Pas capable de finir

Question

Bonjour, j'ai le foutu viruse antiverus 2009 ,la je suis rendu a faire analiser les rapport . J'espere que quelqu'un va pouvoir m'aider. Mesci.


"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 2009-01-02|12:38 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [2005-04-15|14:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [2005-04-15|14:36] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [2008-10-17|22:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [2007-09-13|14:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems
   [2008-12-26|15:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [2007-09-13|08:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [2007-10-23|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [2007-11-17|12:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [2008-12-21|14:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [2006-12-16|09:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [2007-01-13|21:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [2008-08-07|10:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
   [2008-08-07|10:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
   [2008-08-06|11:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [2005-04-15|14:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [2007-03-23|21:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [2007-09-13|08:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [2008-12-26|15:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [2008-12-23|19:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [2008-12-20|13:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SITEguard
   [2007-09-07|22:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [2008-12-27|08:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation
   [2008-12-20|12:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\STOPzilla!
   [2006-08-30|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [2008-10-01|11:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [2008-05-31|20:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TrackMania
   [2007-06-19|17:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [2006-12-19|17:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

   [2005-04-15|14:36] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [2005-04-15|14:36] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [2005-04-15|14:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [2005-04-15|14:36] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

   [2007-09-13|14:37] C:\DOCUME~1\SERGEL~1\APPLIC~1\ACD Systems
   [2007-01-03|11:22] C:\DOCUME~1\SERGEL~1\APPLIC~1\Adobe
   [2007-01-03|11:22] C:\DOCUME~1\SERGEL~1\APPLIC~1\AdobeUM
   [2007-09-13|08:35] C:\DOCUME~1\SERGEL~1\APPLIC~1\Ahead
   [2007-11-17|12:09] C:\DOCUME~1\SERGEL~1\APPLIC~1\Apple Computer
   [2008-12-21|15:57] C:\DOCUME~1\SERGEL~1\APPLIC~1\Avira
   [2006-12-16|09:51] C:\DOCUME~1\SERGEL~1\APPLIC~1\CyberLink
   [2006-12-24|10:27] C:\DOCUME~1\SERGEL~1\APPLIC~1\DWGeditor
   [2007-05-07|18:59] C:\DOCUME~1\SERGEL~1\APPLIC~1\F-Secure
   [2007-10-04|21:03] C:\DOCUME~1\SERGEL~1\APPLIC~1\FunWebProducts
   [2007-01-13|21:29] C:\DOCUME~1\SERGEL~1\APPLIC~1\Google
   [2007-06-19|17:33] C:\DOCUME~1\SERGEL~1\APPLIC~1\Help
   [2005-04-15|14:55] C:\DOCUME~1\SERGEL~1\APPLIC~1\Identities
   [2008-12-27|08:36] C:\DOCUME~1\SERGEL~1\APPLIC~1\InstallShield
   [2008-06-14|18:45] C:\DOCUME~1\SERGEL~1\APPLIC~1\InterTrust
   [2007-05-07|18:55] C:\DOCUME~1\SERGEL~1\APPLIC~1\ispnews
   [2006-12-14|18:00] C:\DOCUME~1\SERGEL~1\APPLIC~1\Macromedia
   [2005-04-15|14:36] C:\DOCUME~1\SERGEL~1\APPLIC~1\Microsoft
   [2007-09-29|17:05] C:\DOCUME~1\SERGEL~1\APPLIC~1\mIRC
   [2006-12-20|18:44] C:\DOCUME~1\SERGEL~1\APPLIC~1\MSNInstaller
   [2008-10-04|20:16] C:\DOCUME~1\SERGEL~1\APPLIC~1\Nero
   [2007-05-07|18:59] C:\DOCUME~1\SERGEL~1\APPLIC~1\PEX
   [2008-02-24|15:27] C:\DOCUME~1\SERGEL~1\APPLIC~1\skypePM
   [2006-12-24|11:01] C:\DOCUME~1\SERGEL~1\APPLIC~1\SolidWorks
   [2008-12-27|08:47] C:\DOCUME~1\SERGEL~1\APPLIC~1\Sony Corporation
   [2007-08-30|17:43] C:\DOCUME~1\SERGEL~1\APPLIC~1\Sun
   [2007-02-18|12:39] C:\DOCUME~1\SERGEL~1\APPLIC~1	eamspeak2
   [2006-12-14|21:34] C:\DOCUME~1\SERGEL~1\APPLIC~1\U3
   [2007-06-19|17:41] C:\DOCUME~1\SERGEL~1\APPLIC~1\Ulead Systems
   [2007-01-05|20:40] C:\DOCUME~1\SERGEL~1\APPLIC~1\uTorrent
   [2008-05-03|17:33] C:\DOCUME~1\SERGEL~1\APPLIC~1\Ventrilo
   [2007-12-31|00:37] C:\DOCUME~1\SERGEL~1\APPLIC~1\WinRAR
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [2009-01-01 18:09][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [2009-01-02 12:10][--ah-----] C:\WINDOWS	asks\SA.DAT
   [2004-08-10 05:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [2008-12-22|18:40] C:\Program Files\1ClickUnZip
   [2007-09-13|14:36] C:\Program Files\ACD Systems
   [2006-08-30|20:40] C:\Program Files\Acer Inc
   [2006-08-30|20:41] C:\Program Files\Adobe
   [2008-06-07|11:04] C:\Program Files\Apple Software Update
   [2008-12-21|14:02] C:\Program Files\Avira
   [2008-10-17|22:23] C:\Program Files\Bonjour
   [2008-08-05|21:59] C:\Program Files\Circle Developement
   [2005-04-15|14:42] C:\Program Files\ComPlus Applications
   [2006-08-30|20:35] C:\Program Files\CONEXANT
   [2006-12-14|18:00] C:\Program Files\CyberLink
   [2006-08-30|20:30] C:\Program Files\DIFX
   [2007-12-23|14:58] C:\Program Files\Dofus
   [2007-04-07|09:10] C:\Program Files\Dofus-Arena
   [2007-06-19|17:32] C:\Program Files\DSC_Program
   [2008-06-14|18:46] C:\Program Files\DSS
   [2006-12-24|10:26] C:\Program Files\DWGeditor
   [2008-10-01|11:10] C:\Program Files\Eltima Software
   [2008-12-13|10:15] C:\Program Files\FBrowserAdvisor
   [2008-12-13|10:15] C:\Program Files\FBrowsingAdvisor
   [2005-04-15|14:37] C:\Program Files\Fichiers communs
   [2007-01-12|22:38] C:\Program Files\Google
   [2006-08-30|20:33] C:\Program Files\InstallShield Installation Information
   [2005-04-15|14:44] C:\Program Files\Internet Explorer
   [2008-10-17|22:24] C:\Program Files\iPod
   [2008-10-17|22:24] C:\Program Files\iTunes
   [2006-12-24|12:42] C:\Program Files\Java
   [2006-12-14|18:03] C:\Program Files\Launch Manager
   [2006-12-24|12:41] C:\Program Files\LimeWire
   [2006-12-14|22:55] C:\Program Files\Logitech
   [2005-04-15|14:41] C:\Program Files\Messenger
   [2008-08-05|21:59] C:\Program Files\Messenger Plus! Live
   [2005-04-15|14:47] C:\Program Files\microsoft frontpage
   [2006-12-24|10:26] C:\Program Files\Microsoft Office
   [2007-03-23|22:01] C:\Program Files\Microsoft Visual Studio
   [2007-03-23|22:01] C:\Program Files\Microsoft Works
   [2007-03-23|22:00] C:\Program Files\Microsoft.NET
   [2007-09-29|17:04] C:\Program Files\mIRC
   [2005-04-15|14:41] C:\Program Files\Movie Maker
   [2005-04-15|14:41] C:\Program Files\MSN
   [2005-04-15|14:41] C:\Program Files\MSN Gaming Zone
   [2006-12-26|17:59] C:\Program Files\MSN Messenger
   [2008-11-13|17:58] C:\Program Files\MSXML 4.0
   [2009-01-02|12:30] C:\Program Files\Navilog1
   [2007-09-13|08:32] C:\Program Files\Nero
   [2005-04-15|14:44] C:\Program Files\NetMeeting
   [2006-08-30|20:39] C:\Program Files\NewTech Infosystems
   [2008-12-26|15:06] C:\Program Files\NOS
   [2005-04-15|14:42] C:\Program Files\Online Services
   [2005-04-15|14:44] C:\Program Files\Outlook Express
   [2007-10-16|18:07] C:\Program Files\PhotoFrame_V1.5
   [2008-10-17|22:22] C:\Program Files\QuickTime
   [2006-08-30|20:34] C:\Program Files\Realtek
   [2007-12-02|20:00] C:\Program Files\Runtime Software
   [2008-10-17|22:16] C:\Program Files\Safari
   [2007-02-08|22:03] C:\Program Files\Slayers Online
   [2007-03-07|23:09] C:\Program Files\Softnyx
   [2007-09-13|13:20] C:\Program Files\SolidWorks
   [2007-09-13|13:31] C:\Program Files\SolidWorks Installation Manager
   [2008-12-27|08:41] C:\Program Files\Sonic
   [2008-12-26|15:05] C:\Program Files\Sony
   [2008-12-22|17:49] C:\Program Files\Steam
   [2006-08-30|20:50] C:\Program Files\Symantec
   [2006-08-30|20:35] C:\Program Files\Synaptics
   [2008-12-22|18:28] C:\Program Files\SystemRequirementsLab
   [2007-02-18|12:39] C:\Program Files\Teamspeak2_RC2
   [2008-12-20|11:28] C:\Program Files\Trend Micro
   [2008-09-06|16:35] C:\Program Files\TSO
   [2007-06-19|17:27] C:\Program Files\Ulead Systems
   [2005-04-15|14:55] C:\Program Files\Uninstall Information
   [2007-02-17|16:39] C:\Program Files\Valve
   [2008-05-03|17:33] C:\Program Files\Ventrilo
   [2008-10-18|16:29] C:\Program Files\VirtualDJ
   [2008-12-13|10:15] C:\Program Files\VisualTool
   [2007-03-25|13:59] C:\Program Files\WarRock
   [2007-09-13|13:20] C:\Program Files\Windows Desktop Search
   [2008-08-05|21:59] C:\Program Files\Windows Live
   [2006-12-14|22:57] C:\Program Files\Windows Media Components
   [2007-10-26|20:29] C:\Program Files\Windows Media Connect 2
   [2005-04-15|14:42] C:\Program Files\Windows Media Player
   [2005-04-15|14:41] C:\Program Files\Windows NT
   [2005-04-15|14:42] C:\Program Files\Windows Plus
   [2005-04-15|14:45] C:\Program Files\WindowsUpdate
   [2007-12-31|00:37] C:\Program Files\WinRAR
   [2005-04-15|14:47] C:\Program Files\xerox
   [2007-06-19|17:36] C:\Program Files\XviD
   [2006-12-14|18:10] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [2007-09-13|14:36] C:\Program Files\Fichiers communs\ACD Systems
   [2008-05-09|21:04] C:\Program Files\Fichiers communs\Adobe
   [2007-09-13|08:32] C:\Program Files\Fichiers communs\Ahead
   [2007-11-17|12:07] C:\Program Files\Fichiers communs\Apple
   [2006-12-24|10:44] C:\Program Files\Fichiers communs\Bluebeam Software
   [2006-12-24|10:26] C:\Program Files\Fichiers communs\Designer
   [2006-08-30|20:31] C:\Program Files\Fichiers communs\InstallShield
   [2008-12-20|12:22] C:\Program Files\Fichiers communs\iS3
   [2006-12-24|12:41] C:\Program Files\Fichiers communs\Java
   [2006-08-30|20:40] C:\Program Files\Fichiers communs\LightScribe
   [2008-08-07|10:34] C:\Program Files\Fichiers communs\logishrd
   [2006-12-14|22:57] C:\Program Files\Fichiers communs\Logitech
   [2005-04-15|14:37] C:\Program Files\Fichiers communs\Microsoft Shared
   [2005-04-15|14:44] C:\Program Files\Fichiers communs\MSSoap
   [2006-08-30|20:39] C:\Program Files\Fichiers communs\muvee Technologies
   [2006-08-30|20:39] C:\Program Files\Fichiers communs\NewTech Infosystems
   [2005-04-15|14:37] C:\Program Files\Fichiers communs\ODBC
   [2005-04-15|14:44] C:\Program Files\Fichiers communs\Services
   [2007-09-13|13:20] C:\Program Files\Fichiers communs\Solidworks Data
   [2007-09-13|13:21] C:\Program Files\Fichiers communs\SolidWorks Shared
   [2005-04-15|14:37] C:\Program Files\Fichiers communs\SpeechEngines
   [2007-01-01|22:59] C:\Program Files\Fichiers communs\SWF Studio
   [2006-08-30|20:49] C:\Program Files\Fichiers communs\Symantec Shared
   [2005-04-15|14:44] C:\Program Files\Fichiers communs\System
   [2007-06-19|17:27] C:\Program Files\Fichiers communs\Ulead Systems
   [2008-05-03|17:33] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 64 Processes )

