1:04:30 | Mon 29/12/2008 | Microsoft® Windows Vista™ Home Premium  (v6.0.6000)
# BOOT MODE: Normal
(!) - UAC is disable

# OPTION: Clean | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

# PC: PC-DE-AUDREY | USER: AUDREY ( Current user is an administrator)

# DRIVE(S): 
- C:\  (File System: NTFS)

# Internet Explorer v7.0.6000.16764

--------- [ RUNNING PROCESSES: 63 ] ---------

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehtray.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Kiwee Toolbar2\2.6.156\kwtbaim.exe
C:\Program Files\agi\common\agservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\PSIService.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32	askeng.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32	askeng.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32
tvdm.exe

-----------------------------------

(!) ---- IE start pages reset

+-----------------------| Boonty/Boonty Games Elements Deleted :

"Boonty Games" (service)
.
"HKEY_CURRENT_USER\SOFTWARE\Boonty"
"HKEY_LOCAL_MACHINE\Software\Boonty"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Boonty Games"
.
[04/10/2008 19:43|d--------] C:\Boonty
[04/10/2008 19:44|d--------] C:\DOCUME~1\ALLUSE~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\DOCUME~1\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\BOONTY
[|] C:\PROGRA~2\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\PROGRA~2\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[|] C:\Users\ALLUSE~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\APPLIC~1\BOONTY
[04/10/2008 19:44|d--------] C:\Program Files\Common Files\BOONTY Shared
[04/10/2008 19:44|d--------] C:\ProgramData\Microsoft\Windows\STARTM~1\Programs\BoontyGames
[04/10/2008 19:45|--a------] C:\Users\AUDREY\AppData\Roaming\MICROS~1\Windows\Cookies\AUE429~1.TXT
[04/10/2008 19:45|--a------] C:\Users\AUDREY\AppData\Roaming\MICROS~1\Windows\Cookies\AUA0ED~1.TXT

+-----------------------| Eorezo Elements Deleted :

"HKEY_CLASSES_ROOT\EoRezoBHO.EoBho"
"HKEY_CLASSES_ROOT\EoRezoBHO.EoBho.1"
"HKEY_CLASSES_ROOT\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}"
"HKEY_CLASSES_ROOT\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}"
"HKEY_CURRENT_USER\SOFTWARE\EoRezo"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1"
.
[31/05/2008 20:52|d--------] C:\Program Files\EoRezo
[28/12/2008 23:28|d--------] C:\Users\AUDREY\AppData\Roaming\EoRezo
[31/05/2008 20:52|d--------] C:\ProgramData\Microsoft\Windows\STARTM~1\Programs\EoRezo
[03/12/2008 11:15|--a------] C:\Users\AUDREY\AppData\Roaming\MICROS~1\Windows\Cookies\AU5E73~1.TXT

+-----------------------| Everest Poker Elements Deleted :

.
[18/11/2007 14:44|d--------] C:\Program Files\Everest Poker
[18/11/2007 14:39|d--------] C:\ProgramData\Microsoft\Windows\STARTM~1\Programs\Everest Poker

+-----------------------| It's TV Elements Deleted :

"HKEY_CURRENT_USER\Software\ItsLabel\ItsTV"
"HKEY_LOCAL_MACHINE\SOFTWARE\ItsLabel"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ItsTV_is1"
"HKEY_USERS\S-1-5-21-1033721620-3049051530-2943172277-1002\Software\ItsLabel"
.
[31/05/2008 20:53|d--------] C:\Program Files\ItsLabel
[31/05/2008 21:30|d--------] C:\Users\AUDREY\AppData\Roaming\ItsLabel
[31/05/2008 20:53|d--------] C:\ProgramData\Microsoft\Windows\STARTM~1\Programs\ItsLabel

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


+-----------------------| ADDED SCAN :

+--[HKEY_CURRENT_USER\..\Run]

Sidebar    REG_SZ    C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
(par d‚faut)    REG_SZ    
StartCCC    REG_SZ    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
msnmsgr    REG_SZ    "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
swg    REG_SZ    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
ehTray.exe    REG_SZ    C:\Windows\ehome\ehTray.exe

+--[HKEY_LOCAL_MACHINE\..\Run]

