Virus Win32:Trojan-gen. {Other}

Question

Bonjour,

J'ai plusieurs fois lancés des scan d'avast, mais ce virus revient à chaque fois. 

J'en peux plus au secours !!!! lol !!

plopus · Answer

bonsoir

telecharge hijackthis

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html

choisit "do a scan and save the log" et poste le rapport

Wazza6 · Answer

"Bonjour,

J'ai plusieurs fois lancés des scan d'avast, mais ce virus revient à chaque fois.

J'en peux plus au secours !!!! lol !"

lol! ??
un virus c'est serieux je ne trouves pas ca drole... en tout cas...

plopus · Answer

fait le poste 1

danicrome · Answer

Merci pour ta réponse rapide. j'ai dû redémarrer mon ordi, il rame grave.

voici le log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:42:12, on 20/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PVSW\Bin\WGE_SRV.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Documents and Settings\Dani\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5060905
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5060905
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=MQ-vaq6YtqM1DocvPPgF6YSkQOg
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\GhostSurf 2006 Platinum\SCActiveBlock.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: (no name) - {5f6a8570-ecc4-4a7d-b8c2-b647f34beaee} - C:\WINDOWS\system32\gayosetu.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: {8c244226-de06-fb7a-fe24-5e26d8dd9aad} - {daa9dd8d-62e5-42ef-a7bf-60ed622442c8} - C:\WINDOWS\system32\xebpdn.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [CTSVolFE.exe] "C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [huhumehasu] Rundll32.exe "C:\WINDOWS\system32\zevehahu.dll",s
O4 - HKLM\..\Run: [a095ae2e] rundll32.exe "C:\WINDOWS\system32otapote.dll",b
O4 - HKLM\..\Run: [CPMa3a69db2] Rundll32.exe "c:\windows\system32\mozubolu.dll",a
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [huhumehasu] Rundll32.exe "C:\WINDOWS\system32\zevehahu.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by126w.bay126.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://bellerock.microgaming.com/freeplayfrench/FlashAX2.cab
O20 - AppInit_DLLs: interceptor.dll c:\windows\system32\juyobosu.dll C:\WINDOWS\system32olijugu.dll c:\windows\system32\mozubolu.dll xebpdn.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\mozubolu.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\mozubolu.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EBP Pervasive.SQL - Unknown owner - C:\PVSW\Bin\WGE_SRV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

danicrome · Answer

Que dois-je faire ensuite?

danicrome · Answer

S'il vous plait j'ai vraiment besoin d'aide. Quelqu'un a pu voir le rapport de hijack this?

plopus · Answer

bonjour,


vundo est bien implanté dans ton PC

desactive ton antivirus, le fix peut etre detecté a tort

telecharge combofix	http://download.bleepingcomputer.com/sUBs/ComboFix.exe 


telecharge malwarebyte, met le  ajour de suite
http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebytes anti malware

ensuite redemarre ton PC au bip tapote F8 puis choisit mode sans echec


puis lance combofix et ne touche a rien meme pas à la souris (le rapport ce trouve dans C/conbofix.txt

et toujours en sans echec lance une analyse avec malwarebyte à la fin clic sur afficher resultat et clic sur supprimer et poste le rapport

danicrome · Answer

Merci pour ta réponse, je fais de suite la manip.

danicrome · Answer

Je viens de faire la manip, voici le rapport de malware :

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1675
Windows 5.1.2600 Service Pack 3

22/01/2009 00:35:13
mbam-log-2009-01-22 (00-35-13).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 220680
Temps écoulé: 3 hour(s), 43 minute(s), 17 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 15
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 32

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32olijugu.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\mozubolu.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\xebpdn.dll (Trojan.Vundo.H) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{daa9dd8d-62e5-42ef-a7bf-60ed622442c8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{daa9dd8d-62e5-42ef-a7bf-60ed622442c8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5f6a8570-ecc4-4a7d-b8c2-b647f34beaee} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5f6a8570-ecc4-4a7d-b8c2-b647f34beaee} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{daa9dd8d-62e5-42ef-a7bf-60ed622442c8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5041fd9-4819-4dc4-b20e-c950b5b03d2a} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64de95e5-0a25-4dd9-a472-97bc1d419101} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5f6a8570-ecc4-4a7d-b8c2-b647f34beaee} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpma3a69db2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\huhumehasu (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32olijugu.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32olijugu.dll  -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32olijugu.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\mozubolu.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\mozubolu.dll -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\xebpdn.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\mozubolu.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\gayosetu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32olijugu.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP538\A0128384.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP538\A0128516.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP538\A0128518.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP538\A0128519.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP538\A0128546.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP538\A0128552.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP538\A0128568.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP538\A0128900.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP538\A0128902.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP538\A0128904.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\buvujano.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hapoyivu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kafunepi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kajelaki.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lovojefu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\luhuvoyu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\melusume.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\migunugo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\putiwuwa.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qbfsiw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32uvoziyi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	ikzgx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	kowfs.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ufcrqp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xfpkza.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\znovih.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\metitalu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dokanisu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.


MERCI d'avance.

plopus · Answer

relance malwarebyte va dans la quarantaine et supprime tout

et le rapport de combofix tu l'as fait ou pas ?
si non pas grave poste un nouveau hijackthis stp

danicrome · Answer

Je ne retrouve pas le rapport de combo fix.

J'ai refait un hijackthis. 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:53:52, on 22/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PVSW\Bin\WGE_SRV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Dani\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5060905
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5060905
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=MQ-vaq6YtqM1DocvPPgF6YSkQOg
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\GhostSurf 2006 Platinum\SCActiveBlock.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [CTSVolFE.exe] "C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [huhumehasu] Rundll32.exe "C:\WINDOWS\system32\zevehahu.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by126w.bay126.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://bellerock.microgaming.com/freeplayfrench/FlashAX2.cab
O20 - AppInit_DLLs: interceptor.dll c:\windows\system32\juyobosu.dll   xebpdn.dll 
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EBP Pervasive.SQL - Unknown owner - C:\PVSW\Bin\WGE_SRV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

plopus · Answer

clic sur ton poste de travail va dans C et regarde tu dois avoir un document .txt au nom de Combofix poste le stp

danicrome · Answer

Je ne le retrouve pas. 
Je redémarre en sans échec et je refais un combofix.