   iexplore.exe ~ [PID:564]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sz14.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sl6.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sn6.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sy1E.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sx63.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sk3E.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
si1C.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sz37.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sx48.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sy91.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sf19.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sv1B9.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sy32.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sfE.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sxD3.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
st181.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sc209.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
si20E.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sn219.tmp
   C:\Program Files\Circle Developement
   C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@advertstream[2].txt
   C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@adultfriendfinder[2].txt
   C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@advertising[1].txt
   C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@ero-advertising[2].txt
   C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@adopt.euroclick[2].txt
   C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@partypoker[1].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-01-02 12:42:16
   Windows 5.1.2600 Service Pack 3 FAT NTAPI
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:4683][D:97]-> C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
   [F:396][D:0]-> C:\DOCUME~1\SERGEL~1\Cookies
   [F:30711][D:84]-> C:\DOCUME~1\SERGEL~1\LOCALS~1\TEMPOR~1\content.IE5
   [F:2][D:0]-> C:\Recycled

   1 - "C:\Lop SD\LopR_1.txt" - 2009-01-02|12:44 - Option : [1]

   --------------------\  Fin du rapport a 12:44:31

darkpoet · Answer

télécharge hijackthis 
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download 

-> enregistre la cible sous .... "le bureau" 

-> Fais un double-clic sur "HJTInstall.exe" afin de lancer l'installation 

-> Clique sur Install ensuite sur "I Accept" 

-> Clique sur" Do a scan system and save log file" 

-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse 

-> 
http://pageperso.aol.fr/balltrap34/Hijenr.gif 
Démo : (Merci a Balltrap34 pour cette réalisation)

serdeninc · Answer

Merci ,ca donne ca le rapport.   


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:33:33, on 2009-01-02
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eLock\LockServ.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\program files\steam\steam.exe
C:\Program Files\MSN Messenger\MSNMSGR.EXE
C:\WINDOWS\system32\svchost.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fsympatico.msn.ca%2fdefaultf.aspx%2f%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {01c543da-fed5-4b54-ac92-ba63c42f2c52} - C:\WINDOWS\system32\fuzoyalu.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: VisualTool - {F3A54897-9E68-B11E-A37A-4D1422CE9CAA} - C:\Program Files\VisualTool\VisualTool-3.dll (file missing)
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll (file missing)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Microsoft] C:\WINDOWS\wuauclt.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [0b790604] rundll32.exe "C:\WINDOWS\system32\dokakuru.dll",b
O4 - HKLM\..\Run: [diwodakefa] Rundll32.exe "C:\WINDOWS\system32\loboseta.dll",s
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MSNMSGR.EXE" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs: C:\WINDOWS\system32elipasi.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira Premium Security Suite Pare-feu (AntiVirFirewallService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe
O23 - Service: Avira Premium Security Suite MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
O23 - Service: Planificateur Avira Premium Security Suite (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
O23 - Service: Avira Premium Security Suite Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
O23 - Service: Avira Premium Security Suite WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service d'assistance Avira Premium Security Suite MailGuard (AVEService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe

darkpoet · Answer

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau. 
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 

* Lance l'installation du programme en exécutant le fichier téléchargé. 
* Double-clique maintenant sur le raccourci de Toolbar-S&D. 
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 
* Poste le rapport généré. (C:\TB.txt)

serdeninc · Answer

Voici le raport

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 Mobile Technology MK-36 )
   BIOS : PhoenixBIOS 4.0 Release 6.1     
   USER : Serge Laplante ( Administrator )
   BOOT : Normal boot
   Antivirus : Avira AntiVir PersonalEdition Classic 0.0.0.0 (Activated)
   Firewall  : Avira Pare-feu 8.0.1.30 (Not Activated)
   C:\ (Local Disk) - FAT32 - Total:53 Go (Free:1 Go)
   D:\ (Local Disk) - FAT32 - Total:53 Go (Free:34 Go)
   E:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [1] ( 2009-01-03|11:43 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\NERF.tmp\Toolbar.exe
   C:\Program Files\FBrowserAdvisor
   C:\Program Files\FBrowsingAdvisor
   C:\Program Files\FBrowsingAdvisor\unins000.dat
   C:\Program Files\FBrowsingAdvisor\main.db
   C:\Program Files\FBrowsingAdvisor\Logo.png
   C:\Program Files\FBrowsingAdvisor\IXPCOMEvents.xpt
   C:\Program Files\FBrowsingAdvisor\unins000.exe
   C:\DOCUME~1\SERGEL~1\APPLIC~1\FunWebProducts
   C:\DOCUME~1\SERGEL~1\APPLIC~1\FunWebProducts\Data
   C:\DOCUME~1\SERGEL~1\APPLIC~1\FunWebProducts\Data\Serge Laplante
   C:\DOCUME~1\SERGEL~1\APPLIC~1\FunWebProducts\Data\Serge Laplante\avatar.dat
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em201.tmp.exe
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em205.tmp.exe
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em20B.tmp.exe
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em211.tmp.exe
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em215.tmp.exe
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em21B.tmp.exe
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sz14.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sl6.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sn6.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sy1E.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sx63.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sk3E.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
si1C.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sz37.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sx48.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sy91.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sf19.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sv1B9.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sy32.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sfE.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sxD3.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
st181.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sc209.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
si20E.tmp
   C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sn219.tmp

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fsympatico.msn.ca%2fdefaultf.aspx%2f%3f"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 2009-01-03|11:44 - Option : [1]

   -----------\  Fin du rapport a 11:44:58,38

darkpoet · Answer

relance toolbarsd et fait option 2 post le rapport

serdeninc · Answer

Salut , j'ai fait option 2

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 Mobile Technology MK-36 )
   BIOS : PhoenixBIOS 4.0 Release 6.1     
   USER : Serge Laplante ( Administrator )
   BOOT : Normal boot
   Antivirus : Avira AntiVir PersonalEdition Classic 0.0.0.0 (Activated)
   Firewall  : Avira Pare-feu 8.0.1.30 (Not Activated)
   C:\ (Local Disk) - FAT32 - Total:53 Go (Free:1 Go)
   D:\ (Local Disk) - FAT32 - Total:53 Go (Free:34 Go)
   E:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 2009-01-04| 3:18 )

   -----------\ SUPPRESSION

   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\NERF.tmp\Toolbar.exe
   Supprime! - C:\Program Files\FBrowsingAdvisor\unins000.dat
   Supprime! - C:\Program Files\FBrowsingAdvisor\main.db
   Supprime! - C:\Program Files\FBrowsingAdvisor\Logo.png
   Supprime! - C:\Program Files\FBrowsingAdvisor\IXPCOMEvents.xpt
   Supprime! - C:\Program Files\FBrowsingAdvisor\unins000.exe
   Supprime! - C:\DOCUME~1\SERGEL~1\APPLIC~1\FunWebProducts\Data
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em201.tmp.exe
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em205.tmp.exe
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em20B.tmp.exe
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em211.tmp.exe
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em215.tmp.exe
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em21B.tmp.exe
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sz14.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sl6.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sn6.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sy1E.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sx63.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sk3E.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
si1C.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sz37.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sx48.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sy91.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sf19.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sv1B9.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sy32.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sfE.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sxD3.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
st181.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sc209.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
si20E.tmp
   Supprime! - C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
sn219.tmp
   Supprime! - C:\Program Files\FBrowserAdvisor
   Supprime! - C:\Program Files\FBrowsingAdvisor
   Supprime! - C:\DOCUME~1\SERGEL~1\APPLIC~1\FunWebProducts

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fsympatico.msn.ca%2fdefaultf.aspx%2f%3f"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 2009-01-03|11:44 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 2009-01-04| 3:20 - Option : [2]

   -----------\  Fin du rapport a  3:20:03,38

darkpoet · Answer

&#x25B6 Relance Lop S&D 

&#x25B6 Choisis cette fois ci l'Option 2 ( Suppression ) 

&#x25B6 Ne ferme pas la fenêtre lors de la suppression ! 

&#x25B6 Poste le rapport généré ( C:\lopR.txt ) 

( Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier, 

Nouvelle tâche, tape explorer.exe et valide )

serdeninc · Answer

voici le résultat.
Clean Navipromo version 3.7.0 commencé le 2009-01-04 à 17:00:46,46

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 Mobile Technology MK-36 )
BIOS : PhoenixBIOS 4.0 Release 6.1     
USER : Serge Laplante ( Administrator )
BOOT : Normal boot

Antivirus : Avira AntiVir PersonalEdition Classic 0.0.0.0 (Activated)
Firewall  : Avira Pare-feu 8.0.1.30 (Not Activated)

C:\ (Local Disk) - FAT32 - Total:53 Go (Free:1 Go)
D:\ (Local Disk) - FAT32 - Total:53 Go (Free:34 Go)
E:\ (CD or DVD)


Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur

 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Serge Laplante\locals~1\applic~1" * 


* Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudÉ~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudÉ~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Serge Laplante\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Serge Laplante\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Serge Laplante\menud+~1\progra~1" *** 



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Serge Laplante\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


* Dans "C:\Documents and Settings\Serge Laplante\locals~1\applic~1" * 


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltdt absent !

*** Recherche autres dossiers et fichiers connus ***



*** Nettoyage terminé le 2009-01-04 à 17:05:42,79 ***

darkpoet · Answer

tu as fait navilog j ai demande lopsd 2 post 7

serdeninc · Answer

Salut darkpoet desolé pour l,erreur J'ai de gros probleme ,j'ai du désinstaler mon antivérus, je n'avaitplus de bureau.
voici le résultat du raport. je ne peut plus prendre mes email sur hotmail pour le moment????