SynTPEnh    REG_SZ    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
RtHDVCpl    REG_SZ    RtHDVCpl.exe
(par d‚faut)    REG_SZ    
Google Desktop Search    REG_SZ    "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
Adobe Reader Speed Launcher    REG_SZ    "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
SunJavaUpdateSched    REG_SZ    "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
QuickTime Task    REG_SZ    "C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper    REG_SZ    "C:\Program Files\iTunes\iTunesHelper.exe"
ISTray    REG_SZ    "C:\Program Files\Spyware Doctor\pctsTray.exe"

+--[HKEY_USERS\.DEFAULT\..\Run]

Picasa Media Detector    REG_SZ    C:\Program Files\Picasa2\PicasaMediaDetector.exe

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://fr.msn.com/

+---------------------------------------------------------------------------+

- "C:\AD-report-Clean-29.12.2008.log" (~11125 bytes)

- "C:\AD-report-Scan-29.12.2008.log" (~18548 bytes)

# END at:  1:22:39 | 29/12/2008 - Time elapsed: 18 minutes, 9 seconds 

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 191 lines ]
+---------------------------------------------------------------------------+

howdrey · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:26:16, on 29/12/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16764)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehtray.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Kiwee Toolbar2\2.6.156\kwtbaim.exe
C:\Program Files\agi\common\agservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\PSIService.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32	askeng.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32undll32.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\agi\common\_agcutils.pyd
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217148800847&h=292787890fee6a8dfe024abea7aff93e/&filename=jinstall-6u7-windows-i586-jc.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\agi\common\agservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

howdrey · Answer

Alors tu en penses quoi?

crapoulou · Answer

Je t'envoie plusieurs procédures pour gagner du temps car je vais me coucher. Télécharges ToolBar S&D ( de Eric_71 ) = = = = >>> En cliquant ici <<< = = = = Tuto si besoin en cliquant ICI !! Déconnectes toi et fermes toute tes applications en cours le temps de la manipulation !! * Double-cliques sur l’exécutable pour lancer l’outil * Une fois fait, tape F pour sélectionner le Français * Choisis l’option 1 (Recherche) et tape sur Entrée. * Une fois le scan finit, un rapport va apparaître au format .txt. * Copie-colle l’intégralité de son contenu dans ta prochaine réponse ... Note : Le rapport est sauvegardé ici : C:\TB.txt *********************** Pour supprimer les anciennes versions de Java et télécharger la nouvelle, Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries sur ton Bureau : = = = =>>> En cliquant ici <<<= = = = * Décompresse le fichier sur le Bureau (Clic droit > Extraire tout). * Double-clique sur le répertoire JavaRa * Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher). * Clique sur Search For Updates * Sélectionne Update Using jucheck.exe puis clique sur Search. * Autorise le processus à se connecter s'il le demande, clique sur Install et suis les instructions d'installation qui prennent quelques minutes * L'installation est terminée * Reviens à l'écran de JavaRa et clique sur Remove Older Versions. * Clique sur Oui pour confirmer. Laisse travailler et clique ensuite sur Ok, puis une deuxième fois sur Ok. * Un rapport va s'ouvrir. Poste-le dans ta prochaine réponse. * Ferme l'application. Note : le rapport se trouve aussi dans C:\ sous le nom JavaRa.log. *********************** Analyse ce fichier : C:\Program Files\agi\common\_agcutils.pyd Sur le site de virustotal : https://www.virustotal.com/gui/ Parcourir > Sélectionne ton fichier > Analyser, patiente que l’analyse soit terminée. Poste le rapport. *********************** Poste bien tous les rapports. A demain.

howdrey · Answer

Euh je le ferais demain parce que là je n'en peux plus

Merci !!

crapoulou · Answer

Ok, tiens moi bien au courant.
Bonne nuit.

howdrey · Answer

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6000 ) 
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM) Duo CPU      T2450  @ 2.00GHz )
   BIOS : Default System BIOS
   USER : AUDREY ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:141 Go (Free:109 Go)
   D:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [1] ( 29/12/2008|11:20 )

   [ UAC => 0 ]

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="https://actus.sfr.fr"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://actus.sfr.fr"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\AUDREY\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\AppData\Local\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\AppData\Local\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\AppData\Local\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\AppData\Local\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\AppData\Local\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\Local Settings\Application Data\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\Local Settings\Application Data\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\Local Settings\Application Data\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\Local Settings\Application Data\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT
   C:\Users\AUDREY\Local Settings\VirtualStore\Program Files\GoPets Ltd\Effect\motion\effect_all firecracke.EMT


