Bloc note d'hijackthis contre antivirus 2009
Résolu
capucine
-
Utilisateur anonyme -
Utilisateur anonyme -
Bonjour,
j'ai en suivant les conseils sur ce forum, telecharger le logiciel hijackthis et voici la copie du compte rendu :
(les problemes ont commencés il y a plusieurs jours deja avec cet antivirus 2009, j'ai essayé bcp d'anti virus et anti roolkit mais rien n'y fait cela revient toujours. Merci d'avance pour votre aide.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:38:45, on 02/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
C:\Program Files\SFR\Pack Sécurité\Common\FSMA32.EXE
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\FSGK32.EXE
C:\Program Files\SFR\Pack Sécurité\Common\FSMB32.EXE
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\Program Files\SFR\Pack Sécurité\Common\FCH32.EXE
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsqh.exe
C:\Program Files\SFR\Pack Sécurité\Common\FAMEH32.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fssm32.exe
C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsaua.exe
C:\Program Files\SFR\Pack Sécurité\FWES\Program\fsdfwd.exe
C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsus.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\SFR\Pack Sécurité\Common\FSM32.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
C:\APPS\SMP\SmpSys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
C:\Program Files\neuf telecom\neuf Box\Wizard\Agent_WiFi.exe
C:\Program Files\SFR\Pack Sécurité\FSGUI\fsguidll.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\InstantTimeZone\InstantTimeZone.exe
C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\SFR\Pack Sécurité\FSGUI\scanwizard.exe
C:\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.1/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: &Research - {037C7B8A-151A-49E6-BAED-CC05FCB50328} - C:\WINDOWS\system32\winsrc.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {7f564888-6048-4bde-a98b-95b930bafcb4} - C:\WINDOWS\system32\payeritu.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: solution Class - {99C6D1BB-7555-474C-91DA-D8FB62A9CC75} - C:\WINDOWS\system32\Y0FfRJBe.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [OmniPass] C:\Apps\Softex\OmniPass\scureapp.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\SFR\Pack Sécurité\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\SFR\Pack Sécurité\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [vohesijewe] Rundll32.exe "C:\WINDOWS\system32\kovubasa.dll",s
O4 - HKLM\..\Run: [203aebec] rundll32.exe "C:\WINDOWS\system32\nohijubi.dll",b
O4 - HKLM\..\Run: [CPM2309d870] Rundll32.exe "C:\WINDOWS\system32\zemugeno.dll",a
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [TVAgent WiFi] C:\Program Files\neuf telecom\neuf Box\Wizard\Agent_WiFi.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ieupdate] "C:\WINDOWS\system32\explorer32.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InstantTimeZone.lnk = C:\Program Files\InstantTimeZone\InstantTimeZone.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: OFFICE One Clock v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
O4 - Global Startup: OFFICE One Notes v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - D:\Documents and Settings\ange\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {104B0A37-AB99-4F06-8032-8BBDC3B77DDB} (Telechargement Control) - http://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {275D2217-FFE8-46B5-8FD2-B18CA0B7EE36} (Seagate SeaTools Online French) - file://C:\DRIVERS\snapsys\HDDDiag\bin\npseatools.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.photoweb.fr/moncompte/Account/LogOn?ReturnUrl=%2ftransfert
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1AF091A-9F23-4059-89D7-C05EE073285D} (Canal+ Active MSWAY) - https://www.canalplus.com/canalplay/
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://fdata.over-blog.com/99/00/00/01/js/javauploader/ImageUploader4.cab
O20 - AppInit_DLLs: c:\windows\system32\zisakawa.dll C:\WINDOWS\system32\zemogife.dll C:\WINDOWS\system32\yohuhuvi.dll c:\windows\system32\zemugeno.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\zemugeno.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\zemugeno.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\ORSP Client\fsorsp.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
j'ai en suivant les conseils sur ce forum, telecharger le logiciel hijackthis et voici la copie du compte rendu :
(les problemes ont commencés il y a plusieurs jours deja avec cet antivirus 2009, j'ai essayé bcp d'anti virus et anti roolkit mais rien n'y fait cela revient toujours. Merci d'avance pour votre aide.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:38:45, on 02/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
C:\Program Files\SFR\Pack Sécurité\Common\FSMA32.EXE
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\FSGK32.EXE
C:\Program Files\SFR\Pack Sécurité\Common\FSMB32.EXE
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\Program Files\SFR\Pack Sécurité\Common\FCH32.EXE
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsqh.exe
C:\Program Files\SFR\Pack Sécurité\Common\FAMEH32.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fssm32.exe
C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsaua.exe
C:\Program Files\SFR\Pack Sécurité\FWES\Program\fsdfwd.exe
C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsus.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\SFR\Pack Sécurité\Common\FSM32.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
C:\APPS\SMP\SmpSys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
C:\Program Files\neuf telecom\neuf Box\Wizard\Agent_WiFi.exe
C:\Program Files\SFR\Pack Sécurité\FSGUI\fsguidll.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\InstantTimeZone\InstantTimeZone.exe
C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\SFR\Pack Sécurité\FSGUI\scanwizard.exe
C:\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.1/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: &Research - {037C7B8A-151A-49E6-BAED-CC05FCB50328} - C:\WINDOWS\system32\winsrc.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {7f564888-6048-4bde-a98b-95b930bafcb4} - C:\WINDOWS\system32\payeritu.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: solution Class - {99C6D1BB-7555-474C-91DA-D8FB62A9CC75} - C:\WINDOWS\system32\Y0FfRJBe.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [OmniPass] C:\Apps\Softex\OmniPass\scureapp.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\SFR\Pack Sécurité\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\SFR\Pack Sécurité\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [vohesijewe] Rundll32.exe "C:\WINDOWS\system32\kovubasa.dll",s
O4 - HKLM\..\Run: [203aebec] rundll32.exe "C:\WINDOWS\system32\nohijubi.dll",b
O4 - HKLM\..\Run: [CPM2309d870] Rundll32.exe "C:\WINDOWS\system32\zemugeno.dll",a
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [TVAgent WiFi] C:\Program Files\neuf telecom\neuf Box\Wizard\Agent_WiFi.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ieupdate] "C:\WINDOWS\system32\explorer32.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InstantTimeZone.lnk = C:\Program Files\InstantTimeZone\InstantTimeZone.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: OFFICE One Clock v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
O4 - Global Startup: OFFICE One Notes v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - D:\Documents and Settings\ange\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {104B0A37-AB99-4F06-8032-8BBDC3B77DDB} (Telechargement Control) - http://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {275D2217-FFE8-46B5-8FD2-B18CA0B7EE36} (Seagate SeaTools Online French) - file://C:\DRIVERS\snapsys\HDDDiag\bin\npseatools.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.photoweb.fr/moncompte/Account/LogOn?ReturnUrl=%2ftransfert
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1AF091A-9F23-4059-89D7-C05EE073285D} (Canal+ Active MSWAY) - https://www.canalplus.com/canalplay/
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://fdata.over-blog.com/99/00/00/01/js/javauploader/ImageUploader4.cab
O20 - AppInit_DLLs: c:\windows\system32\zisakawa.dll C:\WINDOWS\system32\zemogife.dll C:\WINDOWS\system32\yohuhuvi.dll c:\windows\system32\zemugeno.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\zemugeno.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\zemugeno.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\ORSP Client\fsorsp.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
A voir également:
- Bloc note d'hijackthis contre antivirus 2009
- Hijackthis - Télécharger - Antivirus & Antimalwares
- Bloc note gratuit - Télécharger - Traitement de texte
- Comodo antivirus - Télécharger - Sécurité
- Bloc-notes-Android - Télécharger - Agendas & Calendriers
- Norton antivirus gratuit - Télécharger - Antivirus & Antimalwares
39 réponses
est ce que c'est celui ci ?
ComboFix 09-01-01.02 - ange 2009-01-03 19:19:55.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.2046.1482 [GMT 1:00]
Lancé depuis: d:\documents and settings\ange\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\bedepeba.dll
c:\windows\system32\bulopazo.dll
c:\windows\system32\ezulojet.ini
c:\windows\system32\fofizuju.dll
c:\windows\system32\ibujihon.ini
c:\windows\system32\ibuzuzom.ini
c:\windows\system32\iheguhol.ini
c:\windows\system32\izemukas.ini
c:\windows\system32\jatuveru.dll
c:\windows\system32\nagewati.dll
c:\windows\system32\ogawalit.ini
c:\windows\system32\okelemar.ini
c:\windows\system32\orutikay.ini
c:\windows\system32\rumadune.dll
c:\windows\system32\usapipik.ini
c:\windows\system32\zemugeno.dll
c:\windows\Temp\tmp3.tmp
d:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
d:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
----- BITS: Il y a peut-être des sites infectés -----
hxxp://77.74.48.105
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-12-03 au 2009-01-03 ))))))))))))))))))))))))))))))))))))
.