 --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 Mobile Technology MK-36 )
   BIOS : PhoenixBIOS 4.0 Release 6.1     
   USER : Serge Laplante ( Administrator )
   BOOT : Normal boot
   Antivirus : Avira AntiVir PersonalEdition Classic 0.0.0.0 (Activated)
   C:\ (Local Disk) - FAT32 - Total:53 Go (Free:5 Go)
   D:\ (Local Disk) - FAT32 - Total:53 Go (Free:34 Go)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 2009-01-10|11:35 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@advertstream[2].txt
   Supprime! - C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@adultfriendfinder[2].txt
   Supprime! - C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@advertising[1].txt
   Supprime! - C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@ero-advertising[2].txt
   Supprime! - C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@adopt.euroclick[2].txt
   Supprime! - C:\DOCUME~1\SERGEL~1\Cookies\serge_laplante@partypoker[1].txt
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [2005-04-15|14:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [2005-04-15|14:36] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [2008-10-17|22:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [2007-09-13|14:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems
   [2008-12-26|15:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [2007-09-13|08:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [2007-10-23|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [2007-11-17|12:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [2008-12-21|14:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [2006-12-16|09:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [2007-01-13|21:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [2008-08-07|10:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
   [2008-08-07|10:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
   [2008-08-06|11:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [2005-04-15|14:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [2007-03-23|21:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [2007-09-13|08:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [2008-12-26|15:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [2008-12-23|19:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [2008-12-20|13:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SITEguard
   [2007-09-07|22:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [2008-12-27|08:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation
   [2008-12-20|12:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\STOPzilla!
   [2006-08-30|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [2008-10-01|11:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [2008-05-31|20:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TrackMania
   [2007-06-19|17:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [2006-12-19|17:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

   [2005-04-15|14:36] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [2005-04-15|14:36] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [2005-04-15|14:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [2005-04-15|14:36] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

   [2007-09-13|14:37] C:\DOCUME~1\SERGEL~1\APPLIC~1\ACD Systems
   [2007-01-03|11:22] C:\DOCUME~1\SERGEL~1\APPLIC~1\Adobe
   [2007-01-03|11:22] C:\DOCUME~1\SERGEL~1\APPLIC~1\AdobeUM
   [2007-09-13|08:35] C:\DOCUME~1\SERGEL~1\APPLIC~1\Ahead
   [2007-11-17|12:09] C:\DOCUME~1\SERGEL~1\APPLIC~1\Apple Computer
   [2006-12-16|09:51] C:\DOCUME~1\SERGEL~1\APPLIC~1\CyberLink
   [2009-01-02|14:08] C:\DOCUME~1\SERGEL~1\APPLIC~1\Desktopicon
   [2006-12-24|10:27] C:\DOCUME~1\SERGEL~1\APPLIC~1\DWGeditor
   [2007-05-07|18:59] C:\DOCUME~1\SERGEL~1\APPLIC~1\F-Secure
   [2007-01-13|21:29] C:\DOCUME~1\SERGEL~1\APPLIC~1\Google
   [2007-06-19|17:33] C:\DOCUME~1\SERGEL~1\APPLIC~1\Help
   [2005-04-15|14:55] C:\DOCUME~1\SERGEL~1\APPLIC~1\Identities
   [2008-12-27|08:36] C:\DOCUME~1\SERGEL~1\APPLIC~1\InstallShield
   [2008-06-14|18:45] C:\DOCUME~1\SERGEL~1\APPLIC~1\InterTrust
   [2007-05-07|18:55] C:\DOCUME~1\SERGEL~1\APPLIC~1\ispnews
   [2006-12-14|18:00] C:\DOCUME~1\SERGEL~1\APPLIC~1\Macromedia
   [2005-04-15|14:36] C:\DOCUME~1\SERGEL~1\APPLIC~1\Microsoft
   [2007-09-29|17:05] C:\DOCUME~1\SERGEL~1\APPLIC~1\mIRC
   [2006-12-20|18:44] C:\DOCUME~1\SERGEL~1\APPLIC~1\MSNInstaller
   [2008-10-04|20:16] C:\DOCUME~1\SERGEL~1\APPLIC~1\Nero
   [2007-05-07|18:59] C:\DOCUME~1\SERGEL~1\APPLIC~1\PEX
   [2008-02-24|15:27] C:\DOCUME~1\SERGEL~1\APPLIC~1\skypePM
   [2006-12-24|11:01] C:\DOCUME~1\SERGEL~1\APPLIC~1\SolidWorks
   [2008-12-27|08:47] C:\DOCUME~1\SERGEL~1\APPLIC~1\Sony Corporation
   [2007-08-30|17:43] C:\DOCUME~1\SERGEL~1\APPLIC~1\Sun
   [2007-02-18|12:39] C:\DOCUME~1\SERGEL~1\APPLIC~1	eamspeak2
   [2006-12-14|21:34] C:\DOCUME~1\SERGEL~1\APPLIC~1\U3
   [2007-06-19|17:41] C:\DOCUME~1\SERGEL~1\APPLIC~1\Ulead Systems
   [2007-01-05|20:40] C:\DOCUME~1\SERGEL~1\APPLIC~1\uTorrent
   [2008-05-03|17:33] C:\DOCUME~1\SERGEL~1\APPLIC~1\Ventrilo
   [2007-12-31|00:37] C:\DOCUME~1\SERGEL~1\APPLIC~1\WinRAR
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [2009-01-08 18:09][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [2009-01-10 11:13][--ah-----] C:\WINDOWS	asks\SA.DAT
   [2004-08-10 05:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [2008-12-22|18:40] C:\Program Files\1ClickUnZip
   [2007-09-13|14:36] C:\Program Files\ACD Systems
   [2006-08-30|20:40] C:\Program Files\Acer Inc
   [2006-08-30|20:41] C:\Program Files\Adobe
   [2008-06-07|11:04] C:\Program Files\Apple Software Update
   [2008-12-21|14:02] C:\Program Files\Avira
   [2008-10-17|22:23] C:\Program Files\Bonjour
   [2006-08-30|20:35] C:\Program Files\CONEXANT
   [2006-12-14|18:00] C:\Program Files\CyberLink
   [2006-08-30|20:30] C:\Program Files\DIFX
   [2007-12-23|14:58] C:\Program Files\Dofus
   [2007-04-07|09:10] C:\Program Files\Dofus-Arena
   [2007-06-19|17:32] C:\Program Files\DSC_Program
   [2006-12-24|10:26] C:\Program Files\DWGeditor
   [2008-10-01|11:10] C:\Program Files\Eltima Software
   [2005-04-15|14:37] C:\Program Files\Fichiers communs
   [2007-01-12|22:38] C:\Program Files\Google
   [2006-08-30|20:33] C:\Program Files\InstallShield Installation Information
   [2005-04-15|14:44] C:\Program Files\Internet Explorer
   [2008-10-17|22:24] C:\Program Files\iPod
   [2008-10-17|22:24] C:\Program Files\iTunes
   [2006-12-24|12:42] C:\Program Files\Java
   [2006-12-14|18:03] C:\Program Files\Launch Manager
   [2006-12-24|12:41] C:\Program Files\LimeWire
   [2006-12-14|22:55] C:\Program Files\Logitech
   [2005-04-15|14:41] C:\Program Files\Messenger
   [2008-08-05|21:59] C:\Program Files\Messenger Plus! Live
   [2005-04-15|14:47] C:\Program Files\microsoft frontpage
   [2006-12-24|10:26] C:\Program Files\Microsoft Office
   [2007-03-23|22:01] C:\Program Files\Microsoft Visual Studio
   [2007-03-23|22:01] C:\Program Files\Microsoft Works
   [2007-03-23|22:00] C:\Program Files\Microsoft.NET
   [2007-09-29|17:04] C:\Program Files\mIRC
   [2005-04-15|14:41] C:\Program Files\Movie Maker
   [2005-04-15|14:41] C:\Program Files\MSN
   [2005-04-15|14:41] C:\Program Files\MSN Gaming Zone
   [2006-12-26|17:59] C:\Program Files\MSN Messenger
   [2009-01-02|12:30] C:\Program Files\Navilog1
   [2007-09-13|08:32] C:\Program Files\Nero
   [2005-04-15|14:44] C:\Program Files\NetMeeting
   [2006-08-30|20:39] C:\Program Files\NewTech Infosystems
   [2008-12-26|15:06] C:\Program Files\NOS
   [2005-04-15|14:44] C:\Program Files\Outlook Express
   [2007-10-16|18:07] C:\Program Files\PhotoFrame_V1.5
   [2008-10-17|22:22] C:\Program Files\QuickTime
   [2006-08-30|20:34] C:\Program Files\Realtek
   [2007-12-02|20:00] C:\Program Files\Runtime Software
   [2007-02-08|22:03] C:\Program Files\Slayers Online
   [2007-03-07|23:09] C:\Program Files\Softnyx
   [2007-09-13|13:20] C:\Program Files\SolidWorks
   [2007-09-13|13:31] C:\Program Files\SolidWorks Installation Manager
   [2008-12-27|08:41] C:\Program Files\Sonic
   [2008-12-26|15:05] C:\Program Files\Sony
   [2008-12-22|17:49] C:\Program Files\Steam
   [2006-08-30|20:50] C:\Program Files\Symantec
   [2006-08-30|20:35] C:\Program Files\Synaptics
   [2008-12-22|18:28] C:\Program Files\SystemRequirementsLab
   [2007-02-18|12:39] C:\Program Files\Teamspeak2_RC2
   [2008-12-20|11:28] C:\Program Files\Trend Micro
   [2008-09-06|16:35] C:\Program Files\TSO
   [2007-06-19|17:27] C:\Program Files\Ulead Systems
   [2005-04-15|14:55] C:\Program Files\Uninstall Information
   [2007-02-17|16:39] C:\Program Files\Valve
   [2009-01-02|14:08] C:\Program Files\VDOWNLOADER
   [2008-05-03|17:33] C:\Program Files\Ventrilo
   [2008-10-18|16:29] C:\Program Files\VirtualDJ
   [2008-12-13|10:15] C:\Program Files\VisualTool
   [2007-09-13|13:20] C:\Program Files\Windows Desktop Search
   [2008-08-05|21:59] C:\Program Files\Windows Live
   [2006-12-14|22:57] C:\Program Files\Windows Media Components
   [2007-10-26|20:29] C:\Program Files\Windows Media Connect 2
   [2005-04-15|14:42] C:\Program Files\Windows Media Player
   [2005-04-15|14:41] C:\Program Files\Windows NT
   [2005-04-15|14:42] C:\Program Files\Windows Plus
   [2005-04-15|14:45] C:\Program Files\WindowsUpdate
   [2007-12-31|00:37] C:\Program Files\WinRAR
   [2009-01-04|16:43] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [2007-09-13|14:36] C:\Program Files\Fichiers communs\ACD Systems
   [2008-05-09|21:04] C:\Program Files\Fichiers communs\Adobe
   [2007-09-13|08:32] C:\Program Files\Fichiers communs\Ahead
   [2007-11-17|12:07] C:\Program Files\Fichiers communs\Apple
   [2006-12-24|10:44] C:\Program Files\Fichiers communs\Bluebeam Software
   [2006-12-24|10:26] C:\Program Files\Fichiers communs\Designer
   [2006-08-30|20:31] C:\Program Files\Fichiers communs\InstallShield
   [2008-12-20|12:22] C:\Program Files\Fichiers communs\iS3
   [2006-12-24|12:41] C:\Program Files\Fichiers communs\Java
   [2006-08-30|20:40] C:\Program Files\Fichiers communs\LightScribe
   [2008-08-07|10:34] C:\Program Files\Fichiers communs\logishrd
   [2006-12-14|22:57] C:\Program Files\Fichiers communs\Logitech
   [2005-04-15|14:37] C:\Program Files\Fichiers communs\Microsoft Shared
   [2005-04-15|14:44] C:\Program Files\Fichiers communs\MSSoap
   [2006-08-30|20:39] C:\Program Files\Fichiers communs\muvee Technologies
   [2006-08-30|20:39] C:\Program Files\Fichiers communs\NewTech Infosystems
   [2005-04-15|14:37] C:\Program Files\Fichiers communs\ODBC
   [2005-04-15|14:44] C:\Program Files\Fichiers communs\Services
   [2007-09-13|13:20] C:\Program Files\Fichiers communs\Solidworks Data
   [2007-09-13|13:21] C:\Program Files\Fichiers communs\SolidWorks Shared
   [2005-04-15|14:37] C:\Program Files\Fichiers communs\SpeechEngines
   [2007-01-01|22:59] C:\Program Files\Fichiers communs\SWF Studio
   [2006-08-30|20:49] C:\Program Files\Fichiers communs\Symantec Shared
   [2005-04-15|14:44] C:\Program Files\Fichiers communs\System
   [2007-06-19|17:27] C:\Program Files\Fichiers communs\Ulead Systems
   [2008-05-03|17:33] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 55 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-01-10 12:05:38
   Windows 5.1.2600 Service Pack 3 FAT NTAPI
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:91][D:2]-> C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp
   [F:421][D:0]-> C:\DOCUME~1\SERGEL~1\Cookies
   [F:410][D:52]-> C:\DOCUME~1\SERGEL~1\LOCALS~1\TEMPOR~1\content.IE5
   [F:989][D:266]-> C:\Recycled

   1 - "C:\Lop SD\LopR_1.txt" - 2009-01-02|12:44 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 2009-01-10|12:15 - Option : [2]