Merci

plopus · Answer

si tu es sur  de l'avoir deja fait sa sert a rien...mais si tu trouve pas le fichier .txt c'est pas normal

en tout cas si tu le refiat enregistre bien ton rapport

danicrome · Answer

Voici le rapport de combofix ComboFix 09-01-21.01 - Dani 2009-01-22 20:22:23.2 - NTFSx86 MINIMAL Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1022.798 [GMT 1:00] Lancé depuis: C:\ComboFix.exe AV: *On-access scanning disabled* (Outdated) AV: avast! antivirus 4.8.1296 [VPS 090121-0] *On-access scanning enabled* (Updated) FW: *disabled* AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Exécution préalable ------- . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\Dani\new.txt c:\windows\system32\agipemek.ini c:\windows\system32\anozesog.ini c:\windows\system32\avewemuk.ini c:\windows\system32\bitanazo.dll c:\windows\system32\bosomoju.dll c:\windows\system32\ebekuzet.ini c:\windows\system32\ejapoyiw.ini c:\windows\system32\honulohu.dll c:\windows\system32\ivumises.ini c:\windows\system32\ivuwimin.ini c:\windows\system32\libeay32.dll c:\windows\system32\mevehezo.dll c:\windows\system32\nofesola.dll c:\windows\system32\nugamibe.dll c:\windows\system32\ogileyuw.ini c:\windows\system32\ojegibiw.ini c:\windows\system32\udeveweg.ini c:\windows\system32\uehsgf.dll c:\windows\system32\uyayuhav.ini . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_PACKET -------\Legacy_TDSSSERV -------\Service_TDSSserv ((((((((((((((((((((((((((((( Fichiers créés du 2008-12-22 au 2009-01-22 )))))))))))))))))))))))))))))))))))) . 2009-01-21 20:08 . 2009-01-21 20:09 3,048,283 -ra------ C:\ComboFix.exe 2009-01-21 14:45 . 2009-01-21 14:45 2,724 ---hs---- c:\windows\system32\zunubodu.exe 2009-01-20 23:35 . 2009-01-20 23:35 d-------- c:\windows\system32\Kaspersky Lab 2009-01-13 20:09 . 2009-01-13 20:09 1,334,171 ---hs---- c:\windows\system32\ivumises.tmp 2009-01-10 02:32 . 2009-01-13 22:30 d-------- c:\program files\Full Tilt Poker 2009-01-10 01:49 . 2009-01-10 01:49 410,984 --a------ c:\windows\system32\deploytk.dll 2009-01-10 01:34 . 2009-01-10 01:40 d-------- c:\program files\bwin . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-21 19:06 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-01-20 19:54 --------- d-----w c:\program files\Google 2009-01-14 15:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-14 15:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-01-13 21:31 --------- d-----w c:\program files\Everest Poker 2009-01-10 01:32 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-10 01:19 --------- d-----w c:\program files\WinamaxPoker 2009-01-10 00:49 --------- d-----w c:\program files\Java 2009-01-05 21:26 47,760 ----a-w c:\documents and settings\Dani\Application Data\GDIPFONTCACHEV1.DAT 2009-01-05 00:53 --------- d-----w c:\program files\eMule 2008-12-13 06:37 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll 2008-12-10 02:07 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-11-25 18:02 --------- d-----w c:\program files\MSN Messenger 2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys 2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll 2006-10-18 20:08 88 --sh--r c:\windows\system32\[u]0/uDB961A707.sys 2006-10-18 20:08 3,766 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2008-11-03 5674352] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-06-21 1211176] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-20 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-10 136600] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 667718] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 602182] "CTSVolFE.exe"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2005-02-23 57344] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035] "ISUSPM Startup"="c:\program files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856] "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-09-05 24576] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegedit"= 0 (0x0) "HideClock"= 0 (0x0) "NoDispSettingPage"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3acm"= l3codecp.acm "msacm.divxa32"= DivXa32.acm "VIDC.ACDV"= ACDV.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] --a------ 2007-06-11 10:25 6731312 c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2005-12-09 20:29 49152 c:\program files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair] --a------ 2002-12-10 18:32 155648 c:\program files\Logitech\ImageStudio\ISStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray] --a------ 2002-12-10 18:31 61440 c:\program files\Logitech\ImageStudio\LogiTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMS] --a------ 2002-12-10 17:54 127022 c:\program files\Fichiers communs\Logitech\QCDriver3\LVComS.