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 28/12/2008|21:24 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 28/12/2008|21:31 - Option : [2]
   3 - "C:\ToolBar SD\TB_3.txt" - 28/12/2008|23:17 - Option : [2]
   4 - "C:\ToolBar SD\TB_4.txt" - 29/12/2008|11:24 - Option : [1]

   -----------\  Fin du rapport a 11:24:47,16

howdrey · Answer

JavaRa 1.13 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Dec 29 11:36:59 2008

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.6.0_07\bin\

------------------------------------

Finished reporting.



JavaRa 1.13 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Dec 29 11:37:15 2008

------------------------------------

Finished reporting.

howdrey · Answer

Je n'arrive pas à aller sur virustotal.com/fr/

howdrey · Answer

up !

howdrey · Answer

up !

SVP

crapoulou · Answer

En effet, leur serveur doit avoir un souci !
Essaye ICI

howdrey · Answer

Je ne comprends pas comment utiliser ?

crapoulou · Answer

Parcourir > Sélectionne ton fichier (C:\Program Files\agi\common\_agcutils.pyd)> clic sur Submit, patiente que l’analyse soit terminée.

howdrey · Answer

Scan taken on 29 Dec 2008 17:17:21 (GMT)
A-Squared 	
Found nothing
AntiVir 	
Found nothing
ArcaVir 	
Found nothing
Avast 	
Found nothing
AVG Antivirus 	
Found nothing
BitDefender 	
Found nothing
ClamAV 	
Found nothing
CPsecure 	
Found nothing
Dr.Web 	
Found nothing
F-Prot Antivirus 	
Found nothing
F-Secure Anti-Virus 	
Found nothing
G DATA 	
Found nothing
Ikarus 	
Found nothing
Kaspersky Anti-Virus 	
Found nothing
NOD32 	
Found nothing
Norman Virus Control 	
Found nothing
Panda Antivirus 	
Found nothing
Sophos Antivirus 	
Found nothing
VirusBuster 	
Found nothing
VBA32 	
Found nothing

howdrey · Answer

Crapoulou ?

crapoulou · Answer

Télécharge Random’s System Information Tool (RSIT) de random/random et enregistre l’exécutable sur le Bureau. = = = = >>> En cliquant ici <<< = = = = * Double-clique sur RSIT.exe pour le lancer. * Une première fenêtre s’ouvre, clique alors sur Continue (Disclaimer). * Si la dernière version de HijackThis n’est pas détectée sur ton PC, RSIT le téléchargera et te demandera d’accepter la licence. * Lorsque l’analyse sera terminée, deux fichiers texte s’ouvriront (probablement avec le bloc-notes). * Poste le contenu de log.txt (c’est celui qui apparaît à l’écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

howdrey · Answer

Logfile of random's system information tool 1.05 (written by random/random)
Run by AUDREY at 2008-12-29 20:20:16
Microsoft® Windows Vista™ Édition Familiale Premium  
System drive C: has 112 GB (78%) free of 144 GB
Total RAM: 895 MB (18% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:20:44, on 29/12/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16764)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\Kiwee Toolbar2\2.6.156\kwtbaim.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\agi\common\agservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\PSIService.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\UI0Detect.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32	askeng.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\AUDREY\Downloads\RSIT.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\AUDREY.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\agi\common\_agcutils.pyd
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217148800847&h=292787890fee6a8dfe024abea7aff93e/&filename=jinstall-6u7-windows-i586-jc.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\agi\common\agservice.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