   --------------------\  Fin du rapport a 12:15:17

darkpoet · Answer

repost un nouvel hijack svp

serdeninc · Answer

Le voici ,merci    j'ai toujour la fenetre antivirus 2009 qui ouvre. Ca gosse!!!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:27:01, on 2009-01-10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\eLock\LockServ.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fsympatico.msn.ca%2fdefaultf.aspx%2f%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {01c543da-fed5-4b54-ac92-ba63c42f2c52} - C:\WINDOWS\system32\gotumuda.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: VisualTool - {F3A54897-9E68-B11E-A37A-4D1422CE9CAA} - C:\Program Files\VisualTool\VisualTool-3.dll (file missing)
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Microsoft] C:\WINDOWS\wuauclt.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [0b790604] rundll32.exe "C:\WINDOWS\system32\gihujasu.dll",b
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [diwodakefa] Rundll32.exe "C:\WINDOWS\system32\lozugava.dll",s
O4 - HKLM\..\Run: [CPM084a3598] Rundll32.exe "c:\windows\system32\bobebeji.dll",a
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [diwodakefa] Rundll32.exe "C:\WINDOWS\system32\lozugava.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs: c:\windows\system32\diwosama.dll C:\WINDOWS\system32\gelilawe.dll c:\windows\system32\bobebeji.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\bobebeji.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\bobebeji.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe

serdeninc · Answer

Cette page ouvre souvent aussi mais il ni a rien qui s'affiche.
http://c5.zero.com/jsc/c5/ff2.html?n=377;c99;s=36;d=16;w=720;h300

serdeninc · Answer

Peut-etre que aussi il y a mirar dans ma liste de program que je ne peut éliminer ,j'ai fait un tas de chose pour l'enlever
quand je le supprime il y a un fentre qui ouvre avec rien ,puis il est toujours la.

darkpoet · Answer

ok ça avance tu passeras smitfraufix et tu poste le rapport,Merci 

Ouvre ce lien (merci a S!RI pour ce programme). http://siri.urz.free.fr/Fix/SmitfraudFix.php 

le mieux serait que tu désaxctives tes protections résidente "anti-virus et anti-spyware" le temps d'installer smitfraudfix et de faire l'analyse. 

et télécharge SmitfraudFix.exe. 

Regarde le tuto 

Exécute le en choisissant l’option 1 
il va générer un rapport 

Copie/colle le sur le poste stp. 

Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus, ect...) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 


une petites démo en vidéo :http://pagesperso-orange.fr/rginformatique/section%20virus/smitfraudfix.htm

serdeninc · Answer

Voici le raport. Merci

SmitFraudFix v2.388

Rapport fait à 11:13:07,37, 2009-01-11
Executé à partir de C:\Documents and Settings\Serge Laplante\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\eLock\LockServ.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Steam\Steam.exe
C:\WINDOWS\explorer.exe
C:\Program Files\QuickTime\QuickTimePlayer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Serge Laplante\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Serge Laplante


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Serge Laplante\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SERGEL~1\FAVORIS


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"="STS"

[HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32
osunilo.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32
osunilo.dll"



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="c:\windows\system32\diwosama.dll C:\WINDOWS\system32\gelilawe.dll c:\windows\system32\nosunilo.dll"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 205.151.67.6
DNS Server Search Order: 205.151.67.2

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B2531025-54CE-420B-8F6A-C0C0E924D39B}: DhcpNameServer=205.151.67.6 205.151.67.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B2531025-54CE-420B-8F6A-C0C0E924D39B}: DhcpNameServer=205.151.67.6 205.151.67.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9520F61C-51A6-4E10-A8A9-6CA04DA521CB}: DhcpNameServer=205.151.67.6 205.151.67.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B2531025-54CE-420B-8F6A-C0C0E924D39B}: DhcpNameServer=205.151.67.6 205.151.67.2
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=205.151.67.6 205.151.67.2


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

darkpoet · Answer

Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter. 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 

http://www.coupdepoucepc.com/modules/news/article.php?storyi­d=253 
http://www.micro-astuce.com/depannage/demarrer-mode-sans-ech­ec 

------------------------------------------------------------­---------------- 
Relance le programme Smitfraud, 
Cette fois choisit l’option 2, répond oui a tous ; 
Sauvegarde le rapport, 
Redémarre en mode normal, 
copie/colle le rapport sauvegardé sur le forum 

process.exe 
est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 
http://www.beyondlogic.org/consulting/processutil/processuti­l.htm 

+ un log Hijackthis en Mode Normal

serdeninc · Answer

Je crois que j'ai fait correct.

SmitFraudFix v2.388

Rapport fait à 11:29:09,93, 2009-01-11
Executé à partir de C:\Documents and Settings\Serge Laplante\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"="STS"

[HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32
osunilo.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32
osunilo.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B2531025-54CE-420B-8F6A-C0C0E924D39B}: DhcpNameServer=205.151.67.6 205.151.67.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B2531025-54CE-420B-8F6A-C0C0E924D39B}: DhcpNameServer=205.151.67.6 205.151.67.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9520F61C-51A6-4E10-A8A9-6CA04DA521CB}: DhcpNameServer=205.151.67.6 205.151.67.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B2531025-54CE-420B-8F6A-C0C0E924D39B}: DhcpNameServer=205.151.67.6 205.151.67.2
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=205.151.67.6 205.151.67.2


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"="STS"

[HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32
osunilo.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32
osunilo.dll"



»»»»»»»»»»»»»»»»»»»»»»»» Fin

Plus

ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:45:50, on 2009-01-11
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32undll32.exe
C:\Acer\Empowering Technology\eLock\LockServ.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\program files\steam\steam.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Acer\Empowering Technology\eLock\Monitor\LockMon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Logitech\ImageStudio\LowLight.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {01c543da-fed5-4b54-ac92-ba63c42f2c52} - C:\WINDOWS\system32\gotumuda.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: VisualTool - {F3A54897-9E68-B11E-A37A-4D1422CE9CAA} - C:\Program Files\VisualTool\VisualTool-3.dll (file missing)
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Microsoft] C:\WINDOWS\wuauclt.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [diwodakefa] Rundll32.exe "C:\WINDOWS\system32\lozugava.dll",s
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [0b790604] rundll32.exe "C:\WINDOWS\system32\likizedo.dll",b
O4 - HKLM\..\Run: [CPM084a3598] Rundll32.exe "c:\windows\system32
osunilo.dll",a
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [diwodakefa] Rundll32.exe "C:\WINDOWS\system32\lozugava.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs: c:\windows\system32\diwosama.dll C:\WINDOWS\system32\gelilawe.dll c:\windows\system32
osunilo.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32
osunilo.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32
osunilo.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe

darkpoet · Answer

bon pas le choix 
attentio ce programme est tres puissant suis a la lettre les consignes etregarde les tuto

Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
et sauvegarde le sur ton bureau et pas ailleurs!
 
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

**Désactive les logiciels de protection** (Antivirus, Antispywares) puis : 
deconnecte toi d'internet,ferme tout les programmes 

Double-clique sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider. 
ne touche plus à rien, même pas ta souris!! 
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport. 

Copie/colle un nouveau rapport HiJackThis avec. 

----------------------------------------------------- 

installer la Console de Récupération sur ton pc(cela permettra de réparer ton système au cas où le pc ne redémarrerait plus suite à la désinfection.) 

Clique sur le lien ci-dessous pour aller sur le site Web de Microsoft: 

https://support.microsoft.com/en-us/help/310994 

descend jusqu'à "Téléchargement du fichier programme des disquettes d'installation" et clique sur le téléchargement correspondant à ta version de Windows XP (Édition familiale ou Professionnel) et au Service Pack que tu as installé. 
**note: pour le SP3 charge le Service Pack 2 
pour Windows XP Media Center charge XP Pro Service Pack 2. 

enregistre le sur ton bureau.

serdeninc · Answer

Salut ca va pas bien ,quand je veut créer la console de récupération  je glisse le fichier window  sur combofix .exe sur le bureau comme demadé ,et la fenetre souvre ,le curceur clignote 20 min. puis c'est écrit (fichier de commande introuvable ) Jessait de resoude ca avant dallé plus loin.

darkpoet · Answer

lance combofix sans la console suis la procedure et ne touche ni ton clavier ni la souris pendant le scan

serdeninc · Answer

Ca veut pas partir , la fenetre bleu souvre le cureur clignote puis rien pendant 1/2 heure ,pas de dialogue comme dans le site d,exemple

serdeninc · Answer

je l,ai suprimer  puis reloader puis meme chose.