2009-01-03 19:25 . 2009-01-03 19:25 <REP> d-------- c:\windows\system32\Lang
2009-01-03 14:35 . 2009-01-03 14:35 <REP> d-------- d:\documents and settings\ange\Application Data\Malwarebytes
2009-01-03 14:35 . 2009-01-03 14:35 <REP> d-------- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-03 14:35 . 2009-01-03 15:57 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-03 14:35 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-03 14:35 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-02 20:52 . 2009-01-02 20:52 <REP> d-------- c:\windows\ERUNT
2009-01-02 20:49 . 2009-01-02 23:11 <REP> d-------- C:\SDFIX
2009-01-02 18:03 . 2009-01-02 18:03 0 --a------ c:\windows\LCDMedia.INI
2009-01-02 16:02 . 2009-01-02 17:11 <REP> d-------- C:\SmitfraudFix
2009-01-02 15:29 . 2009-01-03 17:59 <REP> d-------- C:\hijackthis
2009-01-01 23:48 . 2009-01-01 23:48 1,294,620 ---hs---- c:\windows\system32\ezulojet.tmp
2009-01-01 18:58 . 2009-01-01 18:58 30,856 --a------ c:\windows\system32\drivers\fsbts.sys
2009-01-01 18:49 . 2009-01-01 18:49 <REP> d-------- d:\documents and settings\ange\Application Data\F-Secure
2009-01-01 18:43 . 2008-09-23 14:35 79,904 --a------ c:\windows\system32\drivers\fsdfw.sys
2009-01-01 18:42 . 2009-01-01 18:42 <REP> d-------- c:\program files\SFR
2009-01-01 18:39 . 2009-01-01 18:39 <REP> d-------- d:\documents and settings\All Users\Application Data\NortonInstaller
2009-01-01 18:38 . 2009-01-01 18:38 2,404,352 --a------ d:\documents and settings\Norton_Removal_Tool.exe
2009-01-01 18:35 . 2009-01-01 18:35 65,606,128 --a------ d:\documents and settings\NIS2008_15.0_Build_60_MUI_OEM60_CIBC.exe
2009-01-01 17:56 . 2009-01-01 17:56 <REP> d-------- d:\documents and settings\All Users\Application Data\Avg8
2009-01-01 16:39 . 2009-01-01 16:39 71,159,344 --a------ d:\documents and settings\Pack_Securite.exe
2009-01-01 15:16 . 2009-01-01 15:17 14,771,744 --a------ d:\documents and settings\IE7-WindowsXP-x86-fra.exe
2009-01-01 11:47 . 2009-01-01 11:47 2,724 ---hs---- c:\windows\system32\yurizoye.dll
2009-01-01 11:47 . 2009-01-01 11:47 2,724 ---hs---- c:\windows\system32\wivawira.dll
2009-01-01 11:47 . 2009-01-01 11:47 2,724 ---hs---- c:\windows\system32\kemomupi.dll
2008-12-31 11:47 . 2008-12-31 11:47 2,724 ---hs---- c:\windows\system32\pepufebe.dll
2008-12-31 11:47 . 2008-12-31 11:47 2,724 ---hs---- c:\windows\system32\pagifobe.dll
2008-12-31 11:47 . 2008-12-31 11:47 2,724 ---hs---- c:\windows\system32\fimohinu.dll
2008-12-30 23:58 . 2008-12-30 23:58 <REP> d-------- d:\documents and settings\ange\Application Data\aAvgApi
2008-12-30 23:47 . 2008-12-30 23:47 2,724 ---hs---- c:\windows\system32\zidajaji.dll
2008-12-30 23:47 . 2008-12-30 23:47 2,724 ---hs---- c:\windows\system32\tetupaha.dll
2008-12-30 23:47 . 2008-12-30 23:47 2,724 ---hs---- c:\windows\system32\jagenoki.dll
2008-12-30 23:46 . 2008-12-30 23:46 <REP> dr------- d:\documents and settings\LocalService.AUTORITE NT\Favoris
2008-12-26 18:24 . 2008-12-26 18:24 <REP> d-------- c:\program files\Alwil Software
2008-12-26 10:36 . 2008-12-26 10:36 <REP> d-------- c:\windows\system32\config\systemprofile\Application Data\eBay
2008-12-26 00:03 . 2008-12-26 00:03 <REP> d-------- c:\program files\AVG
2008-12-26 00:03 . 2008-12-26 00:03 10,520 --------- c:\windows\system32\avgrsstx.dll.install_backup
2008-12-25 23:09 . 2008-12-25 23:09 <REP> d-------- C:\ProgramData
2008-12-25 23:09 . 2008-12-25 23:09 <REP> d-------- c:\program files\Angle Interactive
2008-12-25 22:57 . 2008-12-25 22:57 <REP> d--h----- c:\windows\system32\GroupPolicy
2008-12-25 21:00 . 2008-12-25 21:00 <REP> dr------- d:\documents and settings\NetworkService.AUTORITE NT\Favoris
2008-12-20 21:51 . 2009-01-03 19:23 <REP> d-------- d:\documents and settings\ange\Application Data\DNA
2008-12-20 21:51 . 2009-01-03 19:26 <REP> d-------- c:\program files\DNA
2008-12-20 21:50 . 2008-12-20 21:50 449,692 --a------ d:\documents and settings\Fiesta-01_228_0001-dna.exe
2008-12-20 20:49 . 2008-12-20 20:49 <REP> d-------- c:\program files\Fichiers communs\DirectX
2008-12-20 18:32 . 2008-12-20 18:32 585,277,688 --a------ d:\documents and settings\FiestaOnlineSetup.zip
2008-12-09 12:23 . 2009-01-01 16:41 <REP> d-------- d:\documents and settings\All Users\Application Data\fssg
2008-12-09 12:21 . 2009-01-01 18:43 <REP> d-------- d:\documents and settings\All Users\Application Data\f-secure
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-01 21:22 --------- d-----w d:\documents and settings\ange\Application Data\gtk-2.0
2009-01-01 17:39 --------- d-----w d:\documents and settings\All Users\Application Data\Symantec
2009-01-01 17:22 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-26 09:36 --------- d-----w d:\documents and settings\All Users\Application Data\WholeSecurity
2008-12-25 20:59 --------- d-----w d:\documents and settings\ange\Application Data\Corel
2008-12-25 20:58 --------- d-----w c:\program files\Corel
2008-12-21 21:15 88 --sh--r d:\documents and settings\All Users\Application Data\7B995A142A.sys
2008-12-21 21:15 2,828 --sha-w d:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2008-12-13 06:37 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-11-14 10:16 --------- d-----w d:\documents and settings\ange\Application Data\InstallShield
2008-11-03 23:28 --------- d-----w d:\documents and settings\LocalService.AUTORITE NT\Application Data\X10 Commander
2008-11-03 11:11 --------- d-----w c:\program files\MSN Messenger
2008-10-24 11:10 453,632 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 13:00 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 13:00 283,648 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:11 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-15 16:59 332,800 ----a-w c:\windows\system32\netapi32(4).dll
2008-10-15 16:59 332,800 ----a-w c:\windows\system32\netapi32(3).dll
2008-10-15 16:59 332,800 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-15 07:06 633,632 ------w c:\windows\system32\dllcache\iexplore.exe
2008-10-15 07:04 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-10-03 10:17 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-03 10:17 247,326 ------w c:\windows\system32\dllcache\strmdll.dll
2008-09-30 20:51 21,340,400 ----a-w d:\documents and settings\Age of Conan\AgeOfConan.exe
2008-09-30 20:49 5,593,368 ----a-w d:\documents and settings\Age of Conan\PatcherSetup.exe
2008-09-26 12:39 18,330,864 ----a-w d:\documents and settings\Age of Conan\ConanPatcher.exe
2008-07-13 17:56 2,897,920 ----a-w d:\documents and settings\Age of Conan\xpsp2res.dll
2008-06-22 10:06 444,776 ----a-w d:\documents and settings\Age of Conan\d3dx10_36.dll
2008-06-22 09:53 297,695 ----a-w d:\documents and settings\Age of Conan\unins000.dat
2008-06-22 08:41 690,416 ----a-w d:\documents and settings\Age of Conan\unins000.exe
2008-04-08 11:39 83,184 ----a-w d:\documents and settings\Age of Conan\ConanHelp.dll
2008-04-06 11:31 171,008 ----a-w d:\documents and settings\Age of Conan\binkw32.dll
2008-03-18 15:57 3,700,020 ----a-w d:\documents and settings\Age of Conan\shaders_cache.bin
2007-12-21 10:43 2,891,776 ----a-w c:\program files\draw1010.exe
2007-12-21 10:31 6,410,240 ----a-w c:\program files\Res_fra1010.dll
2007-12-21 10:28 196,608 ----a-w c:\program files\MAObjectLib.dll
2007-12-21 10:28 151,552 ----a-w c:\program files\FiltersDll.dll
2007-12-21 10:27 462,848 ----a-w c:\program files\MACtrlDll.dll
2007-12-21 10:27 221,184 ----a-w c:\program files\MAUT.dll
2007-11-27 15:34 32,069,221 ----a-w c:\program files\el_150_install.exe
2007-08-25 11:42 2,419,218 -c--a-w c:\program files\4355.exe
2007-08-23 09:22 4 -c--a-w c:\program files\version.dat
2007-07-04 14:04 3,924 ----a-w c:\program files\liste.txt
2007-04-12 10:29 4,349,952 ----a-w c:\program files\ToolkitPro1030vc80.dll
2006-11-21 09:30 445,584 ----a-w c:\program files\Ltimgsfx15u.dll
2006-11-21 09:30 302,224 ----a-w c:\program files\Ltimgcor15u.dll
2006-11-21 09:30 27,792 ----a-w c:\program files\Lfxpm15u.dll
2006-11-21 09:30 25,744 ----a-w c:\program files\Lfwmf15u.dll
2006-11-21 09:30 24,720 ----a-w c:\program files\Lfbmp15u.dll
2006-11-21 09:30 216,208 ----a-w c:\program files\Ltimgefx15u.dll
2006-11-21 09:30 212,112 ----a-w c:\program files\Ltimgclr15u.dll
2006-11-21 09:30 21,136 ----a-w c:\program files\Lfpcx15u.dll
2006-11-21 09:30 18,064 ----a-w c:\program files\Lftga15u.dll
2006-11-21 09:30 126,096 ----a-w c:\program files\Lfpng15u.dll
2006-11-21 09:30 117,904 ----a-w c:\program files\Ltimgutl15u.dll
2006-11-21 09:30 1,711,248 ----a-w c:\program files\Ltclr15u.dll
2006-11-21 09:29 97,424 ----a-w c:\program files\Lffax15u.dll
2006-11-21 09:29 384,144 ----a-w c:\program files\Lfcmp15u.dll
2006-11-21 09:29 261,264 ----a-w c:\program files\Ltdis15u.dll
2006-11-21 09:29 232,592 ----a-w c:\program files\Lfj2k15u.dll
2006-11-21 09:29 150,672 ----a-w c:\program files\Ltfil15u.dll
2006-11-21 09:29 146,576 ----a-w c:\program files\Lftif15u.dll
2006-11-13 19:53 479,232 ----a-w c:\program files\Ltkrn15u.dll
2006-09-22 10:20 23,552 ----a-w c:\program files\ToolkitPro.ResourceFr.dll
2003-03-24 20:24 917,504 ----a-w c:\program files\_ISource30.dll
2003-03-18 19:20 1,060,864 ----a-w c:\program files\mfc71.dll
2003-03-18 19:12 1,047,552 ----a-w c:\program files\mfc71u.dll
2003-03-18 18:14 499,712 ----a-w c:\program files\msvcp71.dll
2003-02-21 02:42 348,160 ----a-w c:\program files\msvcr71.dll
1601-01-01 00:12 75,776 --sha-w c:\windows\system32\sipikuze.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\apps\SMP\SmpSys.exe" [2005-11-17 975360]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"Configuration de la neuf Box"="c:\program files\neuf telecom\neuf Box\Wizard\QuickAccess.exe" [2005-12-13 389120]
"TVAgent WiFi"="c:\program files\neuf telecom\neuf Box\Wizard\Agent_WiFi.exe" [2005-12-13 976896]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-20 342848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8491008]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Vade Retro Outlook Express"="c:\progra~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2004-10-04 310272]
"DetectorApp"="c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-09-25 229952]
"Launch LGDCore"="c:\program files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 1122304]
"Launch LCDMon"="c:\program files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 497152]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-17 81920]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"F-Secure Manager"="c:\program files\SFR\Pack Sécurité\Common\FSM32.EXE" [2008-09-23 182936]
"F-Secure TNB"="c:\program files\SFR\Pack Sécurité\FSGUI\TNBUtil.exe" [2008-09-23 957024]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2007-09-17 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]
d:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
InstantTimeZone.lnk - c:\program files\InstantTimeZone\InstantTimeZone.exe [2007-04-29 1677436]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-08-22 450560]
OFFICE One Clock v6.5.lnk - c:\program files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe [2006-10-26 257536]
OFFICE One Notes v6.5.lnk - c:\program files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe [2006-10-26 559104]
SiWake.lnk - c:\program files\Wireless LAN Utility\SiWake.exe [2007-05-27 135168]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2006-01-30 07:53 49152 c:\apps\Softex\OmniPass\OPXPGina.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= c:\progra~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= c:\progra~1\FICHIE~1\ULEADS~1\MPEG\mpegacm.acm
"msacm.ulmp3acm"= c:\progra~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ehRecvr"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Eternal Lands\\el.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\APPS\\Softex\\OmniPass\\OPXPApp.exe"=
"c:\\APPS\\Softex\\OmniPass\\OmniServ.exe"=
"c:\\Program Files\\Common Files\\X10\\Common\\X10nets.exe"=
"c:\\WINDOWS\\system32\\dllhost.exe"=
R0 fsbts;fsbts;c:\windows\system32\Drivers\fsbts.sys [2009-01-01 30856]
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2009-01-01 79904]
R1 F-Secure HIPS;F-Secure HIPS Driver;\??\c:\program files\SFR\Pack Sécurité\HIPS\drivers\fshs.sys [2009-01-01 66720]
R3 3xHybrid;3xHybrid service;c:\windows\system32\DRIVERS\3xHybrid.sys [2006-09-11 825600]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\c:\program files\SFR\Pack Sécurité\Anti-Virus\minifilter\fsgk.sys [2009-01-01 72288]
R3 FSORSPClient;F-Secure ORSP Client;"c:\program files\SFR\Pack Sécurité\ORSP Client\fsorsp.exe" [2009-01-01 55904]
R3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-09-11 7040]
S3 NBXG7031;NB 802.11g XG703 SP1 Driver;c:\windows\system32\DRIVERS\WlanUIG.sys [2006-10-21 381312]
S3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2007-05-27 162304]
S3 SQTECH9150;Mini Cam;c:\windows\system32\Drivers\Capt9150.sys [2007-06-06 47087]
S4 F-Secure Filter;F-Secure File System Filter;\??\c:\program files\SFR\Pack Sécurité\Anti-Virus\Win2K\FSfilter.sys [2009-01-01 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;\??\c:\program files\SFR\Pack Sécurité\Anti-Virus\Win2K\FSrec.sys [2009-01-01 25184]
*Newly Created Service* - PCANDIS5
.