howdrey · Answer

info.txt logfile of random's system information tool 1.05 2008-12-29 20:20:56

======Uninstall list======

-->MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF}
-->MsiExec.exe /I{0D330013-4A99-46D6-83C6-2C959C68DBFF}
-->MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87}
-->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
-->MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
-->MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82}
-->MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Adobe Reader 8-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *AdobeReader*
Adobe Shockwave Player 11-->C:\Windows\system32\adobe\SHOCKW~1\UNWISE.EXE C:\Windows\system32\Adobe\SHOCKW~1\Install.log
Adobe Shockwave Player-->MsiExec.exe /X{A7DB362E-16DC-4E29-8A34-E74381E00B5B}
Ad-remover-->C:\Program Files\Ad-remover\Uninstal.exe
ADSL Neuf-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *NEUF_FR*
Apple Mobile Device Support-->MsiExec.exe /I{49C88E44-1B38-4FC6-824E-2BDA3063B0E3}
Apple Software Update-->MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
Assistant de connexion Windows Live-->MsiExec.exe /I{D6E592B3-67DA-4BBB-9783-E1838FB253A2}
Atheros Driver Installation Program-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{28006915-2739-4EBE-B5E8-49B25D32EB33}\setup.exe" -l0x40c  -removeonly
ATK Hotkey-->C:\Program Files\InstallShield Installation Information\{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}\Setup.exe -runfromtemp -l0x0009 -removeonly
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Bison 11/28/2006,6.32.03.002-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *CMOS*
Bonjour-->MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
Browser Address Error Redirector-->regsvr32 /u /s "C:\Program Files\Google\Google_BAE\BAE.dll"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Corel Paint Shop Pro Photo X2-->MsiExec.exe /X{64E72FB1-2343-4977-B4A8-262CD53D0BD3}
Creator 9-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *CREATOR9*
Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{EFFCB0F1-CFEC-48D4-B793-EBFCAE852976}
Favorit-->c:\users\audrey\appdata\local\sxdins.bat
Firefox-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *FirefoxFR*
Flash Player 9 Internet Explorer-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Flashplayer*
Galerie de photos Windows Live-->MsiExec.exe /X{43563ACB-371B-4C58-8979-B192B390424C}
Gif Movie Gear 4-->"C:\Program Files\Visicom Media\GifMovieGear 4\uninst-gmg.exe"
Google BAE-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GoogleBAE*
Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Earth-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GOOGLE_EARTH*
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar3.dll"
GoogleDesktop-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GoogleDesktop*
GoogleToolbar-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GoogleToolbar*
GoPets-->"C:\Program Files\GoPets Ltd\Uninstall GoPets.exe"
HDReg France-->MsiExec.exe /I{0ED40D2A-7131-4FE7-941E-5C329336F712}
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Infocentre Rev. 2.0-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Infocentre*
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{3CCB732A-E472-4CF9-B1EE-F18365341FE0}
iTunes-->MsiExec.exe /I{3DE0053C-FD9A-483E-B7C9-B06E4392206E}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Junk Mail filter update-->MsiExec.exe /I{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}
Kiwee Toolbar-->MsiExec.exe /X{6252AFEB-930F-4A08-84D2-58F3ED5568B2}
LimeWire 4.18.3-->"C:\Program Files\LimeWire\uninstall.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{3585ED1C-74C5-43B0-A232-831B96A12A2B}
Metaboli-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *METABOLI*
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Search Enhancement Pack-->MsiExec.exe /I{299CF645-48C7-4FA1-8BCD-5CE200CF180D}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Mozilla Firefox (3.0.1)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Navilog1 3.7.0-->"C:\Program Files\Navilog1\unins000.exe"
Neuf - Kit de connexion-->C:\Program Files\Neuf\Kit\uninstall.exe
Norton Security Scan-->MsiExec.exe /I{230C4A45-2586-4161-84EF-5C0D75D5B270}
OpenOffice.org Installer 1.0-->MsiExec.exe /X{3A2AF807-9F9F-43C9-A24A-17B617238B74}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Packard Bell Demo-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *PB_DEMO*
Packard Bell ImageWriter-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *ImageWriter*
Packard Bell LCD Test-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *LCDTest*
Packard Bell Updator-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Updator*
PeerGuardian 2.0-->"C:\Program Files\PeerGuardian2\unins000.exe"
PhotoFiltre Studio-->"C:\Program Files\PhotoFiltre Studio\Uninst.exe"
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
Picasa 2-->"C:\Program Files\Picasa2\Uninstall.exe"
QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista-->C:\Program Files\InstallShield Installation Information\{AE46ABD3-D625-467F-B5A7-8D3FFF077F0D}\setup.exe -runfromtemp -l0x040c -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c  -removeonly
Roxio Creator 9 LE-->MsiExec.exe /I{B7FB0C86-41A4-4402-9A33-912C462042A0}
SetUp My PC-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *SETUPMYPC_FR*
Shockwave player 10-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Shockwave*
Skype 2.5.2.151-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *SKYPE*
Skype™ 3.6-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Spyware Doctor 6.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Téléchargeur de 7 Sins fr-->"C:\Program Files\Téléchargeur de 7 Sins\unins000.exe"
USB2.0 350K WebCam-->Rundll32.exe BisonRem.dll,WinMainRmv
Video ATI v8.332-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *VIDEO_RIO*
VirginMega.Fr Premium-->MsiExec.exe /I{EE467474-04A8-48D5-8DDF-0F8D3A3CCBE5}
VMN Toolbar-->C:\Program Files\vmntoolbar\uninstall.exe
WebAnim Gif 3.0-->"C:\Program Files\WebAnim Gif 3\unins000.exe"
Wildlife Park 2 Horses-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2EE37EFC-CDF1-4B4C-8977-BDCC57DF96F8}\setup.exe" -l0x40c  -removeonly
Windows Live Call-->MsiExec.exe /I{01523985-2098-43AF-9C97-12B07BE02A9B}
Windows Live Communications Platform-->MsiExec.exe /I{F69E83CF-B440-43F8-89E6-6EA80712109B}
Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Live Sync-->MsiExec.exe /X{67D0313C-4F15-437D-9A2D-C1564088A26A}
Windows Live Toolbar-->MsiExec.exe /X{915809D6-1F93-45F2-9699-5F1DA64DC24B}
Windows Live Writer-->MsiExec.exe /X{2231CE39-B963-4B9D-823A-F412ECA637B1}