darkpoet · Answer

execute en tant qu administrateur (clic droit

serdeninc · Answer

Ta raison .ca marche ComboFix 09-01-10.03 - Serge Laplante 2009-01-11 14:23:48.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1407.926 [GMT -5:00] Lancé depuis: c:\documents and settings\Serge Laplante\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé . [color=purple]Les fichiers ci-dessous ont été désactivés pendant l'exécution:[/color] c:\windows\system32\gelilawe.dll c:\windows\system32\zilozama.dll (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\Serge Laplante\Favoris\Videos.url c:\windows\Downloaded Program Files\Quarantine c:\windows\Downloaded Program Files\setup.inf c:\windows\system32\~.exe c:\windows\system32\404Fix.exe c:\windows\system32\abagutig.ini c:\windows\system32\aberemat.ini c:\windows\system32\abusebip.ini c:\windows\system32\afikihid.ini c:\windows\system32\akojeluy.ini c:\windows\system32\alifediv.ini c:\windows\system32\alotihal.ini c:\windows\system32\amuradug.ini c:\windows\system32\apikobot.ini c:\windows\system32\avatuyod.ini c:\windows\system32\avazupad.ini c:\windows\system32\ayavifew.ini c:\windows\system32\ayikasam.ini c:\windows\system32\bimayivu.dll c:\windows\system32\bobebeji.dll c:\windows\system32\bodenago.dll c:\windows\system32\bupayeta.dll.tmp c:\windows\system32\busuhepi.dll c:\windows\system32\dahehuto.dll c:\windows\system32\dapenado.dll c:\windows\system32\dapuzava.dll c:\windows\system32\datijote.dll c:\windows\system32\dihikifa.dll c:\windows\system32\dumphive.exe c:\windows\system32\ebuhivuk.ini c:\windows\system32\ebupifeh.ini c:\windows\system32\efenurol.ini c:\windows\system32\erojudul.ini c:\windows\system32\eyibujig.ini c:\windows\system32\eyopefop.ini c:\windows\system32\fataleti.dll c:\windows\system32\fisalunu.dll c:\windows\system32\fisojabe.dll c:\windows\system32\fokubino.dll c:\windows\system32\fuzoyalu.dll.tmp c:\windows\system32\gelilawe.dll.vir c:\windows\system32\gihujasu.dll c:\windows\system32\gilinabo.dll c:\windows\system32\gitugaba.dll c:\windows\system32\gizodojo.dll c:\windows\system32\gotumuda.dll c:\windows\system32\gudaruma.dll c:\windows\system32\hadubuja.dll c:\windows\system32\hapirafa.dll c:\windows\system32\hasikevo.dll c:\windows\system32\hefipube.dll c:\windows\system32\heteseze.dll c:\windows\system32\IEDFix.C.exe c:\windows\system32\IEDFix.exe c:\windows\system32\ihesenap.ini c:\windows\system32\inukunez.ini c:\windows\system32\itodinap.ini c:\windows\system32\izijugor.ini c:\windows\system32\jedemeja.dll c:\windows\system32\jedubaji.dll c:\windows\system32\jehovagu.dll c:\windows\system32\jujeyalo.dll c:\windows\system32\jurowuva.dll c:\windows\system32\kazakila.dll c:\windows\system32\kidopulo.dll c:\windows\system32\kuvihube.dll c:\windows\system32\kuyonevi.dll c:\windows\system32\lahitola.dll c:\windows\system32\likizedo.dll c:\windows\system32\loboseta.dll.tmp c:\windows\system32\lolazonu.dll c:\windows\system32\lopivasa.dll c:\windows\system32\lorunefe.dll c:\windows\system32\loyayono.dll c:\windows\system32\lozugava.dll c:\windows\system32\mapadeno.dll.tmp c:\windows\system32\mewokefu.dll c:\windows\system32\miloledo.dll c:\windows\system32\moligefa.dll.tmp c:\windows\system32\motovugu.dll c:\windows\system32 imakeju.dll c:\windows\system32 obafuno.dll c:\windows\system32 onutuga.dll c:\windows\system32 osidale.dll.tmp c:\windows\system32 osunilo.dll c:\windows\system32 uyukape.dll c:\windows\system32\o4Patch.exe c:\windows\system32\obusolez.ini c:\windows\system32\odanepad.ini c:\windows\system32\odezikil.ini c:\windows\system32\oganedob.ini c:\windows\system32\ogomamaf.ini c:\windows\system32\olubagiw.ini c:\windows\system32\onufabon.ini c:\windows\system32\osovunep.ini c:\windows\system32\otuhehad.ini c:\windows\system32\ovekisah.ini c:\windows\system32\ozejuwip.ini c:\windows\system32\panesehi.dll c:\windows\system32\panidoti.dll c:\windows\system32\penuvoso.dll c:\windows\system32\pibesuba.dll c:\windows\system32\pivoniwa.dll.tmp c:\windows\system32\piwujezo.dll c:\windows\system32\pofepoye.dll c:\windows\system32\Process.exe c:\windows\system32 agutapu.dll c:\windows\system32 ehesaba.dll c:\windows\system32 elipasi.dll.tmp c:\windows\system32 ogujizi.dll c:\windows\system32 umilamu.dll c:\windows\system32 uyunuze.dll c:\windows\system32\sekunara.dll c:\windows\system32\siveraja.dll c:\windows\system32\SrchSTS.exe c:\windows\system32 adeyike.dll c:\windows\system32 amereba.dll c:\windows\system32 mp.reg c:\windows\system32 obokipa.dll c:\windows\system32\ubibotev.ini c:\windows\system32\ujekamin.ini c:\windows\system32\ujewijoz.ini c:\windows\system32\ukatoliz.ini c:\windows\system32\unozalol.ini c:\windows\system32\unulasif.ini c:\windows\system32\uparafuy.ini c:\windows\system32\upatugar.ini c:\windows\system32\urukakod.ini c:\windows\system32\usajuhig.ini c:\windows\system32\VACFix.exe c:\windows\system32\vakukina.dll c:\windows\system32\VCCLSID.exe c:\windows\system32\venaluwe.dll c:\windows\system32\vetobibu.dll c:\windows\system32\vokoveya.dll c:\windows\system32\widukemi.dll c:\windows\system32\wifenolu.dll c:\windows\system32\wigabulo.dll c:\windows\system32\wojufowu.dll c:\windows\system32\WS2Fix.exe c:\windows\system32\wuziyana.dll c:\windows\system32\yavinaho.dll c:\windows\system32\yesavodi.dll c:\windows\system32\yovimavo.dll.tmp c:\windows\system32\yufarapu.dll c:\windows\system32\yulejoka.dll c:\windows\system32\zakebipo.dll c:\windows\system32\zayahari.dll c:\windows\system32\zelosubo.dll c:\windows\system32\zenuyohi.dll c:\windows\system32\zewehijo.dll c:\windows\system32\zilozama.dll.vir c:\windows\system32\zirepefi.dll c:\windows\system32\zojiweju.dll c:\windows\system32\zurekasa.dll G:\Autorun.inf ----- BITS: Il y a peut-être des sites infectés ----- hxxp://77.74.48.105 . ((((((((((((((((((((((((((((( Fichiers créés du 2008-12-11 au 2009-01-11 )))))))))))))))))))))))))))))))))))) . 2009-01-11 11:12 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe 2009-01-11 01:16 . 2009-01-11 01:16 d-------- c:\program files\Bonjour 2009-01-11 01:15 . 2009-01-11 01:15 d-------- c:\program files\iTunes 2009-01-11 01:15 . 2009-01-11 01:15 d-------- c:\program files\iPod 2009-01-11 01:15 . 2009-01-11 01:15 d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2009-01-11 01:13 . 2009-01-11 01:13 d-------- c:\program files\QuickTime 2009-01-11 01:09 . 2009-01-11 01:09 d-------- c:\program files\Safari 2009-01-10 18:35 . 2009-01-10 18:35 2,788,800 --a------ c:\program files\FLV PlayerFCSetup.exe 2009-01-10 18:34 . 2009-01-10 18:34 d-------- c:\windows\Applian FLV Player 2009-01-10 18:34 . 2009-01-10 18:34 d-------- c:\program files\FLV Player 2009-01-09 12:17 . 2009-01-09 12:17 2,278 ---hs---- c:\windows\system32\wadowibo.dll 2009-01-09 12:17 . 2009-01-09 12:17 2,278 ---hs---- c:\windows\system32\huwuzewu.dll 2009-01-09 00:19 . 2009-01-09 00:19 2,276 ---hs---- c:\windows\system32\fuyisajo.dll 2009-01-09 00:19 . 2009-01-09 00:19 2,275 ---hs---- c:\windows\system32 upikufo.dll 2009-01-07 19:17 . 2009-01-07 19:17 103,645 --a------ c:\windows\system32\diwosama.VIR 2009-01-06 04:44 . 2009-01-06 04:44 2,276 ---hs---- c:\windows\system32\mojohivo.dll 2009-01-06 04:44 . 2009-01-06 04:44 2,273 ---hs---- c:\windows\system32\guzuyati.dll 2009-01-05 16:44 . 2009-01-05 16:44 2,277 ---hs---- c:\windows\system32\lurujako.dll 2009-01-05 16:44 . 2009-01-05 16:44 2,276 ---hs---- c:\windows\system32\pabirubo.dll 2009-01-03 11:42 . 2009-01-03 11:42 d-------- C:\ToolBar SD 2009-01-02 14:14 . 2009-01-02 14:14 125 --a------ c:\windows\fd3.INI 2009-01-02 14:08 . 2009-01-02 14:08 d-------- c:\program files\VDOWNLOADER 2009-01-02 14:08 . 2009-01-02 14:08 d-------- c:\documents and settings\Serge Laplante\Application Data\Desktopicon 2009-01-02 12:37 . 2009-01-02 12:37 d-------- C:\Lop SD 2009-01-02 12:30 . 2009-01-02 12:30 d-------- c:\program files\Navilog1 2009-01-02 00:28 . 2009-01-02 00:28 2,276 ---hs---- c:\windows\system32\miwiteno.dll 2009-01-02 00:28 . 2009-01-02 00:28 2,274 ---hs---- c:\windows\system32\pudojuli.dll 2009-01-01 15:07 . 2009-01-01 15:07 2,274 ---hs---- c:\windows\system32\sewivevu.dll 2008-12-29 08:32 . 2008-12-29 08:32 2,277 ---hs---- c:\windows\system32\kimejiru.dll 2008-12-29 08:32 . 2008-12-29 08:32 2,275 ---hs---- c:\windows\system32\lehotago.dll 2008-12-28 20:34 . 2008-12-28 20:34 2,277 ---hs---- c:\windows\system32\subesojo.dll 2008-12-28 20:34 . 2008-12-28 20:34 2,275 ---hs---- c:\windows\system32\wavubidi.dll 2008-12-28 08:34 . 2008-12-28 08:34 2,277 ---hs---- c:\windows\system32\dohinuso.dll 2008-12-28 08:34 . 2008-12-28 08:34 2,276 ---hs---- c:\windows\system32\maboreke.dll 2008-12-27 20:34 . 2008-12-27 20:34 2,275 ---hs---- c:\windows\system32\kobohire.dll 2008-12-27 08:47 . 2008-12-27 08:47 d-------- c:\documents and settings\Serge Laplante\Application Data\Sony Corporation 2008-12-27 08:41 . 2008-12-27 08:41 d-------- c:\windows\system32\DLA 2008-12-27 08:41 . 2008-12-27 08:41 d-------- c:\program files\Sonic 2008-12-27 08:41 . 2006-06-13 05:20 94,263 --a------ c:\windows\DLA.EXE 2008-12-27 08:41 . 2006-06-12 03:30 89,264 --a------ c:\windows\system32\drivers\DRVMCDB.SYS 2008-12-27 08:41 . 2006-06-13 05:20 61,500 --a------ c:\windows\system32\DLAAPI_W.DLL 2008-12-27 08:41 . 2006-03-17 05:20 40,544 --a------ c:\windows\system32\drivers\DRVNDDM.SYS 2008-12-27 08:41 . 2006-03-17 08:34 22,684 --a------ c:\windows\system32\drivers\DLARTL_N.SYS 2008-12-27 08:41 . 2006-03-17 08:35 5,660 --a------ c:\windows\system32\drivers\DLACDBHM.SYS 2008-12-27 08:41 . 2008-12-27 08:41 175 --a------ c:\windows\wininit.ini 2008-12-27 08:39 . 2006-11-02 16:57 118,520 --a------ c:\windows\system32\PxInsI64.exe 2008-12-27 08:39 . 2006-10-18 19:43 115,960 --a------ c:\windows\system32\PxCpyI64.exe 2008-12-27 08:39 . 2006-08-28 21:48 2,560 --a------ c:\windows\system32\drivers\cdralw2k.sys 2008-12-27 08:39 . 2006-08-28 21:48 2,432 --a------ c:\windows\system32\drivers\cdr4_xp.sys 2008-12-27 08:37 . 2008-12-27 08:37 d-------- c:\documents and settings\All Users\Application Data\Sony Corporation 2008-12-27 08:36 . 2008-12-27 08:36 d-------- c:\documents and settings\Serge Laplante\Application Data\InstallShield 2008-12-27 07:30 . 2008-12-27 07:30 4,648 ---hs---- c:\windows\system32 ajasone.dll 2008-12-26 19:30 . 2008-12-26 19:30 4,648 ---hs---- c:\windows\system32\zerubeta.dll 2008-12-26 15:06 . 2008-12-26 15:06 d-------- c:\program files\NOS 2008-12-26 15:06 . 2008-12-26 15:06 d-------- c:\documents and settings\All Users\Application Data\NOS 2008-12-26 15:05 . 2008-12-26 15:05 d-------- c:\program files\Sony 2008-12-25 19:30 . 2008-12-25 19:30 4,648 ---hs---- c:\windows\system32\degalego.dll 2008-12-23 19:29 . 2008-12-23 19:29 d-------- c:\documents and settings\All Users\Application Data View_Profiles 2008-12-22 18:50 . 2009-01-11 14:27 51,048 --a------ c:\windows\system32 vapps.xml 2008-12-22 18:49 . 2008-12-22 18:49 d-------- c:\windows view 2008-12-22 18:49 . 2006-07-20 20:58 16,960 --a------ c:\windows\system32 vdisp.nvu 2008-12-22 18:41 . 2008-12-22 18:41 d-------- C:\1ClickUnZIP_unzipfolder 2008-12-22 18:41 . 2008-12-22 18:41 57 --a------ c:\windows op-windows-downloads.url 2008-12-22 18:41 . 2008-12-22 18:41 55 --a------ c:\windows\xm.url 2008-12-22 18:40 . 2008-12-22 18:40 d-------- c:\program files\1ClickUnZip 2008-12-22 18:40 . 2008-12-22 18:40 307,200 --------- c:\windows\Setup1.exe 2008-12-22 18:40 . 2008-12-22 18:40 73,216 --a------ c:\windows\ST6UNST.EXE 2008-12-22 18:29 . 2008-12-22 18:29 2,272 ---hs---- c:\windows\system32\mekiroba.dll 2008-12-22 18:28 . 2008-12-22 18:28 d-------- c:\program files\SystemRequirementsLab 2008-12-22 17:49 . 2008-12-22 17:49 d-------- c:\program files\Steam 2008-12-22 17:41 . 2008-12-22 17:41 3,448,515 --a------ C:\upload_moi_TYREX.tar.gz 2008-12-22 06:28 . 2008-12-22 06:28 0 --a------ c:\windows\system32\amuradug.tmp 2008-12-21 14:02 . 2008-12-21 14:02 d-------- c:\program files\Avira 2008-12-21 14:02 . 2008-12-21 14:02 d-------- c:\documents and settings\All Users\Application Data\Avira 2008-12-20 13:37 . 2008-12-20 13:37 d-------- c:\documents and settings\All Users\Application Data\SITEguard 2008-12-20 12:22 . 2008-12-20 12:22 d-------- c:\program files\Fichiers communs\iS3 2008-12-20 12:22 . 2008-12-20 12:22 d-------- c:\documents and settings\All Users\Application Data\STOPzilla! 2008-12-20 11:28 . 2008-12-20 11:28 d-------- c:\program files\Trend Micro 2008-12-13 10:15 . 2008-12-13 10:15 d-------- c:\program files\VisualTool 2008-12-13 10:15 . 2006-04-14 23:05 9,952 --a------ C: egxpcom.exe 2008-12-12 11:18 . 2008-12-12 11:18 87,336 --a------ c:\windows\system32\dns-sd.exe 2008-12-12 11:11 . 2008-12-12 11:11 61,440 --a------ c:\windows\system32\dnssd.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-13 06:37 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll 2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys 2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll 2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 19:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll 2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 19:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll 2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 19:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll 2008-10-16 19:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll 2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 19:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 19:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll 2008-10-16 13:12 70,656 ----a-w c:\windows\system32\dllcache\ie4uinit.exe 2008-10-16 13:11 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe 2008-10-15 17:35 337,408 ------w c:\windows\system32\dllcache etapi32.dll 2008-10-15 07:06 633,632 ----a-w c:\windows\system32\dllcache\iexplore.exe 2008-10-15 07:04 161,792 ----a-w c:\windows\system32\dllcache\ieakui.dll 2008-02-24 20:27 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat 2008-09-21 05:42 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008092120080922\index.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2006-12-14 16384] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "NCLaunch"="c:\windows\NCLAUNCH.EXe" [2007-01-01 40960] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136] "msnmsgr"="c:\program files\MSN Messenger\MSNMSGR.EXE" [2007-01-19 5674352] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-22 68856] "Steam"="c:\program files\steam\steam.exe" [2008-12-22 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 53248] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521] "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7 tiMUI.exe" [2006-05-15 45056] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168] "ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-07-18 438272] "Boot"="c:\acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 579584] "Acer ePresentation HPD"="c:\acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-06-07 208896] "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-08-09 342016] "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696] "LVCOMS"="c:\program files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022] "LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648] "Ulead AutoDetector"="c:\program files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe" [2003-03-24 45056] "LogitechCommunicationsManager"="c:\program files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-20 86016] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 2027792] "LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440] "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-08-08 634880] "eLockMonitor"="c:\acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe" [2006-03-31 16384] "RTHDCPL"="RTHDCPL.EXE" [2006-07-21 c:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-12-14 45056] Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-12-14 169472] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= c:\progra~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm "VIDC.ACDV"= ACDV.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau Notification Packages REG_MULTI_SZ scecli c:\windows\system32\gelilawe.dll [HKLM\~\startupfolder\C:^Documents and Settings^Serge Laplante^Menu Démarrer^Programmes^Démarrage^Outil de détection de support Picture Motion Browser.lnk] path=c:\documents and settings\Serge Laplante\Menu Démarrer\Programmes\Démarrage\Outil de détection de support Picture Motion Browser.lnk backup=c:\windows\pss\Outil de détection de support Picture Motion Browser.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\LimeWire\LimeWire.exe"= "c:\Program Files\MSN Messenger\msncall.exe"= "c:\Program Files\Valve\Steam\SteamApps\bandidos911\counter-strike source\hl2.exe"= "c:\Program Files\MSN Messenger\MSNMSGR.EXE"= "c:\Program Files\MSN Messenger\livecall.exe"= "c:\Program Files\Steam\SteamApps\bandidos911\counter-strike source\hl2.exe"= "c:\Program Files\Steam\Steam.exe"= "c:\Program Files\mIRC\mirc.exe"= "c:\WINDOWS\System32\java.exe"= "c:\WINDOWS\System32\fxssvc.exe"= "c:\WINDOWS\System32\wscntfy.exe"= "c:\WINDOWS\System32\Restore\rstrui.exe"= "c:\Program Files\Messenger\msmsgs.exe"= "c:\Program Files\iTunes\iTunes.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= R4 eLock2BurnerLockDriver;eLock2BurnerLockDriver;c:\windows\system32\eLock2BurnerLockDriver.sys [2006-12-14 17664] R4 eLock2FSCTLDriver;eLock2FSCTLDriver;c:\windows\system32\eLock2FSCTLDriver.sys [2006-12-14 90112] R4 LockServ;LockServ;c:\acer\Empowering Technology\eLock\LockServ.exe -p --> c:\acer\Empowering Technology\eLock\LockServ.exe -p [?] S3 PhotoFrame;PhotoFrame_2.0 Device;c:\windows\system32\drivers\PhotoFrame.sys [2007-10-16 30208] S3 XDva110;XDva110;\??\c:\windows\system32\XDva110.sys --> c:\windows\system32\XDva110.sys [?] S4 LMIRfsClientNP;LMIRfsClientNP; [x] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc7e26b0-8be4-11db-b54b-0016cf9d250d}] \Shell\AutoRun\command - F:\LaunchU3.exe -a . Contenu du dossier 'Tâches planifiées' 2009-01-08 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . - - - - ORPHELINS SUPPRIMES - - - - BHO-{01c543da-fed5-4b54-ac92-ba63c42f2c52} - c:\windows\system32\gotumuda.dll Toolbar-SITEguard - (no file) WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file) WebBrowser-{D38F90F2-CCF7-440B-BEE8-94C20B001279} - c:\windows\system32\winpf77.dll HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe HKCU-Run-WebCamRT.exe - (no file) HKLM-Run-CPM084a3598 - c:\windows\system32\zilozama.dll . ------- Examen supplémentaire ------- . mWindow Title = uInternet Settings,ProxyOverride = localhost;*.local IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-11 14:28:45 Windows 5.1.2600 Service Pack 3 FAT NTAPI Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . c:\program files\FICHIERS COMMUNS\LOGISHRD\LVMVFM\LVPRCSRV.EXE c:\windows\SYSTEM32\RUNDLL32.EXE c:\acer\EMPOWERING TECHNOLOGY\EPERFORMANCE\MEMCHECK.EXE c:\program files\FICHIERS COMMUNS\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE c:\program files\BONJOUR\MDNSRESPONDER.EXE c:\program files\FICHIERS COMMUNS\LIGHTSCRIBE\LSSRVC.EXE c:\acer\Empowering Technology\eLock\Monitor\LockMon.exe c:\acer\EMPOWERING TECHNOLOGY\ELOCK\LOCKSERV.EXE c:\program files\Logitech\ImageStudio\LowLight.exe c:\program files\FICHIERS COMMUNS\LOGISHRD\LVCOMSER\LVCOMSER.EXE c:\windows\SYSTEM32\NVSVC32.EXE c:\program files\FICHIERS COMMUNS\LOGISHRD\LVCOMSER\LVCOMSER.EXE c:\windows\EHOME\MCRDSVC.EXE c:\program files\iPod\bin\iPodService.exe c:\windows\system32\wbem\wmiapsrv.exe c:\windows\system32\wbem\unsecapp.exe c:\program files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe c:\docume~1\SERGEL~1\LOCALS~1\Temp\RtkBtMnt.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Heure de fin: 2009-01-11 14:31:33 - La machine a redémarré ComboFix-quarantined-files.txt 2009-01-11 19:31:32 Avant-CF: 5 307 695 104 octets libres Après-CF: 5,252,382,720 octets libres WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect 441 --- E O F --- 2008-12-18 23:12:59