Contenu du dossier 'Tâches planifiées'
2008-12-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
2009-01-01 c:\windows\Tasks\At1.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At10.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At11.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-31 c:\windows\Tasks\At12.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-02 c:\windows\Tasks\At13.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At14.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At15.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At16.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-02 c:\windows\Tasks\At17.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At18.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At19.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At2.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At20.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-02 c:\windows\Tasks\At21.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-01 c:\windows\Tasks\At22.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-02 c:\windows\Tasks\At23.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-01 c:\windows\Tasks\At24.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-02 c:\windows\Tasks\At25.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At26.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At27.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At28.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At29.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At3.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At30.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At31.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At32.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At33.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At34.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At35.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-31 c:\windows\Tasks\At36.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-02 c:\windows\Tasks\At37.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At38.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At39.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At4.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At40.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-02 c:\windows\Tasks\At41.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At42.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At43.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At44.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-02 c:\windows\Tasks\At45.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-01 c:\windows\Tasks\At46.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-02 c:\windows\Tasks\At47.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-01 c:\windows\Tasks\At48.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At5.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At6.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At7.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At8.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At9.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\Configurer mon PC.job
- c:\apps\SMP\PCSETUP.EXE [2005-11-17 09:03]
2009-01-03 c:\windows\Tasks\Scheduled scanning task.job
- c:\progra~1\SFR\PACKSC~1\ANTI-V~1\fsav.exe [2008-09-23 14:35]
2009-01-03 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-ISUSPM Startup - c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe
HKLM-Run-OmniPass - c:\apps\Softex\OmniPass\scureapp.exe
HKLM-Run-CanalPlayer - c:\program files\Lecteur CANALPLAY\CanalPlayer.exe
MSConfigStartUp-79041872252976424972244103365599 - c:\program files\Antivirus 2009\av2009.exe
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Connection Wizard,ShellNext = hxxp://192.168.1.1/
uSearchURL,(Default) = hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Recherche sur eBay - c:\program files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - d:\documents and settings\ange\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
LSP: c:\program files\SFR\Pack Se9,curite9,\FSPS\program\FSLSP.DLL
Trusted Zone: *.canalplay.com
Trusted Zone: *.canalplusactive.com
Trusted Zone: *.canalplay.com
Trusted Zone: *.canalplusactive.com
c:\windows\system32\unicows.dll - c:\windows\Downloaded Program Files\telechargement-photoweb.ocx
O16 -: {104B0A37-AB99-4F06-8032-8BBDC3B77DDB}
hxxp://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
c:\windows\Downloaded Program Files\telechargement-photoweb.inf
c:\windows\Downloaded Program Files\npSeaTools_FR.dll - O16 -: {275D2217-FFE8-46B5-8FD2-B18CA0B7EE36}
file://c:\drivers\snapsys\HDDDiag\bin\npseatools.cab
c:\windows\Downloaded Program Files\npSeaTools_FR.inf
c:\windows\system32\unicows.dll - c:\windows\Downloaded Program Files\ImageUploader5.ocx
O16 -: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3}
hxxp://www.photoweb.fr/telechargement/telechargement-photoweb.cab
c:\windows\Downloaded Program Files\ImageUploader5.inf
c:\windows\Downloaded Program Files\msway.dll - O16 -: {E1AF091A-9F23-4059-89D7-C05EE073285D}
hxxp://www.canalplay.com/cabs/msway44.cab
c:\windows\Downloaded Program Files\msway.inf
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-03 19:25:05
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-3657964355-63999632-1874375830-1005\Software\Microsoft\SystemCertificates\AddressBook*NULL*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\mpDRM\LicenseStore*NULL*]
@DACL=
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(692)
c:\windows\system32\Ati2evxx.dll
c:\apps\Softex\OmniPass\opxpgina.dll
c:\program files\SFR\Pack Sécurité\FWES\Program\fsdc32.dll
- - - - - - - > 'lsass.exe'(748)
c:\program files\SFR\Pack Sécurité\FSPS\program\FSLSP.DLL
c:\program files\SFR\Pack Sécurité\FWES\Program\fsdc32.dll
- - - - - - - > 'csrss.exe'(660)
c:\program files\SFR\Pack Sécurité\FWES\Program\fsdc32.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\windows\ehome\ehSched.exe
c:\program files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
c:\program files\SFR\Pack Sécurité\Common\FSMA32.EXE
c:\program files\SFR\Pack Sécurité\Anti-Virus\fsgk32.exe
c:\program files\SFR\Pack Sécurité\Common\FSMB32.EXE
c:\apps\Softex\OmniPass\OmniServ.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
c:\program files\SFR\Pack Sécurité\Common\FCH32.EXE
c:\progra~1\COMMON~1\X10\Common\X10nets.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\SFR\Pack Sécurité\Common\FAMEH32.EXE
c:\program files\SFR\Pack Sécurité\Anti-Virus\fsqh.exe
c:\windows\system32\dllhost.exe
c:\program files\SFR\Pack Sécurité\Anti-Virus\fssm32.exe
c:\program files\SFR\Pack Sécurité\FSAUA\program\fsaua.exe
c:\apps\Softex\OmniPass\OPXPApp.exe
c:\program files\SFR\Pack Sécurité\FWES\program\fsdfwd.exe
c:\progra~1\SFR\PACKSC~1\ANTI-V~1\fsav32.exe
c:\windows\ehome\ehmsas.exe
c:\apps\ABOARD\AOSD.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Logitech\G-series Software\Applets\LCDClock.exe
c:\program files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Logitech\G-series Software\Applets\LCDMedia.exe
c:\program files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
c:\program files\SFR\Pack Sécurité\FSGUI\fsguidll.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Logitech\Video\FxSvr2.exe
.
**************************************************************************
.
Heure de fin: 2009-01-03 19:29:51 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-01-03 18:29:46
Avant-CF: 3 299 639 296 octets libres
Après-CF: 3,483,869,184 octets libres
484 --- E O F --- 2008-12-25 22:01:35
ComboFix 09-01-01.02 - ange 2009-01-03 19:19:55.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.2046.1482 [GMT 1:00]
Lancé depuis: d:\documents and settings\ange\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\bedepeba.dll
c:\windows\system32\bulopazo.dll
c:\windows\system32\ezulojet.ini
c:\windows\system32\fofizuju.dll
c:\windows\system32\ibujihon.ini
c:\windows\system32\ibuzuzom.ini
c:\windows\system32\iheguhol.ini
c:\windows\system32\izemukas.ini
c:\windows\system32\jatuveru.dll
c:\windows\system32\nagewati.dll
c:\windows\system32\ogawalit.ini
c:\windows\system32\okelemar.ini
c:\windows\system32\orutikay.ini
c:\windows\system32\rumadune.dll
c:\windows\system32\usapipik.ini
c:\windows\system32\zemugeno.dll
c:\windows\Temp\tmp3.tmp
d:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
d:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
----- BITS: Il y a peut-être des sites infectés -----
hxxp://77.74.48.105
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-12-03 au 2009-01-03 ))))))))))))))))))))))))))))))))))))
.