======Security center information======

AV: Avira AntiVir PersonalEdition Classic
AS: Spyware Doctor
AS: Windows Defender

System event log

Computer Name: PC-de-AUDREY
Event Code: 7036
Message: Le service Recherche Windows est entré dans l'état : en cours d'exécution.
Record Number: 121074
Source Name: Service Control Manager
Time Written: 20081229191106.000000-000
Event Type: Information
User: 

Computer Name: PC-de-AUDREY
Event Code: 7036
Message: Le service Prise en charge de l’application Rapports et solutions aux problèmes du Panneau de configuration est entré dans l'état : en cours d'exécution.
Record Number: 121075
Source Name: Service Control Manager
Time Written: 20081229191737.000000-000
Event Type: Information
User: 

Computer Name: PC-de-AUDREY
Event Code: 7036
Message: Le service Prise en charge de l’application Rapports et solutions aux problèmes du Panneau de configuration est entré dans l'état : arrêté.
Record Number: 121076
Source Name: Service Control Manager
Time Written: 20081229191742.000000-000
Event Type: Information
User: 

Computer Name: PC-de-AUDREY
Event Code: 10029
Message: DCOM a démarré le service TrustedInstaller avec les arguments «  » de façon à exécuter le serveur :
{752073A1-23F2-4396-85F0-8FDB879ED0ED}
Record Number: 121077
Source Name: Microsoft-Windows-DistributedCOM
Time Written: 20081229191928.000000-000
Event Type: Information
User: 

Computer Name: PC-de-AUDREY
Event Code: 7036
Message: Le service Programme d’installation de modules Windows est entré dans l'état : en cours d'exécution.
Record Number: 121078
Source Name: Service Control Manager
Time Written: 20081229191936.000000-000
Event Type: Information
User: 

Application event log

Computer Name: PC-de-AUDREY
Event Code: 1
Message: Le client des services de certification a démarré correctement.
Record Number: 79248326
Source Name: Microsoft-Windows-CertificateServicesClient
Time Written: 20081229190623.589024-000
Event Type: Information
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-AUDREY
Event Code: 0
Message: 
Record Number: 79248327
Source Name: iPod Service
Time Written: 20081229190635.000000-000
Event Type: Information
User: 

Computer Name: PC-de-AUDREY
Event Code: 1000
Message: Un périphérique ou programme a requis l’attention. Périphérique ou application : C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe. Titre du message : Microsoft Visual C++ Runtime Library.
Record Number: 79248328
Source Name: Interactive Services detection
Time Written: 20081229190741.000000-000
Event Type: Information
User: 

Computer Name: PC-de-AUDREY
Event Code: 1
Message: Le service Centre de sécurité Windows a démarré.
Record Number: 79248329
Source Name: SecurityCenter
Time Written: 20081229190837.000000-000
Event Type: Information
User: 

Computer Name: PC-de-AUDREY
Event Code: 1003
Message: Le service Recherche Windows a été démarré.