serdeninc · Answer

Hijack this


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:39:29, on 2009-01-11
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Acer\Empowering Technology\eLock\Monitor\LockMon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Acer\Empowering Technology\eLock\LockServ.exe
C:\Program Files\Logitech\ImageStudio\LowLight.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe

serdeninc · Answer

ca semble marcher je n'ai pas encore eu de fenetre intempetive!!!!

serdeninc · Answer

Dans ajout /supression de progam MIRAR est encore la ca a commencer avec ca.si c'est pas grave on le laisse la???

darkpoet · Answer

Bonjour, 

télécharge GenProc http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip sur ton bureau 

dézippe le dossier, double-clique sur GenProc.bat [img]http://forum.telecharger.01net.com/forum/­lies/jeanchretien1-3.gif/img et poste le contenu du rapport qui s'ouvre 

Aide en images : http://www.alt-shift-return.org/Info/GenProc-HowTo.html

serdeninc · Answer

Rapport GenProc 2.323 [1] - 2009-01-11 - Windows XP 
 
# Etape 1/ Télécharge :
 
- CCleaner https://www.ccleaner.com/ccleaner/download (FileHippo)
Ce logiciel va permettre de supprimer tous les fichiers temporaires.
Lance-le et clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures".
Par la suite, laisse-le avec ses réglages par défaut. Ferme le programme.

- Toolbar-S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 (Team IDN) sur ton Bureau.

- MSNFix http://sosvirus.changelog.fr/MSNFix.zip (!aur3n7) et décompresse-le sur le Bureau.


 Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ ; pour retrouver le rapport, clique sur le raccourci "GenProc" sur ton bureau. Choisis ta session courante *** Serge Laplante ***  

 
# Etape 2/ 
 
 Lance Toolbar-S&D situé sur le Bureau.
 Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 3/ 
 
Lance le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le bureau.
- Exécute l'option R.
- Si l'infection est détectée, exécute l'option N.
- Sauvegarde ce rapport sur ton bureau.


# Etape 4/ 
 
 Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.
 
# Etape 5/ 
 
 Redémarre normalement et poste, dans la même réponse : 
 
- Le contenu du rapport MSNfix situé sur le Bureau ; 
- Le contenu du rapport C:\TB.txt ; 
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ; 

 Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.
 
____________________________________________________________________________________________________________
 
Sites officiels GenProc : www.alt-shift-return.org et www.genpr

darkpoet · Answer

suis les procedure genproc post les rapport je reprend demain on est presque au bout

serdeninc · Answer

Merci a demain!!

serdeninc · Answer

ead file error: C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\winlogon.exe, Le fichier spécifié est introuvable.
read file error: C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\services.exe, Le fichier spécifié est introuvable.
read file error: C:\WINDOWS\system32\cftmon.exe, Le fichier spécifié est introuvable.
read file error: C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\winlogon.exe, Le fichier spécifié est introuvable.
read file error: C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\services.exe, Le fichier spécifié est introuvable.
read file error: C:\WINDOWS\system32\cftmon.exe, Le fichier spécifié est introuvable.