2009-01-03 19:25 . 2009-01-03 19:25 <REP> d-------- c:\windows\system32\Lang
2009-01-03 14:35 . 2009-01-03 14:35 <REP> d-------- d:\documents and settings\ange\Application Data\Malwarebytes
2009-01-03 14:35 . 2009-01-03 14:35 <REP> d-------- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-03 14:35 . 2009-01-03 15:57 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-03 14:35 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-03 14:35 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-02 20:52 . 2009-01-02 20:52 <REP> d-------- c:\windows\ERUNT
2009-01-02 20:49 . 2009-01-02 23:11 <REP> d-------- C:\SDFIX
2009-01-02 18:03 . 2009-01-02 18:03 0 --a------ c:\windows\LCDMedia.INI
2009-01-02 16:02 . 2009-01-02 17:11 <REP> d-------- C:\SmitfraudFix
2009-01-02 15:29 . 2009-01-03 17:59 <REP> d-------- C:\hijackthis
2009-01-01 23:48 . 2009-01-01 23:48 1,294,620 ---hs---- c:\windows\system32\ezulojet.tmp
2009-01-01 18:58 . 2009-01-01 18:58 30,856 --a------ c:\windows\system32\drivers\fsbts.sys
2009-01-01 18:49 . 2009-01-01 18:49 <REP> d-------- d:\documents and settings\ange\Application Data\F-Secure
2009-01-01 18:43 . 2008-09-23 14:35 79,904 --a------ c:\windows\system32\drivers\fsdfw.sys
2009-01-01 18:42 . 2009-01-01 18:42 <REP> d-------- c:\program files\SFR
2009-01-01 18:39 . 2009-01-01 18:39 <REP> d-------- d:\documents and settings\All Users\Application Data\NortonInstaller
2009-01-01 18:38 . 2009-01-01 18:38 2,404,352 --a------ d:\documents and settings\Norton_Removal_Tool.exe
2009-01-01 18:35 . 2009-01-01 18:35 65,606,128 --a------ d:\documents and settings\NIS2008_15.0_Build_60_MUI_OEM60_CIBC.exe
2009-01-01 17:56 . 2009-01-01 17:56 <REP> d-------- d:\documents and settings\All Users\Application Data\Avg8
2009-01-01 16:39 . 2009-01-01 16:39 71,159,344 --a------ d:\documents and settings\Pack_Securite.exe
2009-01-01 15:16 . 2009-01-01 15:17 14,771,744 --a------ d:\documents and settings\IE7-WindowsXP-x86-fra.exe
2009-01-01 11:47 . 2009-01-01 11:47 2,724 ---hs---- c:\windows\system32\yurizoye.dll
2009-01-01 11:47 . 2009-01-01 11:47 2,724 ---hs---- c:\windows\system32\wivawira.dll
2009-01-01 11:47 . 2009-01-01 11:47 2,724 ---hs---- c:\windows\system32\kemomupi.dll
2008-12-31 11:47 . 2008-12-31 11:47 2,724 ---hs---- c:\windows\system32\pepufebe.dll
2008-12-31 11:47 . 2008-12-31 11:47 2,724 ---hs---- c:\windows\system32\pagifobe.dll
2008-12-31 11:47 . 2008-12-31 11:47 2,724 ---hs---- c:\windows\system32\fimohinu.dll
2008-12-30 23:58 . 2008-12-30 23:58 <REP> d-------- d:\documents and settings\ange\Application Data\aAvgApi
2008-12-30 23:47 . 2008-12-30 23:47 2,724 ---hs---- c:\windows\system32\zidajaji.dll
2008-12-30 23:47 . 2008-12-30 23:47 2,724 ---hs---- c:\windows\system32\tetupaha.dll
2008-12-30 23:47 . 2008-12-30 23:47 2,724 ---hs---- c:\windows\system32\jagenoki.dll
2008-12-30 23:46 . 2008-12-30 23:46 <REP> dr------- d:\documents and settings\LocalService.AUTORITE NT\Favoris
2008-12-26 18:24 . 2008-12-26 18:24 <REP> d-------- c:\program files\Alwil Software
2008-12-26 10:36 . 2008-12-26 10:36 <REP> d-------- c:\windows\system32\config\systemprofile\Application Data\eBay
2008-12-26 00:03 . 2008-12-26 00:03 <REP> d-------- c:\program files\AVG
2008-12-26 00:03 . 2008-12-26 00:03 10,520 --------- c:\windows\system32\avgrsstx.dll.install_backup
2008-12-25 23:09 . 2008-12-25 23:09 <REP> d-------- C:\ProgramData
2008-12-25 23:09 . 2008-12-25 23:09 <REP> d-------- c:\program files\Angle Interactive
2008-12-25 22:57 . 2008-12-25 22:57 <REP> d--h----- c:\windows\system32\GroupPolicy
2008-12-25 21:00 . 2008-12-25 21:00 <REP> dr------- d:\documents and settings\NetworkService.AUTORITE NT\Favoris
2008-12-20 21:51 . 2009-01-03 19:23 <REP> d-------- d:\documents and settings\ange\Application Data\DNA
2008-12-20 21:51 . 2009-01-03 19:26 <REP> d-------- c:\program files\DNA
2008-12-20 21:50 . 2008-12-20 21:50 449,692 --a------ d:\documents and settings\Fiesta-01_228_0001-dna.exe
2008-12-20 20:49 . 2008-12-20 20:49 <REP> d-------- c:\program files\Fichiers communs\DirectX
2008-12-20 18:32 . 2008-12-20 18:32 585,277,688 --a------ d:\documents and settings\FiestaOnlineSetup.zip
2008-12-09 12:23 . 2009-01-01 16:41 <REP> d-------- d:\documents and settings\All Users\Application Data\fssg
2008-12-09 12:21 . 2009-01-01 18:43 <REP> d-------- d:\documents and settings\All Users\Application Data\f-secure
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-01 21:22 --------- d-----w d:\documents and settings\ange\Application Data\gtk-2.0
2009-01-01 17:39 --------- d-----w d:\documents and settings\All Users\Application Data\Symantec
2009-01-01 17:22 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-26 09:36 --------- d-----w d:\documents and settings\All Users\Application Data\WholeSecurity
2008-12-25 20:59 --------- d-----w d:\documents and settings\ange\Application Data\Corel
2008-12-25 20:58 --------- d-----w c:\program files\Corel
2008-12-21 21:15 88 --sh--r d:\documents and settings\All Users\Application Data\7B995A142A.sys
2008-12-21 21:15 2,828 --sha-w d:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2008-12-13 06:37 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-11-14 10:16 --------- d-----w d:\documents and settings\ange\Application Data\InstallShield
2008-11-03 23:28 --------- d-----w d:\documents and settings\LocalService.AUTORITE NT\Application Data\X10 Commander
2008-11-03 11:11 --------- d-----w c:\program files\MSN Messenger
2008-10-24 11:10 453,632 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 13:00 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 13:00 283,648 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:11 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-15 16:59 332,800 ----a-w c:\windows\system32\netapi32(4).dll
2008-10-15 16:59 332,800 ----a-w c:\windows\system32\netapi32(3).dll
2008-10-15 16:59 332,800 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-15 07:06 633,632 ------w c:\windows\system32\dllcache\iexplore.exe
2008-10-15 07:04 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-10-03 10:17 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-03 10:17 247,326 ------w c:\windows\system32\dllcache\strmdll.dll
2008-09-30 20:51 21,340,400 ----a-w d:\documents and settings\Age of Conan\AgeOfConan.exe
2008-09-30 20:49 5,593,368 ----a-w d:\documents and settings\Age of Conan\PatcherSetup.exe
2008-09-26 12:39 18,330,864 ----a-w d:\documents and settings\Age of Conan\ConanPatcher.exe
2008-07-13 17:56 2,897,920 ----a-w d:\documents and settings\Age of Conan\xpsp2res.dll
2008-06-22 10:06 444,776 ----a-w d:\documents and settings\Age of Conan\d3dx10_36.dll
2008-06-22 09:53 297,695 ----a-w d:\documents and settings\Age of Conan\unins000.dat
2008-06-22 08:41 690,416 ----a-w d:\documents and settings\Age of Conan\unins000.exe
2008-04-08 11:39 83,184 ----a-w d:\documents and settings\Age of Conan\ConanHelp.dll
2008-04-06 11:31 171,008 ----a-w d:\documents and settings\Age of Conan\binkw32.dll
2008-03-18 15:57 3,700,020 ----a-w d:\documents and settings\Age of Conan\shaders_cache.bin
2007-12-21 10:43 2,891,776 ----a-w c:\program files\draw1010.exe
2007-12-21 10:31 6,410,240 ----a-w c:\program files\Res_fra1010.dll
2007-12-21 10:28 196,608 ----a-w c:\program files\MAObjectLib.dll
2007-12-21 10:28 151,552 ----a-w c:\program files\FiltersDll.dll
2007-12-21 10:27 462,848 ----a-w c:\program files\MACtrlDll.dll
2007-12-21 10:27 221,184 ----a-w c:\program files\MAUT.dll
2007-11-27 15:34 32,069,221 ----a-w c:\program files\el_150_install.exe
2007-08-25 11:42 2,419,218 -c--a-w c:\program files\4355.exe
2007-08-23 09:22 4 -c--a-w c:\program files\version.dat
2007-07-04 14:04 3,924 ----a-w c:\program files\liste.txt
2007-04-12 10:29 4,349,952 ----a-w c:\program files\ToolkitPro1030vc80.dll
2006-11-21 09:30 445,584 ----a-w c:\program files\Ltimgsfx15u.dll
2006-11-21 09:30 302,224 ----a-w c:\program files\Ltimgcor15u.dll
2006-11-21 09:30 27,792 ----a-w c:\program files\Lfxpm15u.dll
2006-11-21 09:30 25,744 ----a-w c:\program files\Lfwmf15u.dll
2006-11-21 09:30 24,720 ----a-w c:\program files\Lfbmp15u.dll
2006-11-21 09:30 216,208 ----a-w c:\program files\Ltimgefx15u.dll
2006-11-21 09:30 212,112 ----a-w c:\program files\Ltimgclr15u.dll
2006-11-21 09:30 21,136 ----a-w c:\program files\Lfpcx15u.dll
2006-11-21 09:30 18,064 ----a-w c:\program files\Lftga15u.dll
2006-11-21 09:30 126,096 ----a-w c:\program files\Lfpng15u.dll
2006-11-21 09:30 117,904 ----a-w c:\program files\Ltimgutl15u.dll
2006-11-21 09:30 1,711,248 ----a-w c:\program files\Ltclr15u.dll
2006-11-21 09:29 97,424 ----a-w c:\program files\Lffax15u.dll
2006-11-21 09:29 384,144 ----a-w c:\program files\Lfcmp15u.dll
2006-11-21 09:29 261,264 ----a-w c:\program files\Ltdis15u.dll
2006-11-21 09:29 232,592 ----a-w c:\program files\Lfj2k15u.dll
2006-11-21 09:29 150,672 ----a-w c:\program files\Ltfil15u.dll
2006-11-21 09:29 146,576 ----a-w c:\program files\Lftif15u.dll
2006-11-13 19:53 479,232 ----a-w c:\program files\Ltkrn15u.dll
2006-09-22 10:20 23,552 ----a-w c:\program files\ToolkitPro.ResourceFr.dll
2003-03-24 20:24 917,504 ----a-w c:\program files\_ISource30.dll
2003-03-18 19:20 1,060,864 ----a-w c:\program files\mfc71.dll
2003-03-18 19:12 1,047,552 ----a-w c:\program files\mfc71u.dll
2003-03-18 18:14 499,712 ----a-w c:\program files\msvcp71.dll
2003-02-21 02:42 348,160 ----a-w c:\program files\msvcr71.dll
1601-01-01 00:12 75,776 --sha-w c:\windows\system32\sipikuze.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\apps\SMP\SmpSys.exe" [2005-11-17 975360]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"Configuration de la neuf Box"="c:\program files\neuf telecom\neuf Box\Wizard\QuickAccess.exe" [2005-12-13 389120]
"TVAgent WiFi"="c:\program files\neuf telecom\neuf Box\Wizard\Agent_WiFi.exe" [2005-12-13 976896]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-20 342848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8491008]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Vade Retro Outlook Express"="c:\progra~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2004-10-04 310272]
"DetectorApp"="c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-09-25 229952]
"Launch LGDCore"="c:\program files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 1122304]
"Launch LCDMon"="c:\program files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 497152]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-17 81920]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"F-Secure Manager"="c:\program files\SFR\Pack Sécurité\Common\FSM32.EXE" [2008-09-23 182936]
"F-Secure TNB"="c:\program files\SFR\Pack Sécurité\FSGUI\TNBUtil.exe" [2008-09-23 957024]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2007-09-17 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]
d:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
InstantTimeZone.lnk - c:\program files\InstantTimeZone\InstantTimeZone.exe [2007-04-29 1677436]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-08-22 450560]
OFFICE One Clock v6.5.lnk - c:\program files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe [2006-10-26 257536]
OFFICE One Notes v6.5.lnk - c:\program files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe [2006-10-26 559104]
SiWake.lnk - c:\program files\Wireless LAN Utility\SiWake.exe [2007-05-27 135168]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2006-01-30 07:53 49152 c:\apps\Softex\OmniPass\OPXPGina.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= c:\progra~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= c:\progra~1\FICHIE~1\ULEADS~1\MPEG\mpegacm.acm
"msacm.ulmp3acm"= c:\progra~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ehRecvr"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Eternal Lands\\el.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\APPS\\Softex\\OmniPass\\OPXPApp.exe"=
"c:\\APPS\\Softex\\OmniPass\\OmniServ.exe"=
"c:\\Program Files\\Common Files\\X10\\Common\\X10nets.exe"=
"c:\\WINDOWS\\system32\\dllhost.exe"=
R0 fsbts;fsbts;c:\windows\system32\Drivers\fsbts.sys [2009-01-01 30856]
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2009-01-01 79904]
R1 F-Secure HIPS;F-Secure HIPS Driver;\??\c:\program files\SFR\Pack Sécurité\HIPS\drivers\fshs.sys [2009-01-01 66720]
R3 3xHybrid;3xHybrid service;c:\windows\system32\DRIVERS\3xHybrid.sys [2006-09-11 825600]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\c:\program files\SFR\Pack Sécurité\Anti-Virus\minifilter\fsgk.sys [2009-01-01 72288]
R3 FSORSPClient;F-Secure ORSP Client;"c:\program files\SFR\Pack Sécurité\ORSP Client\fsorsp.exe" [2009-01-01 55904]
R3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-09-11 7040]
S3 NBXG7031;NB 802.11g XG703 SP1 Driver;c:\windows\system32\DRIVERS\WlanUIG.sys [2006-10-21 381312]
S3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2007-05-27 162304]
S3 SQTECH9150;Mini Cam;c:\windows\system32\Drivers\Capt9150.sys [2007-06-06 47087]
S4 F-Secure Filter;F-Secure File System Filter;\??\c:\program files\SFR\Pack Sécurité\Anti-Virus\Win2K\FSfilter.sys [2009-01-01 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;\??\c:\program files\SFR\Pack Sécurité\Anti-Virus\Win2K\FSrec.sys [2009-01-01 25184]
*Newly Created Service* - PCANDIS5
.