Record Number: 79248330
Source Name: Microsoft-Windows-Search
Time Written: 20081229191105.000000-000
Event Type: Information
User: 

Security event log

Computer Name: PC-de-AUDREY
Event Code: 4672
Message: Privilèges spéciaux attribués à la nouvelle ouverture de session.

Sujet :
	ID de sécurité :		S-1-5-21-1033721620-3049051530-2943172277-1002
	Nom du compte :		AUDREY
	Domaine du compte :		PC-de-AUDREY
	ID d’ouverture de session :		0x19d69c5

Privilèges :		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
Record Number: 21196
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080816205014.279536-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-AUDREY
Event Code: 4634
Message: Fermeture de session d’un compte.

Sujet :
	ID de sécurité :		S-1-5-21-1033721620-3049051530-2943172277-1002
	Nom du compte :		AUDREY
	Domaine du compte :		PC-de-AUDREY
	ID du compte :		0x19d69e4

Type d’ouverture de session :			7

Cet événement est généré lorsqu’une session ouverte est supprimée. Il peut être associé à un événement d’ouverture de session en utilisant la valeur ID d’ouverture de session. Les ID d’ouverture de session ne sont uniques qu’entre les redémarrages sur un même ordinateur.
Record Number: 21197
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080816205015.731591-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-AUDREY
Event Code: 4634
Message: Fermeture de session d’un compte.

Sujet :
	ID de sécurité :		S-1-5-21-1033721620-3049051530-2943172277-1002
	Nom du compte :		AUDREY
	Domaine du compte :		PC-de-AUDREY
	ID du compte :		0x19d69c5

Type d’ouverture de session :			7

Cet événement est généré lorsqu’une session ouverte est supprimée. Il peut être associé à un événement d’ouverture de session en utilisant la valeur ID d’ouverture de session. Les ID d’ouverture de session ne sont uniques qu’entre les redémarrages sur un même ordinateur.
Record Number: 21198
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080816205015.732568-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-AUDREY
Event Code: 4648
Message: Tentative d’ouverture de session en utilisant des informations d’identification explicites.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		PC-DE-AUDREY$
	Domaine du compte :		WORKGROUP
	ID d’ouverture de session :		0x3e7
	GUID d’ouverture de session :		{00000000-0000-0000-0000-000000000000}

Compte dont les informations d’identification ont été utilisées :
	Nom du compte :		AUDREY
	Domaine du compte :		PC-de-AUDREY
	GUID d’ouverture de session :		{00000000-0000-0000-0000-000000000000}

Serveur cible :
	Nom du serveur cible :	localhost
	Informations supplémentaires :	localhost

Informations sur le processus :
	ID du processus :		0x2e8
	Nom du processus :		C:\Windows\System32\winlogon.exe

Informations sur le réseau :
	Adresse du réseau :	127.0.0.1
	Port :			0

Cet événement est généré lorsqu’un processus tente d’ouvrir une session pour un compte en spécifiant explicitement les informations d’identification de ce compte. Ceci se produit le plus souvent dans les configurations par lot comme les tâches planifiées, ou avec l’utilisation de la commande RUNAS.
Record Number: 21199
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080816212630.016969-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-AUDREY
Event Code: 4624
Message: L’ouverture de session d’un compte s’est correctement déroulée.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		PC-DE-AUDREY$
	Domaine du compte :		WORKGROUP
	ID d’ouverture de session :		0x3e7

Type d’ouverture de session :			7

Nouvelle ouverture de session :
	ID de sécurité :		S-1-5-21-1033721620-3049051530-2943172277-1002
	Nom du compte :		AUDREY
	Domaine du compte :		PC-de-AUDREY
	ID d’ouverture de session :		0x1a6b220
	GUID d’ouverture de session :		{00000000-0000-0000-0000-000000000000}

Informations sur le processus :
	ID du processus :		0x2e8
	Nom du processus :		C:\Windows\System32\winlogon.exe

Informations sur le réseau :
	Nom de la station de travail :	PC-DE-AUDREY
	Adresse du réseau source :	127.0.0.1
	Port source :		0

Informations détaillées sur l’authentification :
	Processus d’ouverture de session :		User32 
	Package d’authentification :	Negotiate
	Services en transit :	-
	Nom du package (NTLM uniquement) :	-
	Longueur de la clé :		0

Cet événement est généré lors de la création d’une ouverture de session. Il est généré sur l’ordinateur sur lequel l’ouverture de session a été effectuée.