 -----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 Mobile Technology MK-36 )
   BIOS : PhoenixBIOS 4.0 Release 6.1     
   USER : Serge Laplante ( Administrator )
   BOOT : Fail-safe boot
   Antivirus : Avira AntiVir PersonalEdition Classic 0.0.0.0 (Activated)
   C:\ (Local Disk) - FAT32 - Total:53 Go (Free:6 Go)
   D:\ (Local Disk) - FAT32 - Total:53 Go (Free:34 Go)
   E:\ (CD or DVD)
   G:\ (Local Disk) - FAT32 - Total:298 Go (Free:250 Go)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 2009-01-11|16:18 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\windows\system32\blank.htm"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Local Page"="C:\windows\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 2009-01-03|11:44 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 2009-01-04| 3:20 - Option : [2]
   3 - "C:\ToolBar SD\TB_3.txt" - 2009-01-10|10:58 - Option : [1]
   4 - "C:\ToolBar SD\TB_4.txt" - 2009-01-11|16:18 - Option : [2]

   -----------\  Fin du rapport a 16:18:50,34

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:34:49, on 2009-01-11
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\MSN Messenger\MSNMSGR.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Acer\Empowering Technology\eLock\Monitor\LockMon.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\eLock\LockServ.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Logitech\ImageStudio\LowLight.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe

darkpoet · Answer

Télécharge Malwarebytes' Anti-Malware: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/­ 

. sur la page cliques sur Télécharger Malwarebyte's Anti-Malware 
. enregistres le sur le bureau 
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation. 
. Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour 
. si le pare-feu demande l'autorisation de se connecter pour malwarebytes, acceptes 
. Une fois la mise à jour terminée,fermes Malwarebytes 
. redemarres en mode sans échec pour savoir comment au cas ou tu ne saurrais pas regarde plus bas 
. une fois en mode sans echec tu double-cliques sur l'icône de malwarebytes 
. une fois ouvert rend-toi dans l'onglet, Recherche 
. Sélectionnes Exécuter un examen complet 
. Cliques sur Rechercher 
. Le scan démarre. 
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés. 
. Cliques sur Ok pour poursuivre. 
. Si des malwares ont été détectés, cliques sur Afficher les résultats 
. Sélectionnes tout (ou laisses cochés) 

. cliques sur Supprimer la sélection 

. Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine. 
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse. 
. redemarre le pc 
. une fois redémarré en mode normal double-cliques sur malwarebytes 
. rends toi dans l'onglet rapport/log 
. tu cliques dessus pour l'afficher une fois affiché 
. tu cliques sur edition en haut du boc notes,et puis sur sélectionner tous 
. tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse 
. tu cliques droit dans le cadre de la reponse et coller 


Si tu as besoin d'aide regarde ces tutoriels : 
https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm 
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/ 


(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreurs ...)

serdeninc · Answer

voila le raport cool l'ordi va vite.

Malwarebytes' Anti-Malware 1.32
Version de la base de données: 1647
Windows 5.1.2600 Service Pack 3

2009-01-12 19:42:36
mbam-log-2009-01-12 (19-42-36).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 160335
Temps écoulé: 31 minute(s), 35 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 136

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:egxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\saliyono.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gayusomi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mulirowo.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Trend Micro\HijackThis\backups\backup-20081220-115706-759.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Trend Micro\HijackThis\backups\backup-20081220-120130-307.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Trend Micro\HijackThis\backups\backup-20081220-120522-594.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP652\A0250748.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP661\A0251737.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP662\A0252902.DLL (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP662\A0252903.DLL (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP662\A0252904.DLL (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP671\A0253145.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP671\A0253147.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP672\A0253263.DLL (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP680\A0259495.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP680\A0259496.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP680\A0259497.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP684\A0259630.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP684\A0259634.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264032.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264048.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264049.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264050.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264051.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264052.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264054.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264062.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264063.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264066.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264067.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264070.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264071.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264072.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264073.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264074.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264075.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264081.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264082.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264084.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264087.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264089.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264091.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264092.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264093.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264094.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264099.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264100.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264101.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264115.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264116.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264117.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264118.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264119.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264120.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264121.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264123.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264124.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264125.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264126.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264128.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264129.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264130.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264142.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264144.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264145.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264146.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264147.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264149.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264151.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264152.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264153.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264155.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264156.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264157.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264160.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP688\A0264161.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\ToolBar SD\Backup-TB\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em205.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\ToolBar SD\Backup-TB\DOCUME~1\SERGEL~1\LOCALS~1\Temp	em215.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\~.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\bodenago.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\busuhepi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dahehuto.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dapenado.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dapuzava.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dihikifa.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\fisalunu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\fisojabe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\gilinabo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\gitugaba.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\gudaruma.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\hadubuja.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\hapirafa.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\hasikevo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\hefipube.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\heteseze.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\jedubaji.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\jehovagu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\jurowuva.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kuvihube.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\lahitola.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\lolazonu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\lopivasa.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\lorunefe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\loyayono.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32
imakeju.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32
obafuno.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32
onutuga.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\panesehi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\panidoti.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\penuvoso.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\pibesuba.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\piwujezo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\pofepoye.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32agutapu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32ogujizi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32umilamu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32uyunuze.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\sekunara.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32	adeyike.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32	amereba.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32	obokipa.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\venaluwe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\vokoveya.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\widukemi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wifenolu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wigabulo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wuziyana.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\yesavodi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\yufarapu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\yulejoka.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\zayahari.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\zelosubo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\zenuyohi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\zojiweju.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\zurekasa.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.

darkpoet · Answer

ok vide la quarantaine de malwarebytes 
un vundo est dans la restoration systeme fait cette manip svp
il faut desactiver la restauration systeme le temps du redemarrage dans DEMARRER puis TOUS LES PROG 
puis ACCESOIRE puis OUTILS SYSTEME puis DANS RESTAURATION SYSTEME aller dans parametre et desactiver la restauration 
tu redemare l ordi et tu remet la restoration meme manip activer la restoration

telecharge superantispyware

http://www.commentcamarche.net/telecharger/telecharger 34055294 superantispyware

fait un scan complet

serdeninc · Answer

Merci beaucoup, tout est revnu comme avant . C.est incroyable la patience et le savoir que tu partage, merci encore .

darkpoet · Answer

pour desinstalller tout les fix utilisés fait ceci ci tu veux bien envoie un dernier hijackthis avant cette manip a ton service 
Télécharge ToolsCleaner sur ton bureau. 
--> 
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur "Recherche" et laisse le scan agir ... 
# Clique sur "Suppression" pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

serdeninc · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:07:34, on 2009-01-18
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\eLock\LockServ.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Acer\Empowering Technology\eLock\Monitor\LockMon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Google\Google Earth\googleearth.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fsympatico.msn.ca%2fdefaultf.aspx%3flang%3dfr-ca%26OCID%3dFW54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe

serdeninc · Answer

Le rapport est ici.

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\rapport_clean.txt: trouvé !
C:\lopR.txt: trouvé !
C:\TB.txt: trouvé !
C:\*.msnfix: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\WINDOWS\msnfix.txt: trouvé !
C:\WINDOWS\system32\*.msnfix: trouvé !
C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\Serge Laplante\Mes documents\BUREAU\Clean.zip: trouvé !
C:\Documents and Settings\Serge Laplante\Mes documents\BUREAU\Navilog1.exe: trouvé !
C:\Documents and Settings\Serge Laplante\Mes documents\BUREAU\Navilog1.lnk: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\LopSD.exe: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\Msnfix.zip: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\GenProc.zip: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\ToolBarSD.exe: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\MsnFix: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\SmitFraudfix: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\GenProc: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\GenProc\Page\GenProc[*].html: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\GenProc\outil\GenProc[*].html: trouvé !
C:\Documents and Settings\Serge Laplante\Recent\MSNFix.lnk: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\1ClickUnZIP_unzipfolder\GenProc: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\Serge Laplante\Mes documents\BUREAU\Clean.zip: supprimé !
C:\Documents and Settings\Serge Laplante\Mes documents\BUREAU\Navilog1.exe: supprimé !
C:\Documents and Settings\Serge Laplante\Mes documents\BUREAU\Navilog1.lnk: supprimé !
C:\Documents and Settings\Serge Laplante\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Serge Laplante\Bureau\LopSD.exe: supprimé !
C:\Documents and Settings\Serge Laplante\Bureau\Msnfix.zip: supprimé !
C:\Documents and Settings\Serge Laplante\Bureau\GenProc.zip: supprimé !
C:\Documents and Settings\Serge Laplante\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Serge Laplante\Bureau\SmitFraudFix.exe: supprimé !
C:\Documents and Settings\Serge Laplante\Bureau\ToolBarSD.exe: supprimé !
C:\Documents and Settings\Serge Laplante\Recent\MSNFix.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: ERREUR DE SUPPRESSION !!
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Combofix.txt: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\rapport_clean.txt: supprimé !
C:\lopR.txt: supprimé !
C:\TB.txt: supprimé !
C:\*.msnfix: ERREUR DE SUPPRESSION !!
C:\WINDOWS\msnfix.txt: supprimé !
C:\WINDOWS\system32\*.msnfix: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Serge Laplante\Bureau\GenProc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Serge Laplante\Bureau\GenProc\outil\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Documents and Settings\Serge Laplante\Bureau\MsnFix: supprimé !
C:\Documents and Settings\Serge Laplante\Bureau\SmitFraudfix: supprimé !
C:\Documents and Settings\Serge Laplante\Bureau\GenProc: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: ERREUR DE SUPPRESSION !!
C:\1ClickUnZIP_unzipfolder\GenProc: supprimé !

Point de restauration crée !
Corbeille vidée!
Fichiers temporaires nettoyés !

darkpoet · Answer

il reste ujne ligne a fixer 
relance hijackthis
clic do a scan only
selectionne cette ligne
R3 - Default URLSearchHook is missing 
clic sur fix checked 


refait un hijackthis normal pour verif

darkpoet · Answer

panneau de config>options internet >programmes et clic sur retablir les parametres web

serdeninc · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:15:46, on 2009-01-18
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\eLock\LockServ.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\MSN Messenger\MSNMSGR.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Acer\Empowering Technology\eLock\Monitor\LockMon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fsympatico.msn.ca%2fdefaultf.aspx%3flang%3dfr-ca%26OCID%3dFW54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe

darkpoet · Answer

- Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau. 
http://images.malwareremoval.com/random/RSIT.exe 

- Double-clique sur RSIT.exe afin de lancer le programme. 

- Clique sur Continue à l'écran Disclaimer. 

- Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. 

- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches). 

Note : Les rapports sont sauvegardés dans le dossier C:\rsit.

serdeninc · Answer

Logfile of random's system information tool 1.05 (written by random/random)
Run by Serge Laplante at 2009-01-19 18:13:33
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 9 GB (17%) free of 54 GB
Total RAM: 1407 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:13:34, on 2009-01-19
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\eLock\LockServ.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\MSN Messenger\MSNMSGR.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Acer\Empowering Technology\eLock\Monitor\LockMon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Serge Laplante\Local Settings\Temporary Internet Files\Content.IE5\N78Z4VHU\RSIT[1].exe
C:\Program Files\Trend Micro\HijackThis\Serge Laplante.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe

darkpoet · Answer

MSNFix http://sosvirus.changelog.fr/MSNFix.zip (!aur3n7) et décompresse-le sur le Bureau. 



decompresse le fichier dans c:

Lance le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le bureau. 
- Exécute l'option R. 
- Si l'infection est détectée, exécute l'option N. 
- Sauvegarde ce rapport sur ton bureau. 
post le rapport ici

serdeninc · Answer

Salut ,pas d'infection et je ne trouve pas de rapport.

darkpoet · Answer

bon c ok pour moi passe toolcleaner pour virer les fix utilisés et clic sur resolue si c bon pour toi
Télécharge ToolsCleaner sur ton bureau. 
--> 
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur "Recherche" et laisse le scan agir ... 
# Clique sur "Suppression" pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 

ensuite 

Télécharges : - CCleaner (n'installe pas la barre d'outil Yahoo) 
https://www.pcastuces.com/logitheque/ccleaner.htm 
Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corrigé ton registre .Lors de l'installation, avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 première. 
Une fois le prg instalé et lancé, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures"( Par la suite, laisse-le avec ses réglages par défaut. C'est tout ). 

Un tuto ( aide ): 
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm 

---> Utilisation: 
! déconnectes toi et fermes toutes applications en cours ! 
* vas dans "nettoyeur" : fait analyse puis nettoyage 
* vas dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) . 

( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )

serdeninc · Answer

voici le rapport ,ca tour au max ,merveilleux Merci Beaucoup . Ccleaner fait un bon boulot.

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\*.msnfix: trouvé !
C:\Rsit: trouvé !
C:\WINDOWS\msnfix.txt: trouvé !
C:\WINDOWS\system32\*.msnfix: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Serge Laplante\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Serge Laplante\Recent\MSNFix.lnk: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\1ClickUnZIP_unzipfolder\MsnFix: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Serge Laplante\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Serge Laplante\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Serge Laplante\Recent\MSNFix.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\*.msnfix: ERREUR DE SUPPRESSION !!
C:\WINDOWS\msnfix.txt: supprimé !
C:\WINDOWS\system32\*.msnfix: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
C:\1ClickUnZIP_unzipfolder\MsnFix: supprimé !