Contenu du dossier 'Tâches planifiées'
2008-12-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
2009-01-01 c:\windows\Tasks\At1.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At10.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At11.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-31 c:\windows\Tasks\At12.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-02 c:\windows\Tasks\At13.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At14.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At15.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At16.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-02 c:\windows\Tasks\At17.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At18.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At19.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At2.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At20.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-02 c:\windows\Tasks\At21.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-01 c:\windows\Tasks\At22.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-02 c:\windows\Tasks\At23.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-01 c:\windows\Tasks\At24.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-02 c:\windows\Tasks\At25.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At26.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At27.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At28.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At29.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At3.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At30.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At31.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At32.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At33.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At34.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At35.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-31 c:\windows\Tasks\At36.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-02 c:\windows\Tasks\At37.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At38.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At39.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At4.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\At40.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-02 c:\windows\Tasks\At41.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At42.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At43.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-03 c:\windows\Tasks\At44.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-02 c:\windows\Tasks\At45.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-01 c:\windows\Tasks\At46.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-02 c:\windows\Tasks\At47.job
- c:\windows\system32\W3DdPHYc.exe []
2009-01-01 c:\windows\Tasks\At48.job
- c:\windows\system32\W3DdPHYc.exe []
2008-12-25 c:\windows\Tasks\At5.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At6.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At7.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At8.job
- c:\windows\system32\K3GogBqJ.exe []
2008-12-25 c:\windows\Tasks\At9.job
- c:\windows\system32\K3GogBqJ.exe []
2009-01-03 c:\windows\Tasks\Configurer mon PC.job
- c:\apps\SMP\PCSETUP.EXE [2005-11-17 09:03]
2009-01-03 c:\windows\Tasks\Scheduled scanning task.job
- c:\progra~1\SFR\PACKSC~1\ANTI-V~1\fsav.exe [2008-09-23 14:35]
2009-01-03 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-ISUSPM Startup - c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe
HKLM-Run-OmniPass - c:\apps\Softex\OmniPass\scureapp.exe
HKLM-Run-CanalPlayer - c:\program files\Lecteur CANALPLAY\CanalPlayer.exe
MSConfigStartUp-79041872252976424972244103365599 - c:\program files\Antivirus 2009\av2009.exe
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Connection Wizard,ShellNext = hxxp://192.168.1.1/
uSearchURL,(Default) = hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Recherche sur eBay - c:\program files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - d:\documents and settings\ange\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
LSP: c:\program files\SFR\Pack Se9,curite9,\FSPS\program\FSLSP.DLL
Trusted Zone: *.canalplay.com
Trusted Zone: *.canalplusactive.com
Trusted Zone: *.canalplay.com
Trusted Zone: *.canalplusactive.com
c:\windows\system32\unicows.dll - c:\windows\Downloaded Program Files\telechargement-photoweb.ocx
O16 -: {104B0A37-AB99-4F06-8032-8BBDC3B77DDB}
hxxp://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
c:\windows\Downloaded Program Files\telechargement-photoweb.inf
c:\windows\Downloaded Program Files\npSeaTools_FR.dll - O16 -: {275D2217-FFE8-46B5-8FD2-B18CA0B7EE36}
file://c:\drivers\snapsys\HDDDiag\bin\npseatools.cab
c:\windows\Downloaded Program Files\npSeaTools_FR.inf
c:\windows\system32\unicows.dll - c:\windows\Downloaded Program Files\ImageUploader5.ocx
O16 -: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3}
hxxp://www.photoweb.fr/telechargement/telechargement-photoweb.cab
c:\windows\Downloaded Program Files\ImageUploader5.inf
c:\windows\Downloaded Program Files\msway.dll - O16 -: {E1AF091A-9F23-4059-89D7-C05EE073285D}
hxxp://www.canalplay.com/cabs/msway44.cab
c:\windows\Downloaded Program Files\msway.inf
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-03 19:25:05
Windows 5.1.2600 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-3657964355-63999632-1874375830-1005\Software\Microsoft\SystemCertificates\AddressBook*NULL*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\mpDRM\LicenseStore*NULL*]
@DACL=
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(692)
c:\windows\system32\Ati2evxx.dll
c:\apps\Softex\OmniPass\opxpgina.dll
c:\program files\SFR\Pack Sécurité\FWES\Program\fsdc32.dll
- - - - - - - > 'lsass.exe'(748)
c:\program files\SFR\Pack Sécurité\FSPS\program\FSLSP.DLL
c:\program files\SFR\Pack Sécurité\FWES\Program\fsdc32.dll
- - - - - - - > 'csrss.exe'(660)
c:\program files\SFR\Pack Sécurité\FWES\Program\fsdc32.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\windows\ehome\ehSched.exe
c:\program files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
c:\program files\SFR\Pack Sécurité\Common\FSMA32.EXE
c:\program files\SFR\Pack Sécurité\Anti-Virus\fsgk32.exe
c:\program files\SFR\Pack Sécurité\Common\FSMB32.EXE
c:\apps\Softex\OmniPass\OmniServ.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
c:\program files\SFR\Pack Sécurité\Common\FCH32.EXE
c:\progra~1\COMMON~1\X10\Common\X10nets.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\SFR\Pack Sécurité\Common\FAMEH32.EXE
c:\program files\SFR\Pack Sécurité\Anti-Virus\fsqh.exe
c:\windows\system32\dllhost.exe
c:\program files\SFR\Pack Sécurité\Anti-Virus\fssm32.exe
c:\program files\SFR\Pack Sécurité\FSAUA\program\fsaua.exe
c:\apps\Softex\OmniPass\OPXPApp.exe
c:\program files\SFR\Pack Sécurité\FWES\program\fsdfwd.exe
c:\progra~1\SFR\PACKSC~1\ANTI-V~1\fsav32.exe
c:\windows\ehome\ehmsas.exe
c:\apps\ABOARD\AOSD.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Logitech\G-series Software\Applets\LCDClock.exe
c:\program files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Logitech\G-series Software\Applets\LCDMedia.exe
c:\program files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
c:\program files\SFR\Pack Sécurité\FSGUI\fsguidll.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Logitech\Video\FxSvr2.exe
.
**************************************************************************
.
Heure de fin: 2009-01-03 19:29:51 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-01-03 18:29:46
Avant-CF: 3 299 639 296 octets libres
Après-CF: 3,483,869,184 octets libres
484 --- E O F --- 2008-12-25 22:01:35
attention cette manip est concue specialement pour pour le pc de " Capucine " en fonction des rapports !! interdiction a toutes autres personnes de l'utiliser sur une autre machine !!
voici la suite
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt
Copie le texte en gras : ci-dessous :
Files::
c:\windows\system32\ezulojet.tmp
c:\windows\system32\yurizoye.dll
c:\windows\system32\wivawira.dll
c:\windows\system32\kemomupi.dll
c:\windows\system32\pepufebe.dll
c:\windows\system32\pagifobe.dll
c:\windows\system32\fimohinu.dll
c:\windows\system32\zidajaji.dll
c:\windows\system32\tetupaha.dll
c:\windows\system32\jagenoki.dll
c:\windows\system32\sipikuze.dll
c:\windows\system32\K3GogBqJ.exe
c:\windows\system32\W3DdPHYc.exe
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
fait Glisser maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
voici la suite
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt
Copie le texte en gras : ci-dessous :
Files::
c:\windows\system32\ezulojet.tmp
c:\windows\system32\yurizoye.dll
c:\windows\system32\wivawira.dll
c:\windows\system32\kemomupi.dll
c:\windows\system32\pepufebe.dll
c:\windows\system32\pagifobe.dll
c:\windows\system32\fimohinu.dll
c:\windows\system32\zidajaji.dll
c:\windows\system32\tetupaha.dll
c:\windows\system32\jagenoki.dll
c:\windows\system32\sipikuze.dll
c:\windows\system32\K3GogBqJ.exe
c:\windows\system32\W3DdPHYc.exe
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
fait Glisser maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
Alors voilà la suite : j'ai crée le fichier texte comme demandé et fait glisser dans le programme Combo sur le bureau, et la fenetre bleue s'est ouverte mais rien ne se passe, il n'y a aucunne phrase qui s'inscrit rien, et j'ai attendu longtemps, j'ai essayé plusieurs fois mais ca ne marche pas. En plus j'ai arretté l'ordinateur manuellement (start bouton) car plus rien ne reagissait, et combo ne voulait pas se fermer.
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
bon , on va faire autrement ;-)
Télécharge OTMoveIt3 de OldTimer sur ton Bureau en cliquant sur ce lien :
http://oldtimer.geekstogo.com/OTMoveIt3.exe
Double-clique sur OTMoveIt3.exe pour le lancer.
Vérifie que la case devant "Unregister Dll's and Ocx's est bien cochée.
Copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt : "Paste instructions for item to be moved".
:Processes
explorer.exe
:Services
:Reg
:Files
c:\windows\system32\ezulojet.tmp
c:\windows\system32\yurizoye.dll
c:\windows\system32\wivawira.dll
c:\windows\system32\kemomupi.dll
c:\windows\system32\pepufebe.dll
c:\windows\system32\pagifobe.dll
c:\windows\system32\fimohinu.dll
c:\windows\system32\zidajaji.dll
c:\windows\system32\tetupaha.dll
c:\windows\system32\jagenoki.dll
c:\windows\system32\sipikuze.dll
c:\windows\system32\K3GogBqJ.exe
c:\windows\system32\W3DdPHYc.exe
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
Clique sur "MoveIt!" pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur "Exit" pour fermer.
Poste le rapport situé dans C:\_OTMoveIt\MovedFiles sous le nom xxxxxx_xxxxxxxxxx.log .
Il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.