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate] --a------ 2007-12-20 09:51 299920 c:\program files\Plaxo\3.7.1.2\PlaxoHelper_fr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-03-28 22:37 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a------ 2007-01-10 18:38 20480 c:\program files\Real\RealPlayer\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe] --a------ 2007-03-14 16:52 3770024 c:\program files\TomTom HOME\TomTomHOME.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2006-10-25 06:37 35328 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-08-30 16:43 4670704 c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\Program Files\Messenger\msmsgs.exe"= "c:\Program Files\eMule\emule.exe"= "c:\Program Files\BitLord\BitLord.exe"= "c:\Python25\pythonw.exe"= "c:\Program Files\ICQ6\ICQ.exe"= "c:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"= "c:\Program Files\Yahoo!\Messenger\YServer.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"= "c:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"= "c:\Program Files\Sports Interactive\Football Manager 2008\fm.exe"= "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "c:\PVSW\Bin\w3dbsmgr.exe"= "c:\Program Files\EBP\Paye13.0\WinPaye.exe"= "c:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe"= "c:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe"= "c:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords_PitBoss.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\MSN Messenger\msnmsgr.exe"= "c:\Program Files\MSN Messenger\livecall.exe"= "c:\Program Files\Alwil Software\Avast4\ashServ.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "10093:UDP"= 10093:UDP:Port Fm 1 "10094:TCP"= 10094:TCP:Port Fm 2 "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "49175:UDP"= 49175:UDP:emule S0 lffhcfz;lffhcfz;c:\windows\system32\drivers\fkzIgfr.sys --> c:\windows\system32\drivers\fkzIgfr.sys [?] S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-05-28 111184] S4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-05-28 20560] S4 EBP Pervasive.SQL;EBP Pervasive.SQL;c:\pvsw\Bin\WGE_SRV.exe [2006-12-07 32768] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\autorun.exe \Shell\setup\command - G:\install.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \Shell\AutoRun\command - I:\autorun.exe . Contenu du dossier 'Tâches planifiées' 2009-01-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57] . - - - - ORPHELINS SUPPRIMES - - - - HKLM-RunServicesOnce-Olepro32.dll - (no file) MSConfigStartUp-MSKDetectorExe - c:\program files\McAfee\SpamKiller\MSKDetct.exe . ------- Examen supplémentaire ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uDefault_Search_URL = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/first_usage&s=MQ-vaq6YtqM1DocvPPgF6YSkQOg uInternet Settings,ProxyOverride = uInternet Settings,ProxyServer = uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000 IE: {{FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com FF - ProfilePath - c:\documents and settings\Dani\Application Data\Mozilla\Firefox\Profiles\45tmdnxt.default\ FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Picasa2\npPicasa2.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-22 20:27:49 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-1311335598-687219084-3099851508-1005\Software\G*e*n*i*e*"!\FM Genie Scout] "GameDir"="c:\Program Files\Sports Interactive\Football Manager 2007\user data\games" "ShortlistDir"="c:\Program Files\Sports Interactive\Football Manager 2007\user data\shortlists" "ScreenshotsDir"="c:\Program Files\Sports Interactive\Football Manager 2007\user data" "SaveDir"="c:\Program Files\Sports Interactive\Football Manager 2007\user data" "HistoryDir"="c:\Documents and Settings\Dani\Mes documents\Football Manager 2007\FM Genie Scout 2007\History Points" "LangDB"="c:\Program Files\Sports Interactive\Football Manager 2007\data\db\702\lang_db.dat" "LastSaveGame"="c:\Documents and Settings\Dani\Mes documents\Sports Interactive\Football Manager 2007\games\dani V2.fm" "LoadLangDB"=dword:00000001 "CompressHistoryPoints"=dword:00000000 "HighlightedAttributes"=dword:00000000 "WindowState"=dword:00000002 "WindowHeight"=dword:000002e0 "WindowWidth"=dword:000003fe "WindowLeft"=dword:00000001 "WindowTop"=dword:00000002 "Currency"=dword:0000001c "Language"="English" "MinCondition"=dword:00000050 "LastUpdateCheck"=dword:00009990 "HighQualityGUI"=dword:00000000 "AutomaticallyUpdateCheck"=dword:00000001 "AdvancedGeneration"=dword:00000000 "ShowHistory"=dword:00000001 "UseProxy"=dword:00000000 "ProxyHost"="" "ProxyPort"="" "UseAuthentication"=dword:00000000 "UserName"="" "UserPassword"="" [HKEY_USERS\S-1-5-21-1311335598-687219084-3099851508-1005\Software\G*e*n*i*e*"!