Fichiers temporaires nettoyés !
Corbeille vidée!
Sauvegarde du registre crée !
Point de restauration crée !

serdeninc · Answer

J'aimerai juste svoir si c'est grave que MIRAR est encore dans ma liste de program et je ne suis pas capable de le sup.
Quand j'essai une fenetre ouvre et ca change rien. merci

darkpoet · Answer

regarde ici
http://forum.telecharger.01net.com/forum/high-tech/SECURITE/Securite/mirar-debarasser-sujet_23533_1.htm

serdeninc · Answer

Ca ne marche pas ,aucune recherche ne trouve Mirar et meme suprimer en mode sans echec il est toujours la.

darkpoet · Answer

on va essayer un truc fait ceci pour reperer 
- Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau. 
http://images.malwareremoval.com/random/RSIT.exe 

- Double-clique sur RSIT.exe afin de lancer le programme. 

- Clique sur Continue à l'écran Disclaimer. 

- Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. 

- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches). 

Note : Les rapports sont sauvegardés dans le dossier C:\rsit.

serdeninc · Answer

Logfile of random's system information tool 1.05 (written by random/random)
Run by Serge Laplante at 2009-02-03 19:05:51
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 8 GB (14%) free of 54 GB
Total RAM: 1407 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:05:59, on 2009-02-03
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\eLock\LockServ.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\MSN Messenger\MSNMSGR.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Acer\Empowering Technology\eLock\Monitor\LockMon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Serge Laplante\Local Settings\Temporary Internet Files\Content.IE5\504SIQ6T\RSIT[1].exe
C:\Program Files	rend micro\Serge Laplante.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fsympatico.msn.ca%2fdefaultf.aspx%3flang%3dfr-ca%26OCID%3dFW54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Fichiers communs\SolidWorks Shared\Service\SolidWorksLicensing.exe

darkpoet · Answer

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort. 

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau. 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes 
explorer.exe 




:files 
C:\WINDOWS\system32\wadowibo.dll
C:\WINDOWS\system32\huwuzewu.dll 
C:\WINDOWS\system32
upikufo.dll 
C:\WINDOWS\system32\fuyisajo.dll 
C:\WINDOWS\system32\mojohivo.dll 
C:\WINDOWS\system32\guzuyati.dll 
C:\WINDOWS\system32\pabirubo.dll 
C:\WINDOWS\system32\lurujako.dll 


:reg 


:commands 
[purity] 
[emptytemp] 
[reboot] 





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log






ensuite 

- Fais un scan en ligne ici https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr (Avec Internet Explorer). 

- En bas à droite, clique sur Démarrer Online-scanner. 

- Dans la nouvelle fenêtre qui s'affiche, clique sur J'accepte. 

- Accepte les Contrôles ActiveX. 

- Choisis Poste de travail pour le scan. 

- Celui-ci terminé, sauvegarde (Choisis fichier texte) et poste le rapport. 

- Pour t'aider à utiliser le scan en ligne : Lien 

Note : Si tu reçois le message La licence de Kaspersky On-line Scanner est périmée, va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte-toi sur le site de Kaspersky pour retenter le scan en ligne.

serdeninc · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
LoadLibrary failed for C:\WINDOWS\system32\wadowibo.dll
C:\WINDOWS\system32\wadowibo.dll NOT unregistered.
C:\WINDOWS\system32\wadowibo.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\huwuzewu.dll
C:\WINDOWS\system32\huwuzewu.dll NOT unregistered.
C:\WINDOWS\system32\huwuzewu.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32
upikufo.dll
C:\WINDOWS\system32
upikufo.dll NOT unregistered.
C:\WINDOWS\system32
upikufo.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\fuyisajo.dll
C:\WINDOWS\system32\fuyisajo.dll NOT unregistered.
C:\WINDOWS\system32\fuyisajo.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\mojohivo.dll
C:\WINDOWS\system32\mojohivo.dll NOT unregistered.
C:\WINDOWS\system32\mojohivo.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\guzuyati.dll
C:\WINDOWS\system32\guzuyati.dll NOT unregistered.
C:\WINDOWS\system32\guzuyati.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\pabirubo.dll
C:\WINDOWS\system32\pabirubo.dll NOT unregistered.
C:\WINDOWS\system32\pabirubo.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\lurujako.dll
C:\WINDOWS\system32\lurujako.dll NOT unregistered.
C:\WINDOWS\system32\lurujako.dll moved successfully.
========== REGISTRY ==========
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\Perflib_Perfdata_588.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\Perflib_Perfdata_4b4.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\~DF2580.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\~DFF226.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\~DFA49E.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_390.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02082009_121708

Files moved on Reboot...
File C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\Perflib_Perfdata_588.dat not found!
File C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\Perflib_Perfdata_4b4.dat not found!
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\~DF2580.tmp moved successfully.
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\~DFF226.tmp moved successfully.
C:\DOCUME~1\SERGEL~1\LOCALS~1\Temp\~DFA49E.tmp moved successfully.
C:\WINDOWS	emp\Perflib_Perfdata_390.dat moved successfully.

serdeninc · Answer

Impossible de faire fonctionner kasperski, ca se déconnecte et dit erreur sur la page.

darkpoet · Answer

reinstal le

serdeninc · Answer

C:\WINDOWS\system32\config\system.LOG  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\software.LOG  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\default.LOG  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\SAM.LOG  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\SECURITY.LOG  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\Media Ce.evt  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\SysEvent.Evt  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\AppEvent.Evt  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\SecEvent.Evt  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\Internet.evt  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\OSession.evt  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\ODiag.evt  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\SECURITY  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\SOFTWARE  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\SYSTEM  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\DEFAULT  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\config\SAM  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\CatRoot2	mp.edb  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\CatRoot2\edb.log  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\system32\gesokabo.dll.tmp  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\WINDOWS\system32\yopamuna.dll.tmp  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\WINDOWS\system32\wojenahu.dll.tmp  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\WINDOWS\system32\fusoweli.dll.tmp  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\WINDOWS\system32\yofenada.dll.tmp  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\WINDOWS\system32\detigere.dll.tmp  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\WINDOWS\system32\fikesilo.dll.tmp  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\WINDOWS\system32
esoyalo.dll.tmp  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\WINDOWS\system32
apohari.dll.tmp  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\WINDOWS\system32\diwosama.VIR  Infecté : Trojan.Win32.Pakes.mxn  ignoré  
 
C:\WINDOWS\system32\h323log.txt  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\Temp\Perflib_Perfdata_28c.dat  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\Debug\PASSWD.LOG  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\SoftwareDistribution\DataStore\Logs	mp.edb  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\wiaservc.log  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\wiadebug.log  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\WindowsUpdate.log  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\SchedLgU.Txt  L'objet est verrouillé  ignoré  
 
C:\WINDOWS\Sti_Trace.log  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\NetworkService
tuser.dat.LOG  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\NetworkService\NTUSER.DAT  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\LocalService
tuser.dat.LOG  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\LocalService\NTUSER.DAT  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante
tuser.dat.LOG  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Temp\Perflib_Perfdata_5cc.dat  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Temp\Perflib_Perfdata_9b4.dat  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Temp\~DF8761.tmp  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Temp\~DF4C86.tmp  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Historique\History.IE5\index.dat  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Temporary Internet Files\Content.IE5\index.dat  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Application Data\ApplicationHistory\ePower_DMC.exe.3ca0acde.ini.inuse  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Application Data\ApplicationHistory\Acer.Empowering.Framework.Launcher.exe.7c55249b.ini.inuse  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Application Data\ApplicationHistory\LockMon.exe.7987f3da.ini.inuse  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Application Data\ApplicationHistory\ePresentation.exe.e70224e9.ini.inuse  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\Mes documents\Ma musique\johnny was here - greatest hits.mp3  Infecté : Trojan-Downloader.WMA.GetCodec.n  ignoré  
 
C:\Documents and Settings\Serge Laplante\Mes documents\Incomplete\T-3545425-johnny was here.mp3  Infecté : Trojan-Downloader.WMA.GetCodec.r  ignoré  
 
C:\Documents and Settings\Serge Laplante\Cookies\index.dat  L'objet est verrouillé  ignoré  
 
C:\Documents and Settings\Serge Laplante\NTUSER.DAT  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\inuse.txt  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\D0000000.FCS  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\main.log  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\storydb.idx  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\chandir.idx  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\L0000002.FCS  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\chn.dat  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\chn.idx  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\prs_die.dat  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\prs_die.idx  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\prs_dnd.dat  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\prs_dnd.idx  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\prs_ext.dat  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\prs_ext.idx  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\prs_rcv.dat  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\prs_rcv.idx  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\prs.dat  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\prs.idx  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\storydb.dat  L'objet est verrouillé  ignoré  
 
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Serge Laplante\Data\chandir.dat  L'objet est verrouillé  ignoré  
 
C:\system volume information\_restore{7D0A09CF-FCEC-40B1-949D-E158943906CC}\RP28\change.log  L'objet est verrouillé  ignoré  
 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/~.exe  Infecté : Trojan-GameThief.Win32.OnLineGames.ukcv  ignoré  
 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/videfila.dll  Infecté : Backdoor.Win32.Agent.aalh  ignoré  
 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/zobumawe.dll  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/wofokode.dll  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/panesehi.dll  Infecté : Trojan.Win32.Monder.ajhs  ignoré  
 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/mazenahi.dll  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/venaluwe.dll  Infecté : Net-Worm.Win32.Kido.gq  ignoré  
 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/yufarapu.dll  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar  Infecté : Packed.Win32.Krap.f  ignoré  
 
C:\upload_moi_TYREX.tar.gz  GZIP: infecté - 9  ignoré  
 
D:\pps email\Rakion\060803RIS.exe/file027  Infecté : Rootkit.Win32.Delf.q  ignoré  
 
D:\pps email\Rakion\060803RIS.exe  Inno: infecté - 1  ignoré  
 
Analyse terminée.

darkpoet · Answer

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort. 

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau. 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes 
explorer.exe 




:files 
C:\WINDOWS\system32\gesokabo.dll

C:\WINDOWS\system32\yopamuna.dll
C:\WINDOWS\system32\wojenahu.dll
C:\WINDOWS\system32\fusoweli.dll
C:\WINDOWS\system32\yofenada.dll
C:\WINDOWS\system32\detigere.dll
C:\WINDOWS\system32\fikesilo.dll
C:\WINDOWS\system32
esoyalo.dll
C:\WINDOWS\system32
apohari.dll
C:\WINDOWS\system32\diwosama.VIR 
D:\pps email\Rakion\060803RIS.exe

:reg 


:commands 
[purity] 
[emptytemp] 
[reboot] 





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

darkpoet · Answer

ne fait pas le post precedent j avais oublié des lignes fait celui qui suit

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort. 

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau. 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes 
explorer.exe 




:files 
C:\WINDOWS\system32\gesokabo.dll 

C:\WINDOWS\system32\yopamuna.dll 
C:\WINDOWS\system32\wojenahu.dll 
C:\WINDOWS\system32\fusoweli.dll 
C:\WINDOWS\system32\yofenada.dll 
C:\WINDOWS\system32\detigere.dll 
C:\WINDOWS\system32\fikesilo.dll 
C:\WINDOWS\system32
esoyalo.dll 
C:\WINDOWS\system32
apohari.dll 
C:\WINDOWS\system32\diwosama.VIR 
D:\pps email\Rakion\060803RIS.exe 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/~­.exe 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/v­idefila.dll 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/z­obumawe.dll 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/w­ofokode.dll 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/p­anesehi.dll 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/m­azenahi.dll 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/v­enaluwe.dll 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar/WINDOWS/System32/y­ufarapu.dll 
C:\upload_moi_TYREX.tar.gz/upload_moi.tar 
C:\upload_moi_TYREX.tar.gz 
D:\pps email\Rakion\060803RIS.exe/file027 

:reg 


:commands 
[purity] 
[emptytemp] 
[reboot] 





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

^^Marie^^ · Answer

Bonjour

darkpoet est absent, j'essaierai de regarder pour la suite

Pas capable de finir

62 réponses

Votre réponse

Discussions similaires

Newsletters