Télécharge OTMoveIt3 de OldTimer sur ton Bureau en cliquant sur ce lien :
http://oldtimer.geekstogo.com/OTMoveIt3.exe
Double-clique sur OTMoveIt3.exe pour le lancer.
Vérifie que la case devant "Unregister Dll's and Ocx's est bien cochée.
Copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt : "Paste instructions for item to be moved".
:Processes
explorer.exe
:Services
:Reg
:Files
c:\windows\system32\ezulojet.tmp
c:\windows\system32\yurizoye.dll
c:\windows\system32\wivawira.dll
c:\windows\system32\kemomupi.dll
c:\windows\system32\pepufebe.dll
c:\windows\system32\pagifobe.dll
c:\windows\system32\fimohinu.dll
c:\windows\system32\zidajaji.dll
c:\windows\system32\tetupaha.dll
c:\windows\system32\jagenoki.dll
c:\windows\system32\sipikuze.dll
c:\windows\system32\K3GogBqJ.exe
c:\windows\system32\W3DdPHYc.exe
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
Clique sur "MoveIt!" pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur "Exit" pour fermer.
Poste le rapport situé dans C:\_OTMoveIt\MovedFiles sous le nom xxxxxx_xxxxxxxxxx.log .
Il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.
J'ai fait tout ce que tu as conseillé et voici le rapport :
maintenant je souhaite bonne nuit et à demain :)
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
c:\windows\system32\ezulojet.tmp moved successfully.
LoadLibrary failed for c:\windows\system32\yurizoye.dll
c:\windows\system32\yurizoye.dll NOT unregistered.
c:\windows\system32\yurizoye.dll moved successfully.
LoadLibrary failed for c:\windows\system32\wivawira.dll
c:\windows\system32\wivawira.dll NOT unregistered.
c:\windows\system32\wivawira.dll moved successfully.
LoadLibrary failed for c:\windows\system32\kemomupi.dll
c:\windows\system32\kemomupi.dll NOT unregistered.
c:\windows\system32\kemomupi.dll moved successfully.
LoadLibrary failed for c:\windows\system32\pepufebe.dll
c:\windows\system32\pepufebe.dll NOT unregistered.
c:\windows\system32\pepufebe.dll moved successfully.
LoadLibrary failed for c:\windows\system32\pagifobe.dll
c:\windows\system32\pagifobe.dll NOT unregistered.
c:\windows\system32\pagifobe.dll moved successfully.
LoadLibrary failed for c:\windows\system32\fimohinu.dll
c:\windows\system32\fimohinu.dll NOT unregistered.
c:\windows\system32\fimohinu.dll moved successfully.
LoadLibrary failed for c:\windows\system32\zidajaji.dll
c:\windows\system32\zidajaji.dll NOT unregistered.
c:\windows\system32\zidajaji.dll moved successfully.
LoadLibrary failed for c:\windows\system32\tetupaha.dll
c:\windows\system32\tetupaha.dll NOT unregistered.
c:\windows\system32\tetupaha.dll moved successfully.
LoadLibrary failed for c:\windows\system32\jagenoki.dll
c:\windows\system32\jagenoki.dll NOT unregistered.
c:\windows\system32\jagenoki.dll moved successfully.
LoadLibrary failed for c:\windows\system32\sipikuze.dll
c:\windows\system32\sipikuze.dll NOT unregistered.
c:\windows\system32\sipikuze.dll moved successfully.
File/Folder c:\windows\system32\K3GogBqJ.exe not found.
File/Folder c:\windows\system32\W3DdPHYc.exe not found.
c:\windows\Tasks\At1.job moved successfully.
c:\windows\Tasks\At10.job moved successfully.
c:\windows\Tasks\At11.job moved successfully.
c:\windows\Tasks\At12.job moved successfully.
c:\windows\Tasks\At13.job moved successfully.
c:\windows\Tasks\At14.job moved successfully.
c:\windows\Tasks\At15.job moved successfully.
c:\windows\Tasks\At16.job moved successfully.
c:\windows\Tasks\At17.job moved successfully.
c:\windows\Tasks\At18.job moved successfully.
c:\windows\Tasks\At19.job moved successfully.
c:\windows\Tasks\At2.job moved successfully.
c:\windows\Tasks\At20.job moved successfully.
c:\windows\Tasks\At21.job moved successfully.
c:\windows\Tasks\At22.job moved successfully.
c:\windows\Tasks\At23.job moved successfully.
c:\windows\Tasks\At24.job moved successfully.
c:\windows\Tasks\At25.job moved successfully.
c:\windows\Tasks\At26.job moved successfully.
c:\windows\Tasks\At27.job moved successfully.
c:\windows\Tasks\At28.job moved successfully.
c:\windows\Tasks\At29.job moved successfully.
c:\windows\Tasks\At3.job moved successfully.
c:\windows\Tasks\At30.job moved successfully.
c:\windows\Tasks\At31.job moved successfully.
c:\windows\Tasks\At32.job moved successfully.
c:\windows\Tasks\At33.job moved successfully.
c:\windows\Tasks\At34.job moved successfully.
c:\windows\Tasks\At35.job moved successfully.
c:\windows\Tasks\At36.job moved successfully.
c:\windows\Tasks\At37.job moved successfully.
c:\windows\Tasks\At38.job moved successfully.
c:\windows\Tasks\At39.job moved successfully.
c:\windows\Tasks\At4.job moved successfully.
c:\windows\Tasks\At40.job moved successfully.
c:\windows\Tasks\At41.job moved successfully.
c:\windows\Tasks\At42.job moved successfully.
c:\windows\Tasks\At43.job moved successfully.
c:\windows\Tasks\At44.job moved successfully.
c:\windows\Tasks\At45.job moved successfully.
c:\windows\Tasks\At46.job moved successfully.
c:\windows\Tasks\At47.job moved successfully.
c:\windows\Tasks\At48.job moved successfully.
c:\windows\Tasks\At5.job moved successfully.
c:\windows\Tasks\At6.job moved successfully.
c:\windows\Tasks\At7.job moved successfully.
c:\windows\Tasks\At8.job moved successfully.
c:\windows\Tasks\At9.job moved successfully.
========== COMMANDS ==========
File delete failed. D:\DOCUME~1\ange\LOCALS~1\Temp\Perflib_Perfdata_de4.dat scheduled to be deleted on reboot.
File delete failed. D:\DOCUME~1\ange\LOCALS~1\Temp\~DF4082.tmp scheduled to be deleted on reboot.
File delete failed. D:\DOCUME~1\ange\LOCALS~1\Temp\~DF67A2.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\AVP53B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVP53C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVP53D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVP53E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVP53F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVP540.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVPC4.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\nvcbin.def.6E73AF6C.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01042009_003618
maintenant je souhaite bonne nuit et à demain :)
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
c:\windows\system32\ezulojet.tmp moved successfully.
LoadLibrary failed for c:\windows\system32\yurizoye.dll
c:\windows\system32\yurizoye.dll NOT unregistered.
c:\windows\system32\yurizoye.dll moved successfully.
LoadLibrary failed for c:\windows\system32\wivawira.dll
c:\windows\system32\wivawira.dll NOT unregistered.
c:\windows\system32\wivawira.dll moved successfully.
LoadLibrary failed for c:\windows\system32\kemomupi.dll
c:\windows\system32\kemomupi.dll NOT unregistered.
c:\windows\system32\kemomupi.dll moved successfully.
LoadLibrary failed for c:\windows\system32\pepufebe.dll
c:\windows\system32\pepufebe.dll NOT unregistered.
c:\windows\system32\pepufebe.dll moved successfully.
LoadLibrary failed for c:\windows\system32\pagifobe.dll
c:\windows\system32\pagifobe.dll NOT unregistered.
c:\windows\system32\pagifobe.dll moved successfully.
LoadLibrary failed for c:\windows\system32\fimohinu.dll
c:\windows\system32\fimohinu.dll NOT unregistered.
c:\windows\system32\fimohinu.dll moved successfully.
LoadLibrary failed for c:\windows\system32\zidajaji.dll
c:\windows\system32\zidajaji.dll NOT unregistered.
c:\windows\system32\zidajaji.dll moved successfully.
LoadLibrary failed for c:\windows\system32\tetupaha.dll
c:\windows\system32\tetupaha.dll NOT unregistered.
c:\windows\system32\tetupaha.dll moved successfully.
LoadLibrary failed for c:\windows\system32\jagenoki.dll
c:\windows\system32\jagenoki.dll NOT unregistered.
c:\windows\system32\jagenoki.dll moved successfully.
LoadLibrary failed for c:\windows\system32\sipikuze.dll
c:\windows\system32\sipikuze.dll NOT unregistered.
c:\windows\system32\sipikuze.dll moved successfully.
File/Folder c:\windows\system32\K3GogBqJ.exe not found.
File/Folder c:\windows\system32\W3DdPHYc.exe not found.
c:\windows\Tasks\At1.job moved successfully.
c:\windows\Tasks\At10.job moved successfully.
c:\windows\Tasks\At11.job moved successfully.
c:\windows\Tasks\At12.job moved successfully.
c:\windows\Tasks\At13.job moved successfully.
c:\windows\Tasks\At14.job moved successfully.
c:\windows\Tasks\At15.job moved successfully.
c:\windows\Tasks\At16.job moved successfully.
c:\windows\Tasks\At17.job moved successfully.
c:\windows\Tasks\At18.job moved successfully.
c:\windows\Tasks\At19.job moved successfully.
c:\windows\Tasks\At2.job moved successfully.
c:\windows\Tasks\At20.job moved successfully.
c:\windows\Tasks\At21.job moved successfully.
c:\windows\Tasks\At22.job moved successfully.
c:\windows\Tasks\At23.job moved successfully.
c:\windows\Tasks\At24.job moved successfully.
c:\windows\Tasks\At25.job moved successfully.
c:\windows\Tasks\At26.job moved successfully.
c:\windows\Tasks\At27.job moved successfully.
c:\windows\Tasks\At28.job moved successfully.
c:\windows\Tasks\At29.job moved successfully.
c:\windows\Tasks\At3.job moved successfully.
c:\windows\Tasks\At30.job moved successfully.
c:\windows\Tasks\At31.job moved successfully.
c:\windows\Tasks\At32.job moved successfully.
c:\windows\Tasks\At33.job moved successfully.
c:\windows\Tasks\At34.job moved successfully.
c:\windows\Tasks\At35.job moved successfully.
c:\windows\Tasks\At36.job moved successfully.
c:\windows\Tasks\At37.job moved successfully.
c:\windows\Tasks\At38.job moved successfully.
c:\windows\Tasks\At39.job moved successfully.
c:\windows\Tasks\At4.job moved successfully.
c:\windows\Tasks\At40.job moved successfully.
c:\windows\Tasks\At41.job moved successfully.
c:\windows\Tasks\At42.job moved successfully.
c:\windows\Tasks\At43.job moved successfully.
c:\windows\Tasks\At44.job moved successfully.
c:\windows\Tasks\At45.job moved successfully.
c:\windows\Tasks\At46.job moved successfully.
c:\windows\Tasks\At47.job moved successfully.
c:\windows\Tasks\At48.job moved successfully.
c:\windows\Tasks\At5.job moved successfully.
c:\windows\Tasks\At6.job moved successfully.
c:\windows\Tasks\At7.job moved successfully.
c:\windows\Tasks\At8.job moved successfully.
c:\windows\Tasks\At9.job moved successfully.