Le champ Objet indique le compte sur le système local qui a demandé l’ouverture de session. Il s’agit le plus souvent d’un service, comme le service Serveur, ou un processus local tel que Winlogon.exe ou Services.exe.

Le champ Type d’ouverture de session indique le type d’ouverture de session qui s’est produit. Les types les plus courants sont 2 (interactif) et 3 (réseau).

Le champ Nouvelle ouverture de session indique le compte pour lequel la nouvelle ouverture de session a été créée, par exemple, le compte qui s’est connecté.

Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas.

Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique.
	- Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC .
	- Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session.
	- Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM.
	- La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée.
Record Number: 21200
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080816212630.016969-000
Event Type: Succès de l'audit
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 14 Stepping 12, GenuineIntel
"PROCESSOR_REVISION"=0e0c
"NUMBER_OF_PROCESSORS"=2
"RoxioCentral"=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\
"PYTHONPATH"=C:\Program Files\agi\common;C:\Program Files\agi\common\python25.zip
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip

-----------------EOF-----------------

crapoulou · Answer

Dans l'ajout/suppression de programmes, désinstalle : - Kiwee Toolbar - Java(TM) 6 Update 7 Mets à jour Java en téléchargeant la version 6 Update = = = =>>> En cliquant ici <<<= = = = **************** Fais une analyse complète de l'ordinateur avec Malwarebytes anti malware mis à jour avant. Poste le rapport.

howdrey · Answer

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1565
Windows 6.0.6000 

29/12/2008 22:22:35
mbam-log-2008-12-29 (22-22-35).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 137285
Temps écoulé: 1 hour(s), 4 minute(s), 10 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

howdrey · Answer

Franchement merci beaucoup !!!

Sans toi je serai arrivée a rien !!

bisous !

crapoulou · Answer

Tu as bien désinstallé les éléments cités au message précédent ? Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques : Télécharge toolscleaner sur ton Bureau = = = =>>> En cliquant ici <<<= = = = * Double-clique sur ToolsCleaner2.exe et laisse le travailler * Clique sur Recherche et laisse le scan se terminer. * Clique sur Suppression pour finaliser. * Tu peux, si tu le souhaites, te servir des Options facultatives. * Clique sur Quitter, pour que le rapport puisse se créer. * Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse.

howdrey · Answer

Oui j'ai supprimé Kiwee et Java !

crapoulou · Answer

Ok.
J'attends ton rapport Tools cleaner2.
Tu as bien installé Java (la mise à jour).

howdrey · Answer

Tools cleaner beugue c'est normal, il se lance normalement et quand je clique sur Recherche il ne reponds plus ?

crapoulou · Answer

Laisse le travailler sans le toucher.
C'est un peu long normal.
S'il est écrit qu'il ne répond plus, termine le processus et relance le en le laissant tranquille.
Il est susceptible : quand il recherche il aime pas être taquiné, lol.
"laisse tranquille" pour moi = pas cliquer sur la fenêtre, néanmoins, tu peux faire autre chose.

howdrey · Answer

Il ne marche vraiment pas il est vraiment trés utile ? Parce que je peux les supprimer de mon panneau de configuration ?

Java est installé

crapoulou · Answer

Fais manuellement alors :
Tu as tout ça à supprimer :
- Hijackthis
- Toolbar S&D
- Navilog1
- Ad Remover
- Javara : c'est juste un utilitaire : rien dans Ajout/suppression de programmes.
- Toolscleaner2 : juste un utilitaire exécutable également.
- RSIT

et les rapports correspondants s'ils sont présents :

- C:\TB.txt (si présent)
- C:\Ad-report(date).log
- hijackthis.log (recherche le fichier tu le trouvera s'il n'est pas sur le bureau ou dans le dossier hijackthis.)
- C:\ToolBar SD\TB_4.txt (si dossier présent).
- Rapport RSIT (Recherche le s'il n'est pas dans le dossier RSIT)
- Info.txt

Tu peux garder Malwarebytes anti malware si tu veux, il est bien à passer de temps en temps.

Rapport malwarebytes

54 réponses

Discussions similaires

Newsletters