========== COMMANDS ==========
File delete failed. D:\DOCUME~1\ange\LOCALS~1\Temp\Perflib_Perfdata_de4.dat scheduled to be deleted on reboot.
File delete failed. D:\DOCUME~1\ange\LOCALS~1\Temp\~DF4082.tmp scheduled to be deleted on reboot.
File delete failed. D:\DOCUME~1\ange\LOCALS~1\Temp\~DF67A2.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\AVP53B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVP53C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVP53D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVP53E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVP53F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVP540.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\AVPC4.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\nvcbin.def.6E73AF6C.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01042009_003618
Bonjour :) voici le rapport d'Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:20:38, on 04/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
C:\Program Files\SFR\Pack Sécurité\Common\FSMA32.EXE
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\FSGK32.EXE
C:\Program Files\SFR\Pack Sécurité\Common\FSMB32.EXE
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\Program Files\SFR\Pack Sécurité\Common\FCH32.EXE
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\SFR\Pack Sécurité\Common\FAMEH32.EXE
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsqh.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fssm32.exe
C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsaua.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\Program Files\SFR\Pack Sécurité\FWES\Program\fsdfwd.exe
C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsus.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
C:\Program Files\SFR\Pack Sécurité\Common\FSM32.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\APPS\SMP\SmpSys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
C:\Program Files\SFR\Pack Sécurité\FSGUI\fsguidll.exe
C:\Program Files\neuf telecom\neuf Box\Wizard\Agent_WiFi.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\InstantTimeZone\InstantTimeZone.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\SFR\Pack Sécurité\FSGUI\scanwizard.exe
C:\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.1/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\SFR\Pack Sécurité\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\SFR\Pack Sécurité\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [TVAgent WiFi] C:\Program Files\neuf telecom\neuf Box\Wizard\Agent_WiFi.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InstantTimeZone.lnk = C:\Program Files\InstantTimeZone\InstantTimeZone.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: OFFICE One Clock v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
O4 - Global Startup: OFFICE One Notes v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - D:\Documents and Settings\ange\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {104B0A37-AB99-4F06-8032-8BBDC3B77DDB} (Telechargement Control) - http://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {275D2217-FFE8-46B5-8FD2-B18CA0B7EE36} (Seagate SeaTools Online French) - file://C:\DRIVERS\snapsys\HDDDiag\bin\npseatools.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.photoweb.fr/moncompte/Account/LogOn?ReturnUrl=%2ftransfert
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1AF091A-9F23-4059-89D7-C05EE073285D} (Canal+ Active MSWAY) - https://www.canalplus.com/canalplay/
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://fdata.over-blog.com/99/00/00/01/js/javauploader/ImageUploader4.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\ORSP Client\fsorsp.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:20:38, on 04/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
C:\Program Files\SFR\Pack Sécurité\Common\FSMA32.EXE
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\FSGK32.EXE
C:\Program Files\SFR\Pack Sécurité\Common\FSMB32.EXE
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\Program Files\SFR\Pack Sécurité\Common\FCH32.EXE
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\SFR\Pack Sécurité\Common\FAMEH32.EXE
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsqh.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fssm32.exe
C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsaua.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\Program Files\SFR\Pack Sécurité\FWES\Program\fsdfwd.exe
C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsus.exe
C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
C:\Program Files\SFR\Pack Sécurité\Common\FSM32.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\APPS\SMP\SmpSys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
C:\Program Files\SFR\Pack Sécurité\FSGUI\fsguidll.exe
C:\Program Files\neuf telecom\neuf Box\Wizard\Agent_WiFi.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\InstantTimeZone\InstantTimeZone.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\SFR\Pack Sécurité\FSGUI\scanwizard.exe
C:\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.1/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\SFR\Pack Sécurité\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\SFR\Pack Sécurité\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [TVAgent WiFi] C:\Program Files\neuf telecom\neuf Box\Wizard\Agent_WiFi.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InstantTimeZone.lnk = C:\Program Files\InstantTimeZone\InstantTimeZone.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: OFFICE One Clock v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Clock\ooneclockv65.exe
O4 - Global Startup: OFFICE One Notes v6.5.lnk = C:\Program Files\OFFICE One6.5\OFFICE One Notes\oonotesv65.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - D:\Documents and Settings\ange\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {104B0A37-AB99-4F06-8032-8BBDC3B77DDB} (Telechargement Control) - http://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {275D2217-FFE8-46B5-8FD2-B18CA0B7EE36} (Seagate SeaTools Online French) - file://C:\DRIVERS\snapsys\HDDDiag\bin\npseatools.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.photoweb.fr/moncompte/Account/LogOn?ReturnUrl=%2ftransfert
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E1AF091A-9F23-4059-89D7-C05EE073285D} (Canal+ Active MSWAY) - https://www.canalplus.com/canalplay/
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://fdata.over-blog.com/99/00/00/01/js/javauploader/ImageUploader4.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\SFR\Pack Sécurité\ORSP Client\fsorsp.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
bien ca me semble bien mieux , comment se porte le pc ?
effectue un scanne en ligne afin de controler le travail effectué
* Fais un scan antivirus en ligne ICI :
https://www.bitdefender.fr/
et copie colle le résultat ici
* En bas, à gauche de la fenêtre, clique sur "BitDefender SCAN ONLINE"
* Dans la nouvelle fenêtre, clique sur "I agree"
* La fenêtre change encore, clique sur "Click here to scan"
* Les signatures se chargent, etc.
Tuto (merci Morgane)
https://kerio.probb.fr/t673-bitdefender-antivirus-en-ligne
le rapport de scan se trouve ici
C:\windows\bdoscan8\scanres.txt ou scanres.html
effectue un scanne en ligne afin de controler le travail effectué
* Fais un scan antivirus en ligne ICI :
https://www.bitdefender.fr/
et copie colle le résultat ici
* En bas, à gauche de la fenêtre, clique sur "BitDefender SCAN ONLINE"
* Dans la nouvelle fenêtre, clique sur "I agree"
* La fenêtre change encore, clique sur "Click here to scan"
* Les signatures se chargent, etc.
Tuto (merci Morgane)
https://kerio.probb.fr/t673-bitdefender-antivirus-en-ligne
le rapport de scan se trouve ici
C:\windows\bdoscan8\scanres.txt ou scanres.html
bonsoir, le pc roule à merveille comme neuf :) !!! pour le scan online je l'ai effectué mais au moment d'enregistrer j'ai pris en html et non pas en fichier texte comme il le faut alors je dois le refaire demain. En attendant voici le message qu'il donnait en fin de scan :
BitDefender Online Scanner - Rapport virus en temps réel
Généré à: Sun, Jan 04, 2009 - 23:47:50
--------------------------------------------------------------------------------
Info d'analyse
Fichiers scannés
422406
Infectés Fichiers
0
Virus Détectés
Aucun virus trouvé.
------------------------------------------------------------------------------
Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.
Alors à demain et merci encore pour ton aide, c'est vraiment super impressionnant de voir combien tu m'as aidé !!
BitDefender Online Scanner - Rapport virus en temps réel
Généré à: Sun, Jan 04, 2009 - 23:47:50
--------------------------------------------------------------------------------
Info d'analyse
Fichiers scannés
422406
Infectés Fichiers
0
Virus Détectés
Aucun virus trouvé.
------------------------------------------------------------------------------
Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.
Alors à demain et merci encore pour ton aide, c'est vraiment super impressionnant de voir combien tu m'as aidé !!
bonjour parfait , relance hijackthis , do a scan systeme only et coche les cases qui se trouvent devant ces lignes puis clique sur fix chequed
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://fdata.over-blog.com/99/00/00/01/js/javauploader/ImageUploader4.cab
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://fdata.over-blog.com/99/00/00/01/js/javauploader/ImageUploader4.cab
Bonjour
Aujourd'hui j'ai refait le scan online, mais je n'arrive pas à avoir le rapport en texte, j'ai sauvé cela mais je crois que ca n'est pas lisible ...et je n'arrives pas à trouver de fichier scanres.txt, et il ne donne pas le choix de format non plus.
<HTML>
<HEAD>
<TITLE>BitDefender Online Scanner - Rapport d'analyse</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
</HEAD>
<BODY BGCOLOR=#FFFFFF leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >
<table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
<tr>
<td width="458">
<p><font face="Arial" color=red><span style="font-size:14pt;"><b>BitDefender Online Scanner</b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td colspan="3" width="912">
<p><font face="Arial"><span style="font-size:11pt;"><B>Rapport d'analyse généré à: Mon, Jan 05, 2009 - 14:08:03</b></span></font></p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B>Voie d'analyse: </b></span><span style="font-size:10pt;">C:\;D:\;E:\;G:\;H:\;I:\;K:\;</span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Statistiques</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Temps</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">01:31:54</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">413793</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Directoires</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">11807</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Secteurs de boot</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Archives</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">11239</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Paquets programmes</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">13973</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Résultats</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Virus identifiés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers infectés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers suspects</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Avertissements</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Désinfectés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers effacés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Info sur les moteurs</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Définition virus</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">2404853</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Version des moteurs</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14)</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">17</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Archive des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">45</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Unpack des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">7</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">E-mail plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">6</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Système plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">4</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Paramètres d'analyse</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Première action</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Désinfecté</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Seconde Action</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Heuristique</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Acceptez les avertissements</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Extensions analysées</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">*;</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Excludez les extensions</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2"> </font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse d'emails</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des Archives</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyser paquets programmes</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des fichiers</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse de boot</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td colspan=2>
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="252" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Fichier analysé</b></font></p>
</td>
<td width="195" bgcolor="#CCCCCC" align="right">
<p align="left"><b><font size="2" face="Arial"> Statut</font></b></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Aucun virus trouvé.</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2"> </font></p>
</td>
</tr>
</table>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
</table>
<p> </p>
</body>
</html>
Aujourd'hui j'ai refait le scan online, mais je n'arrive pas à avoir le rapport en texte, j'ai sauvé cela mais je crois que ca n'est pas lisible ...et je n'arrives pas à trouver de fichier scanres.txt, et il ne donne pas le choix de format non plus.
<HTML>
<HEAD>
<TITLE>BitDefender Online Scanner - Rapport d'analyse</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
</HEAD>
<BODY BGCOLOR=#FFFFFF leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >
<table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
<tr>
<td width="458">
<p><font face="Arial" color=red><span style="font-size:14pt;"><b>BitDefender Online Scanner</b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td colspan="3" width="912">
<p><font face="Arial"><span style="font-size:11pt;"><B>Rapport d'analyse généré à: Mon, Jan 05, 2009 - 14:08:03</b></span></font></p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B>Voie d'analyse: </b></span><span style="font-size:10pt;">C:\;D:\;E:\;G:\;H:\;I:\;K:\;</span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Statistiques</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Temps</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">01:31:54</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">413793</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Directoires</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">11807</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Secteurs de boot</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Archives</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">11239</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Paquets programmes</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">13973</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Résultats</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Virus identifiés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers infectés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers suspects</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Avertissements</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Désinfectés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers effacés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Info sur les moteurs</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Définition virus</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">2404853</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Version des moteurs</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14)</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">17</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Archive des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">45</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Unpack des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">7</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">E-mail plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">6</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Système plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">4</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Paramètres d'analyse</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Première action</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Désinfecté</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Seconde Action</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Heuristique</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Acceptez les avertissements</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Extensions analysées</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">*;</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Excludez les extensions</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2"> </font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse d'emails</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des Archives</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyser paquets programmes</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des fichiers</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse de boot</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td colspan=2>
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="252" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Fichier analysé</b></font></p>
</td>
<td width="195" bgcolor="#CCCCCC" align="right">
<p align="left"><b><font size="2" face="Arial"> Statut</font></b></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Aucun virus trouvé.</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2"> </font></p>
</td>
</tr>
</table>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
</table>
<p> </p>
</body>
</html>
desolée je n'avais pas vu ton message de 12:
ca y est j'ai fait un scan de hijackthis et cocher les cases et fais fixed et redemarrer le pc. :) Il ouvre les pages hyper vite maintenant ! on dirait une formule 1 ;)
ca y est j'ai fait un scan de hijackthis et cocher les cases et fais fixed et redemarrer le pc. :) Il ouvre les pages hyper vite maintenant ! on dirait une formule 1 ;)
ca fait plaisir a lire !!
effectue ceci , tu optimiseras encore un chouille ton pc
fin de desinfection , on supprime les dernieres traces et petit coups de menage ;-))
Telecharge
-- CCleaner
https://www.ccleaner.com/ccleaner/download
Choisi de préférence la version SLIM-No Toolbar.
Installe-le en prenant soin de décocher les diverses options dont la barre Yahoo et la mise à jour.
Lance CCleaner puis Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures".
Pour les autres paramètres, laisse-le avec ses réglages par défaut.
Lance CCleaner en double-cliquant sur son raccourci sur le bureau.
Puis dans le menu Nettoyeur
Clique sur Analyse (laisser travailler cela peut durer longtemps la 1ere fois)
Clique sur le bouton Lancer le nettoyage.
Clique une seconde fois sur le bouton Lancer le nettoyage
clique sur registre cherche et repare les erreurs effectue trois fois la manip pour que se sois efficace !
---------
ensuite suppression des outils utilisés
· Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.
http://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe
· Clique sur Recherche et laisse le scan se terminer.
· Clique, sur Suppression pour finaliser.
· Tu peux, si tu le souhaites, te servir des Options facultatives.
· Clique sur Quitter, pour que le rapport puisse se créer.
· Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).
et derniere manip a effectuer tu dois purger ta restauration syteme afin d'y supprimer les virus restes en memoire dans ton pc
http://www.libellules.ch/desactiver_restauration.php
desactive la et ensuite tu la reactive puis tu cree un nouveau point de restauration sains
tuto cree un point de restauration systeme https://www.vulgarisation-informatique.com/creer-point-restauration.php
effectue ceci , tu optimiseras encore un chouille ton pc
fin de desinfection , on supprime les dernieres traces et petit coups de menage ;-))
Telecharge
-- CCleaner
https://www.ccleaner.com/ccleaner/download
Choisi de préférence la version SLIM-No Toolbar.
Installe-le en prenant soin de décocher les diverses options dont la barre Yahoo et la mise à jour.
Lance CCleaner puis Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures".
Pour les autres paramètres, laisse-le avec ses réglages par défaut.
Lance CCleaner en double-cliquant sur son raccourci sur le bureau.
Puis dans le menu Nettoyeur
Clique sur Analyse (laisser travailler cela peut durer longtemps la 1ere fois)
Clique sur le bouton Lancer le nettoyage.
Clique une seconde fois sur le bouton Lancer le nettoyage
clique sur registre cherche et repare les erreurs effectue trois fois la manip pour que se sois efficace !
---------
ensuite suppression des outils utilisés
· Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.
http://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe
· Clique sur Recherche et laisse le scan se terminer.
· Clique, sur Suppression pour finaliser.
· Tu peux, si tu le souhaites, te servir des Options facultatives.
· Clique sur Quitter, pour que le rapport puisse se créer.
· Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).
et derniere manip a effectuer tu dois purger ta restauration syteme afin d'y supprimer les virus restes en memoire dans ton pc
http://www.libellules.ch/desactiver_restauration.php
desactive la et ensuite tu la reactive puis tu cree un nouveau point de restauration sains
tuto cree un point de restauration systeme https://www.vulgarisation-informatique.com/creer-point-restauration.php
et ben ça c'est du nettoyage de pc !! ca doit briller à l'intérieur maintenant :), j'ai fait le premier nettoyage avec ccleaner, mais pour le deusième je ne peux pas accéder à la page du programme de scan car c'est reservé pour les adhérents à Orange ... Est ce que je dois m'inscrire à Orange ?
non lol tu demande , et je te l'apporte
http://www.commentcamarche.net/telecharger/telechargement 34055291 toolscleaner
http://www.commentcamarche.net/telecharger/telechargement 34055291 toolscleaner
voici la suite ...
Toutefois je n'ai pas trouvé le rapport dans le C mais dans le D ... J'espère que cela n'est pas grave ...
maintenant je vais m'occupper du point de restauration et puis je vais aller retrouver mon oreiller et pour cela je dis d'avance Bonne nuit, car il est deja tard pour moi en semaine :)
[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]
-->- Recherche:
D:\_OtMoveIt: trouvé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
D:\Documents and Settings\ange\Bureau\SdFix.exe: trouvé !
D:\Documents and Settings\ange\Bureau\HijackThis.lnk: trouvé !
D:\Documents and Settings\ange\Bureau\ComboFix.exe: trouvé !
D:\Documents and Settings\ange\Bureau\OTMoveIt3.exe: trouvé !
D:\Documents and Settings\ange\Bureau\SDFIX: trouvé !
D:\Documents and Settings\ange\Bureau\SmitFraudfix: trouvé !
---------------------------------
-->- Suppression:
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
D:\Documents and Settings\ange\Bureau\SdFix.exe: supprimé !
D:\Documents and Settings\ange\Bureau\HijackThis.lnk: supprimé !
D:\Documents and Settings\ange\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
D:\Documents and Settings\ange\Bureau\OTMoveIt3.exe: supprimé !
D:\_OtMoveIt: supprimé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
D:\Documents and Settings\ange\Bureau\SDFIX: supprimé !
D:\Documents and Settings\ange\Bureau\SmitFraudfix: supprimé !
Toutefois je n'ai pas trouvé le rapport dans le C mais dans le D ... J'espère que cela n'est pas grave ...
maintenant je vais m'occupper du point de restauration et puis je vais aller retrouver mon oreiller et pour cela je dis d'avance Bonne nuit, car il est deja tard pour moi en semaine :)
[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]
-->- Recherche:
D:\_OtMoveIt: trouvé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
D:\Documents and Settings\ange\Bureau\SdFix.exe: trouvé !
D:\Documents and Settings\ange\Bureau\HijackThis.lnk: trouvé !
D:\Documents and Settings\ange\Bureau\ComboFix.exe: trouvé !
D:\Documents and Settings\ange\Bureau\OTMoveIt3.exe: trouvé !
D:\Documents and Settings\ange\Bureau\SDFIX: trouvé !
D:\Documents and Settings\ange\Bureau\SmitFraudfix: trouvé !
---------------------------------
-->- Suppression:
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
D:\Documents and Settings\ange\Bureau\SdFix.exe: supprimé !
D:\Documents and Settings\ange\Bureau\HijackThis.lnk: supprimé !
D:\Documents and Settings\ange\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
D:\Documents and Settings\ange\Bureau\OTMoveIt3.exe: supprimé !
D:\_OtMoveIt: supprimé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
D:\Documents and Settings\ange\Bureau\SDFIX: supprimé !
D:\Documents and Settings\ange\Bureau\SmitFraudfix: supprimé !
voilà j'ai desactivé mais pour reactivé le point de restauration on ne m'a pas demandé de descriptif, j'ai eue seulement droit à un bouton oui ou annuler à clicker ... mais je suppose que ce n'est pas important.
Est ce que l'ordinateur est maintenant hors danger ou bien je dois encore faire quelque chose ?
Et aussi si ce n'est pas abuser avant de finir j'ai une petite question : j'avais avant la barre d'outil d'Ebay qui me sert pas mal quand je passes des annonces (cela me permet de voir les alertes lorsque des personnes me posent des questions sur les objets en vente) et depuis que j'ai effectué les changements sur le pc la barre a disparu.
Est ce que je peux réinstaller la barre d'outil d'ebay sans risque ou bien c'est mieux de ne pas le faire ? (je n'ose plus rien telecharger à force) merci encore et Bonne nuit. :)
Est ce que l'ordinateur est maintenant hors danger ou bien je dois encore faire quelque chose ?
Et aussi si ce n'est pas abuser avant de finir j'ai une petite question : j'avais avant la barre d'outil d'Ebay qui me sert pas mal quand je passes des annonces (cela me permet de voir les alertes lorsque des personnes me posent des questions sur les objets en vente) et depuis que j'ai effectué les changements sur le pc la barre a disparu.
Est ce que je peux réinstaller la barre d'outil d'ebay sans risque ou bien c'est mieux de ne pas le faire ? (je n'ose plus rien telecharger à force) merci encore et Bonne nuit. :)
bonjour , il ne faut tout de meme pas sombrer dans une psychose ! lol
oui tu peu reinstaller ta toolbar ebay , pas de soucis ;-)
oui tu peu reinstaller ta toolbar ebay , pas de soucis ;-)
alors je penses que tu as sauvé mon pc et m' a permis de faire pas mal d'économie, ce qui dans mon petit foyer n'est pas negligeable ;). Je te dis un grand merci, je ne sais que dire de plus ... faire cela en benevolat c'est franchement genial de ta part, et de tous ceux qui aident sur ce forum. On est tellement desemparé devant l'informatique quand on a pas la tête pour ça ... ton aide m'a permis de ne pas avoir de retard sur mon travail, qui lui meme apporte à d'autres gens ... ect ... c'est la boule de neige bénéfique :D !
je penses que c'est toi qui dois mettre resolu ?
je penses que c'est toi qui dois mettre resolu ?
bonjour merci , beaucoup ;-) ca fait tres plaisir , et c'est bien suffisant !!
je suis heureux d'avoir pu te rendre services , et ainsi qu'as toutes les personnes avec qui tu travail ;-)
Pour mettre en resolus il faut que tu clique sur le petit triangle jaune sur ta gauche ( alerter la moderation ) et leurs demander de mettre le statut resolu sur ton poste .
je te souhaite une bonne année pleinne de bonne chose ainsi qu'une bonne continuation et bon surf !!
ps : n'hesite pas a venir me relancer sur ce meme poste si tu as des soucis ou des questions ;-)
je suis heureux d'avoir pu te rendre services , et ainsi qu'as toutes les personnes avec qui tu travail ;-)
Pour mettre en resolus il faut que tu clique sur le petit triangle jaune sur ta gauche ( alerter la moderation ) et leurs demander de mettre le statut resolu sur ton poste .
je te souhaite une bonne année pleinne de bonne chose ainsi qu'une bonne continuation et bon surf !!
ps : n'hesite pas a venir me relancer sur ce meme poste si tu as des soucis ou des questions ;-)