\FM Genie Scout\Columns\Clubs] "Position0"=dword:00000000 "Visible0"=dword:00000001 "Width0"=dword:0000007d "Position1"=dword:00000001 "Visible1"=dword:00000001 "Width1"=dword:00000064 "Position2"=dword:00000002 "Visible2"=dword:00000001 "Width2"=dword:00000064 "Position3"=dword:00000003 "Visible3"=dword:00000001 "Width3"=dword:00000032 "Position4"=dword:00000004 "Visible4"=dword:00000001 "Width4"=dword:00000032 "Position5"=dword:00000005 "Visible5"=dword:00000001 "Width5"=dword:00000050 "Position6"=dword:00000006 "Visible6"=dword:00000001 "Width6"=dword:00000050 "Position7"=dword:00000007 "Visible7"=dword:00000001 "Width7"=dword:00000050 "Position8"=dword:00000008 "Visible8"=dword:00000000 "Width8"=dword:00000050 "Position9"=dword:00000009 "Visible9"=dword:00000000 "Width9"=dword:0000002d "Position10"=dword:0000000a "Visible10"=dword:00000000 "Width10"=dword:0000001e "Position11"=dword:0000000b "Visible11"=dword:00000000 "Width11"=dword:0000001e "Position12"=dword:0000000c "Visible12"=dword:00000000 "Width12"=dword:0000001e "Position13"=dword:0000000d "Visible13"=dword:00000001 "Width13"=dword:0000003c "Position14"=dword:0000000e "Visible14"=dword:00000000 "Width14"=dword:00000032 "Position15"=dword:0000000f "Visible15"=dword:00000000 "Width15"=dword:00000032 "Position16"=dword:00000010 "Visible16"=dword:00000000 "Width16"=dword:00000032 "Position17"=dword:00000011 "Visible17"=dword:00000001 "Width17"=dword:00000050 "Position18"=dword:00000012 "Visible18"=dword:00000001 "Width18"=dword:00000050 "Position19"=dword:00000013 "Visible19"=dword:00000000 "Width19"=dword:00000050 [HKEY_USERS\S-1-5-21-1311335598-687219084-3099851508-1005\Software\G*e*n*i*e*"!\FM Genie Scout\Columns\Players] "Position0"=dword:00000000 "Visible0"=dword:00000001 "Width0"=dword:00000090 "Position1"=dword:00000001 "Visible1"=dword:00000001 "Width1"=dword:0000006c "Position2"=dword:00000002 "Visible2"=dword:00000001 "Width2"=dword:0000005a "Position3"=dword:00000003 "Visible3"=dword:00000001 "Width3"=dword:0000005b "Position4"=dword:00000004 "Visible4"=dword:00000001 "Width4"=dword:0000001c "Position5"=dword:00000005 "Visible5"=dword:00000001 "Width5"=dword:00000026 "Position6"=dword:00000006 "Visible6"=dword:00000001 "Width6"=dword:00000030 "Position7"=dword:00000009 "Visible7"=dword:00000001 "Width7"=dword:0000004b "Position8"=dword:0000000a "Visible8"=dword:00000001 "Width8"=dword:0000004b "Position9"=dword:0000000b "Visible9"=dword:00000001 "Width9"=dword:0000004c "Position10"=dword:0000000c "Visible10"=dword:00000000 "Width10"=dword:00000050 "Position11"=dword:0000000d "Visible11"=dword:00000000 "Width11"=dword:0000004b "Position12"=dword:0000000e "Visible12"=dword:00000000 "Width12"=dword:0000002d "Position13"=dword:0000000f "Visible13"=dword:00000000 "Width13"=dword:0000003c "Position14"=dword:00000010 "Visible14"=dword:00000000 "Width14"=dword:0000004b "Position15"=dword:00000011 "Visible15"=dword:00000000 "Width15"=dword:00000064 "Position16"=dword:00000012 "Visible16"=dword:00000000 "Width16"=dword:00000064 "Position17"=dword:00000013 "Visible17"=dword:00000000 "Width17"=dword:0000004b "Position18"=dword:00000014 "Visible18"=dword:00000000 "Width18"=dword:00000064 "Position19"=dword:00000015 "Visible19"=dword:00000001 "Width19"=dword:00000037 "Position20"=dword:00000016 "Visible20"=dword:00000000 "Width20"=dword:0000004b "Position21"=dword:00000017 "Visible21"=dword:00000001 "Width21"=dword:0000004a "Position22"=dword:00000018 "Visible22"=dword:00000000 "Width22"=dword:00000027 "Position23"=dword:00000019 "Visible23"=dword:00000001 "Width23"=dword:00000047 "Position24"=dword:0000001a "Visible24"=dword:00000000 "Width24"=dword:0000005a "Position25"=dword:0000001b "Visible25"=dword:00000000 "Width25"=dword:0000006e "Position26"=dword:0000001c "Visible26"=dword:00000001 "Width26"=dword:0000004d "Position27"=dword:0000001d "Visible27"=dword:00000000 "Width27"=dword:00000087 "Position28"=dword:0000001e "Visible28"=dword:00000000 "Width28"=dword:00000064 "Position29"=dword:0000001f "Visible29"=dword:00000000 "Width29"=dword:00000064 "Position30"=dword:00000020 "Visible30"=dword:00000000 "Width30"=dword:00000046 "Position31"=dword:00000021 "Visible31"=dword:00000000 "Width31"=dword:0000004b "Position32"=dword:00000022 "Visible32"=dword:00000000 "Width32"=dword:00000046 "Position33"=dword:00000023 "Visible33"=dword:00000000 "Width33"=dword:0000004b "Position34"=dword:00000024 "Visible34"=dword:00000000 "Width34"=dword:0000003c "Position35"=dword:00000025 "Visible35"=dword:00000000 "Width35"=dword:00000064 "Position36"=dword:00000026 "Visible36"=dword:00000000 "Width36"=dword:00000073 "Position37"=dword:00000027 "Visible37"=dword:00000000 "Width37"=dword:0000005f "Position38"=dword:00000028 "Visible38"=dword:00000000 "Width38"=dword:00000091 "Position39"=dword:00000029 "Visible39"=dword:00000000 "Width39"=dword:0000003c "Position40"=dword:0000002a "Visible40"=dword:00000000 "Width40"=dword:0000005a "Position41"=dword:0000002b "Visible41"=dword:00000000 "Width41"=dword:00000041 "Position42"=dword:0000002c "Visible42"=dword:00000000 "Width42"=dword:00000050 "Position43"=dword:0000002d "Visible43"=dword:00000000 "Width43"=dword:00000055 "Position44"=dword:0000002e "Visible44"=dword:00000000 "Width44"=dword:0000005f "Position45"=dword:0000002f "Visible45"=dword:00000000 "Width45"=dword:00000050 "Position46"=dword:00000030 "Visible46"=dword:00000000 "Width46"=dword:0000004b "Position47"=dword:00000031 "Visible47"=dword:00000000 "Width47"=dword:0000004b "Position48"=dword:00000032 "Visible48"=dword:00000000 "Width48"=dword:00000046 "Position49"=dword:00000033 "Visible49"=dword:00000000 "Width49"=dword:00000032 "Position50"=dword:00000034 "Visible50"=dword:00000000 "Width50"=dword:0000003c "Position51"=dword:00000035 "Visible51"=dword:00000000 "Width51"=dword:0000004b "Position52"=dword:00000036 "Visible52"=dword:00000000 "Width52"=dword:0000003c "Position53"=dword:00000037 "Visible53"=dword:00000000 "Width53"=dword:00000037 "Position54"=dword:00000038 "Visible54"=dword:00000000 "Width54"=dword:00000069 "Position55"=dword:00000039 "Visible55"=dword:00000000 "Width55"=dword:0000005a "Position56"=dword:0000003a "Visible56"=dword:00000000 "Width56"=dword:0000004b "Position57"=dword:0000003b "Visible57"=dword:00000000 "Width57"=dword:0000004b "Position58"=dword:0000003c "Visible58"=dword:00000000 "Width58"=dword:00000037 "Position59"=dword:0000003d "Visible59"=dword:00000000 "Width59"=dword:0000003c "Position60"=dword:0000003e "Visible60"=dword:00000000 "Width60"=dword:0000003c "Position61"=dword:0000003f "Visible61"=dword:00000000 "Width61"=dword:00000041 "Position62"=dword:00000040 "Visible62"=dword:00000000 "Width62"=dword:00000055 "Position63"=dword:00000041 "Visible63"=dword:00000000 "Width63"=dword:0000003c "Position64"=dword:00000042 "Visible64"=dword:00000000 "Width64"=dword:0000003c "Position65"=dword:00000043 "Visible65"=dword:00000000 "Width65"=dword:0000004b "Position66"=dword:00000044 "Visible66"=dword:00000000 "Width66"=dword:0000003c "Position67"=dword:00000045 "Visible67"=dword:00000000 "Width67"=dword:00000046 "Position68"=dword:00000046 "Visible68"=dword:00000000 "Width68"=dword:00000028 "Position69"=dword:00000047 "Visible69"=dword:00000000 "Width69"=dword:00000041 "Position70"=dword:00000048 "Visible70"=dword:00000000 "Width70"=dword:0000003c "Position71"=dword:00000049 "Visible71"=dword:00000000 "Width71"=dword:00000069 "Position72"=dword:0000004a "Visible72"=dword:00000000 "Width72"=dword:00000041 "Position73"=dword:0000004b "Visible73"=dword:00000000 "Width73"=dword:0000005f "Position74"=dword:0000004c "Visible74"=dword:00000000 "Width74"=dword:0000003c "Position75"=dword:0000004d "Visible75"=dword:00000000 "Width75"=dword:00000037 "Position76"=dword:0000004e "Visible76"=dword:00000000 "Width76"=dword:0000004b "Position77"=dword:0000004f "Visible77"=dword:00000000 "Width77"=dword:00000050 "Position78"=dword:00000050 "Visible78"=dword:00000000 "Width78"=dword:00000037 "Position79"=dword:00000051 "Visible79"=dword:00000000 "Width79"=dword:00000037 "Position80"=dword:00000052 "Visible80"=dword:00000000 "Width80"=dword:0000005a "Position81"=dword:00000053 "Visible81"=dword:00000000 "Width81"=dword:0000004b "Position82"=dword:00000054 "Visible82"=dword:00000000 "Width82"=dword:00000055 "Position83"=dword:00000055 "Visible83"=dword:00000000 "Width83"=dword:0000002d "Position84"=dword:00000056 "Visible84"=dword:00000000 "Width84"=dword:00000037 "Position85"=dword:00000057 "Visible85"=dword:00000000 "Width85"=dword:0000003c "Position86"=dword:00000058 "Visible86"=dword:00000000 "Width86"=dword:00000046 "Position87"=dword:00000059 "Visible87"=dword:00000000 "Width87"=dword:0000003c "Position88"=dword:0000005a "Visible88"=dword:00000000 "Width88"=dword:0000005a "Position89"=dword:0000005b "Visible89"=dword:00000000 "Width89"=dword:0000003c "Position90"=dword:0000005c "Visible90"=dword:00000000 "Width90"=dword:00000050 "Position91"=dword:0000005d "Visible91"=dword:00000000 "Width91"=dword:00000046 "Position92"=dword:0000005e "Visible92"=dword:00000000 "Width92"=dword:0000005a "Position93"=dword:0000005f "Visible93"=dword:00000000 "Width93"=dword:00000037 "Position94"=dword:00000060 "Visible94"=dword:00000000 "Width94"=dword:0000003c "Position95"=dword:00000061 "Visible95"=dword:00000000 "Width95"=dword:0000003c "Position96"=dword:00000062 "Visible96"=dword:00000000 "Width96"=dword:00000046 "Position97"=dword:00000063 "Visible97"=dword:00000000 "Width97"=dword:00000046 "Position98"=dword:00000064 "Visible98"=dword:00000000 "Width98"=dword:00000055 "Position99"=dword:00000065 "Visible99"=dword:00000000 "Width99"=dword:00000073 "Position100"=dword:00000066 "Visible100"=dword:00000000 "Width100"=dword:00000041 "Position101"=dword:00000067 "Visible101"=dword:00000000 "Width101"=dword:0000003c "Position102"=dword:00000068 "Visible102"=dword:00000000 "Width102"=dword:0000003c "Position103"=dword:00000069 "Visible103"=dword:00000000 "Width103"=dword:00000046 "Position104"=dword:0000006a "Visible104"=dword:00000000 "Width104"=dword:0000003c "Position105"=dword:0000006b "Visible105"=dword:00000000 "Width105"=dword:00000041 "Position106"=dword:00000091 "Visible106"=dword:00000001 "Width106"=dword:0000004e "Position107"=dword:00000007 "Visible107"=dword:00000001 "Width107"=dword:00000024 "Position108"=dword:0000006c "Visible108"=dword:00000000 "Width108"=dword:00000050 "Position109"=dword:0000006d "Visible109"=dword:00000000 "Width109"=dword:00000050 "Position110"=dword:0000006e "Visible110"=dword:00000000 "Width110"=dword:00000055 "Position111"=dword:0000006f "Visible111"=dword:00000000 "Width111"=dword:00000082 "Position112"=dword:00000070 "Visible112"=dword:00000000 "Width112"=dword:00000087 "Position113"=dword:00000071 "Visible113"=dword:00000000 "Width113"=dword:0000000a "Position114"=dword:00000072 "Visible114"=dword:00000000 "Width114"=dword:0000000a "Position115"=dword:00000073 "Visible115"=dword:00000000 "Width115"=dword:00000072 "Position116"=dword:00000074 "Visible116"=dword:00000000 "Width116"=dword:0000000a "Position117"=dword:00000075 "Visible117"=dword:00000000 "Width117"=dword:0000000a "Position118"=dword:00000076 "Visible118"=dword:00000000 "Width118"=dword:0000000a "Position119"=dword:00000077 "Visible119"=dword:00000000 "Width119"=dword:0000000a "Position120"=dword:00000078 "Visible120"=dword:00000000 "Width120"=dword:0000000a "Position121"=dword:00000079 "Visible121"=dword:00000000 "Width121"=dword:0000000a "Position122"=dword:0000007a "Visible122"=dword:00000000 "Width122"=dword:0000000a "Position123"=dword:0000007b "Visible123"=dword:00000000 "Width123"=dword:0000000a "Position124"=dword:0000007c "Visible124"=dword:00000000 "Width124"=dword:0000000a "Position125"=dword:0000007d "Visible125"=dword:00000000 "Width125"=dword:0000000a "Position126"=dword:0000007e "Visible126"=dword:00000000 "Width126"=dword:0000000a "Position127"=dword:0000007f "Visible127"=dword:00000000 "Width127"=dword:0000000a "Position128"=dword:00000080 "Visible128"=dword:00000000 "Width128"=dword:0000000a "Position129"=dword:00000081 "Visible129"=dword:00000000 "Width129"=dword:0000000a "Position130"=dword:00000082 "Visible130"=dword:00000000 "Width130"=dword:0000000a "Position131"=dword:00000083 "Visible131"=dword:00000000 "Width131"=dword:0000000a "Position132"=dword:00000084 "Visible132"=dword:00000000 "Width132"=dword:0000000a "Position133"=dword:00000085 "Visible133"=dword:00000000 "Width133"=dword:0000000a "Position134"=dword:00000086 "Visible134"=dword:00000000 "Width134"=dword:0000000a "Position135"=dword:00000087 "Visible135"=dword:00000000 "Width135"=dword:0000000a "Position136"=dword:00000088 "Visible136"=dword:00000000 "Width136"=dword:0000000a "Position137"=dword:00000089 "Visible137"=dword:00000000 "Width137"=dword:0000000a "Position138"=dword:0000008a "Visible138"=dword:00000000 "Width138"=dword:0000000a "Position139"=dword:0000008b "Visible139"=dword:00000000 "Width139"=dword:0000000a "Position140"=dword:0000008c "Visible140"=dword:00000000 "Width140"=dword:0000000a "Position141"=dword:0000008d "Visible141"=dword:00000000 "Width141"=dword:0000000a "Position142"=dword:0000008e "Visible142"=dword:00000000 "Width142"=dword:0000000a "Position143"=dword:0000008f "Visible143"=dword:00000000 "Width143"=dword:0000000a "Position144"=dword:00000090 "Visible144"=dword:00000000 "Width144"=dword:0000000a "Position145"=dword:00000095 "Visible145"=dword:00000000 "Width145"=dword:00000050 "Position146"=dword:00000008 "Visible146"=dword:00000000 "Width146"=dword:00000037 "Position147"=dword:00000092 "Visible147"=dword:00000000 "Width147"=dword:00000028 "Position148"=dword:00000093 "Visible148"=dword:00000000 "Width148"=dword:00000037 "Position149"=dword:00000094 "Visible149"=dword:00000001 "Width149"=dword:00000036 [HKEY_USERS\S-1-5-21-1311335598-687219084-3099851508-1005\Software\G*e*n*i*e*"!\FM Genie Scout\Columns\Staff] "Position0"=dword:00000000 "Visible0"=dword:00000001 "Width0"=dword:0000007d "Position1"=dword:00000001 "Visible1"=dword:00000001 "Width1"=dword:00000064 "Position2"=dword:00000002 "Visible2"=dword:00000001 "Width2"=dword:00000064 "Position3"=dword:00000003 "Visible3"=dword:00000001 "Width3"=dword:00000069 "Position4"=dword:00000005 "Visible4"=dword:00000001 "Width4"=dword:00000028 "Position5"=dword:00000006 "Visible5"=dword:00000001 "Width5"=dword:00000028 "Position6"=dword:00000004 "Visible6"=dword:00000001 "Width6"=dword:00000028 "Position7"=dword:00000007 "Visible7"=dword:00000001 "Width7"=dword:00000050 "Position8"=dword:00000008 "Visible8"=dword:00000000 "Width8"=dword:00000050 "Position9"=dword:00000009 "Visible9"=dword:00000000 "Width9"=dword:0000004b "Position10"=dword:0000000a "Visible10"=dword:00000000 "Width10"=dword:0000002d "Position11"=dword:0000000b "Visible11"=dword:00000000 "Width11"=dword:0000003c "Position12"=dword:0000000c "Visible12"=dword:00000000 "Width12"=dword:0000004b "Position13"=dword:0000000d "Visible13"=dword:00000000 "Width13"=dword:00000064 "Position14"=dword:0000000e "Visible14"=dword:00000000 "Width14"=dword:00000064 "Position15"=dword:0000000f "Visible15"=dword:00000000 "Width15"=dword:0000004b "Position16"=dword:00000010 "Visible16"=dword:00000000 "Width16"=dword:00000064 "Position17"=dword:00000011 "Visible17"=dword:00000001 "Width17"=dword:0000003c "Position18"=dword:00000012 "Visible18"=dword:00000000 "Width18"=dword:0000004b "Position19"=dword:00000013 "Visible19"=dword:00000001 "Width19"=dword:00000050 "Position20"=dword:00000014 "Visible20"=dword:00000000 "Width20"=dword:00000046 "Position21"=dword:00000015 "Visible21"=dword:00000000 "Width21"=dword:0000004b "Position22"=dword:00000016 "Visible22"=dword:00000000 "Width22"=dword:00000046 "Position23"=dword:00000017 "Visible23"=dword:00000000 "Width23"=dword:00000046 "Position24"=dword:00000018 "Visible24"=dword:00000000 "Width24"=dword:0000003c "Position25"=dword:00000019 "Visible25"=dword:00000000 "Width25"=dword:00000041 "Position26"=dword:0000001a "Visible26"=dword:00000000 "Width26"=dword:0000003c "Position27"=dword:0000001b "Visible27"=dword:00000000 "Width27"=dword:00000055 "Position28"=dword:0000001c "Visible28"=dword:00000000 "Width28"=dword:00000069 "Position29"=dword:0000001d "Visible29"=dword:00000000 "Width29"=dword:0000006e "Position30"=dword:0000001e "Visible30"=dword:00000000 "Width30"=dword:00000064 "Position31"=dword:0000001f "Visible31"=dword:00000000 "Width31"=dword:00000078 "Position32"=dword:00000020 "Visible32"=dword:00000000 "Width32"=dword:00000064 "Position33"=dword:00000021 "Visible33"=dword:00000000 "Width33"=dword:00000087 "Position34"=dword:00000022 "Visible34"=dword:00000000 "Width34"=dword:00000069 "Position35"=dword:00000023 "Visible35"=dword:00000000 "Width35"=dword:0000006e "Position36"=dword:00000024 "Visible36"=dword:00000000 "Width36"=dword:00000073 "Position37"=dword:00000025 "Visible37"=dword:00000000 "Width37"=dword:0000004b "Position38"=dword:00000026 "Visible38"=dword:00000000 "Width38"=dword:0000002d "Position39"=dword:00000027 "Visible39"=dword:00000000 "Width39"=dword:00000055 "Position40"=dword:00000028 "Visible40"=dword:00000000 "Width40"=dword:00000046 "Position41"=dword:00000029 "Visible41"=dword:00000000 "Width41"=dword:0000004b "Position42"=dword:0000002a "Visible42"=dword:00000000 "Width42"=dword:0000003c "Position43"=dword:0000002b "Visible43"=dword:00000000 "Width43"=dword:00000046 "Position44"=dword:0000002c "Visible44"=dword:00000000 "Width44"=dword:00000073 "Position45"=dword:0000002d "Visible45"=dword:00000000 "Width45"=dword:0000004b "Position46"=dword:0000002e "Visible46"=dword:00000000 "Width46"=dword:00000073 "Position47"=dword:0000002f "Visible47"=dword:00000000 "Width47"=dword:0000007d "Position48"=dword:00000030 "Visible48"=dword:00000000 "Width48"=dword:0000006e "Position49"=dword:00000031 "Visible49"=dword:00000000 "Width49"=dword:00000037 "Position50"=dword:00000032 "Visible50"=dword:00000000 "Width50"=dword:00000064 "Position51"=dword:00000033 "Visible51"=dword:00000000 "Width51"=dword:00000037 "Position52"=dword:00000034 "Visible52"=dword:00000000 "Width52"=dword:0000004b "Position53"=dword:00000035 "Visible53"=dword:00000000 "Width53"=dword:00000046 "Position54"=dword:00000036 "Visible54"=dword:00000000 "Width54"=dword:00000037 "Position55"=dword:00000037 "Visible55"=dword:00000000 "Width55"=dword:0000003c "Position56"=dword:00000038 "Visible56"=dword:00000000 "Width56"=dword:00000055 "Position57"=dword:00000039 "Visible57"=dword:00000000 "Width57"=dword:0000003c "Position58"=dword:0000003a "Visible58"=dword:00000000 "Width58"=dword:0000003c "Position59"=dword:0000003b "Visible59"=dword:00000000 "Width59"=dword:00000055 "Position60"=dword:0000003c "Visible60"=dword:00000000 "Width60"=dword:00000046 "Position61"=dword:0000003d "Visible61"=dword:00000000 "Width61"=dword:0000004b "Position62"=dword:0000003e "Visible62"=dword:00000000 "Width62"=dword:00000055 "Position63"=dword:0000003f "Visible63"=dword:00000000 "Width63"=dword:0000005a "Position64"=dword:00000040 "Visible64"=dword:00000000 "Width64"=dword:0000006e "Position65"=dword:00000041 "Visible65"=dword:00000000 "Width65"=dword:00000050 "Position66"=dword:00000042 "Visible66"=dword:00000000 "Width66"=dword:00000032 "Position67"=dword:00000043 "Visible67"=dword:00000000 "Width67"=dword:00000064 "Position68"=dword:00000044 "Visible68"=dword:00000000 "Width68"=dword:0000004b "Position69"=dword:00000045 "Visible69"=dword:00000000 "Width69"=dword:0000002d "Position70"=dword:00000046 "Visible70"=dword:00000000 "Width70"=dword:0000004b "Position71"=dword:00000047 "Visible71"=dword:00000000 "Width71"=dword:0000005a "Position72"=dword:00000048 "Visible72"=dword:00000000 "Width72"=dword:0000005a "Position73"=dword:00000049 "Visible73"=dword:00000000 "Width73"=dword:00000050 "Position74"=dword:0000004a "Visible74"=dword:00000000 "Width74"=dword:0000004b "Position75"=dword:0000004b "Visible75"=dword:00000000 "Width75"=dword:00000050 "Position76"=dword:0000004c "Visible76"=dword:00000000 "Width76"=dword:0000005a "Position77"=dword:0000004d "Visible77"=dword:00000000 "Width77"=dword:00000041 "Position78"=dword:0000004e "Visible78"=dword:00000000 "Width78"=dword:00000041 "Position79"=dword:0000004f "Visible79"=dword:00000000 "Width79"=dword:00000041 "Position80"=dword:00000050 "Visible80"=dword:00000000 "Width80"=dword:00000041 "Position81"=dword:00000051 "Visible81"=dword:00000000 "Width81"=dword:00000041 "Position82"=dword:00000052 "Visible82"=dword:00000000 "Width82"=dword:00000041 "Position83"=dword:00000053 "Visible83"=dword:00000000 "Width83"=dword:00000041 "Position84"=dword:00000054 "Visible84"=dword:00000000 "Width84"=dword:00000041 "Position85"=dword:00000055 "Visible85"=dword:00000000 "Width85"=dword:00000041 "Position86"=dword:00000056 "Visible86"=dword:00000000 "Width86"=dword:00000050 [HKEY_USERS\S-1-5-21-1311335598-687219084-3099851508-1005\Software\G*e*n*i*e*"!\FM Genie Scout\History Points] "Sans nom"="c:\Documents and Settings\Dani\Mes documents\Football Manager 2007\FM Genie Scout 2007\History Points\Sans nom" [HKEY_USERS\S-1-5-21-1311335598-687219084-3099851508-1005\Software\G*e*n*i*e*"!\FM Genie Scout\Rating] "GKPositionCoef"=dword:00000000 "GKCurrentAbilityCoef"=dword:00000000 "GKCornersCoef"=dword:00000000 "GKCrossingCoef"=dword:00000000 "GKDribblingCoef"=dword:00000000 "GKFinishingCoef"=dword:00000000 "GKFirstTouchCoef"=dword:00000005 "GKFreeKicksCoef"=dword:00000000 "GKHeadingCoef"=dword:00000005 "GKLongShotsCoef"=dword:00000000 "GKLongThrowsCoef"=dword:00000000 "GKMarkingCoef"=dword:00000000 "GKPassingCoef"=dword:0000000a "GKPenaltiesCoef"=dword:00000005 "GKTacklingCoef"=dword:0000000a "GKTechniqueCoef"=dword:00000000 "GKLeftFootCoef"=dword:00000005 "GKRightFootCoef"=dword:00000005 "GKAggressionCoef"=dword:0000001e "GKAnticipationCoef"=dword:0000000a "GKBraveryCoef"=dword:0000001e "GKComposureCoef"=dword:0000001e "GKConcentrationCoef"=dword:00000014 "GKConsistencyCoef"=dword:00000014 "GKCreativityCoef"=dword:00000000 "GKDecisionsCoef"=dword:0000001e "GKDeterminationCoef"=dword:00000014 "GKDirtinessCoef"=dword:fffffff6 "GKFlairCoef"=dword:00000005 "GKImportantMatchesCoef"=dword:00000014 "GKInfluenceCoef"=dword:0000000f "GKOffTheBallCoef"=dword:00000000 "GKPositioningCoef"=dword:0000003c "GKTeamworkCoef"=dword:0000000a "GKWorkRateCoef"=dword:00000005 "GKAccelerationCoef"=dword:0000000a "GKAgilityCoef"=dword:00000014 "GKBalanceCoef"=dword:00000014 "GKInjuryPronenessCoef"=dword:fffffff6 "GKJumpingCoef"=dword:00000050 "GKNaturalFitnessCoef"=dword:0000000a "GKPaceCoef"=dword:00000000 "GKStaminaCoef"=dword:00000005 "GKStrengthCoef"=dword:0000001e "GKVersatilityCoef"=dword:00000005 "GKAerialAbilityCoef"=dword:00000050 "GKCommandOfAreaCoef"=dword:00000032 "GKCommunicationCoef"=dword:0000003c "GKEccentricityCoef"=dword:ffffffe7 "GKHandlingCoef"=dword:00000064 "GKKickingCoef"=dword:00000019 "GKOneOnOnesCoef"=dword:00000032 "GKReflexesCoef"=dword:00000064 "GKRushingOutCoef"=dword:0000001e "GKTendencyToPunchCoef"=dword:ffffffe7 "GKThrowingCoef"=dword:00000019 "GKAdaptabilityCoef"=dword:0000000a "GKAmbitionCoef"=dword:00000014 "GKControversyCoef"=dword:fffffffb "GKLoyalityCoef"=dword:0000000a "GKPressureCoef"=dword:00000014 "GKProfessionalismCoef"=dword:0000000f "GKSportsmanshipCoef"=dword:0000000a "GKTemperamentCoef"=dword:00000005 "SWPositionCoef"=dword:00000000 "SWCurrentAbilityCoef"=dword:00000000 "SWCornersCoef"=dword:0000000a "SWCrossingCoef"=dword:00000005 "SWDribblingCoef"=dword:00000005 "SWFinishingCoef"=dword:00000005 "SWFirstTouchCoef"=dword:00000014 "SWFreeKicksCoef"=dword:0000000a "SWHeadingCoef"=dword:00000064 "SWLongShotsCoef"=dword:00000005 "SWLongThrowsCoef"=dword:00000005 "SWMarkingCoef"=dword:00000064 "SWPassingCoef"=dword:00000014 "SWPenaltiesCoef"=dword:00000005 "SWTacklingCoef"=dword:00000064 "SWTechniqueCoef"=dword:0000000f "SWLeftFootCoef"=dword:0000000a "SWRightFootCoef"=dword:0000000a "SWAggressionCoef"=dword:0000000f "SWAnticipationCoef"=dword:00000014 "SWBraveryCoef"=dword:00000028 "SWComposureCoef"=dword:00000028 "SWConcentrationCoef"=dword:00000028 "SWConsistencyCoef"=dword:00000014 "SWCreativityCoef"=dword:00000005 "SWDecisionsCoef"=dword:0000001e "SWDeterminationCoef"=dword:00000014 "SWDirtinessCoef"=dword:ffffffe7 "SWFlairCoef"=dword:00000005 "SWImportantMatchesCoef"=dword:00000014 "SWInfluenceCoef"=dword:0000000f "SWOffTheBallCoef"=dword:00000005 "SWPositioningCoef"=dword:00000064 "SWTeamworkCoef"=dword:00000028 "SWWorkRateCoef"=dword:0000000a "SWAccelerationCoef"=dword:00000019 "SWAgilityCoef"=dword:00000005 "SWBalanceCoef"=dword:00000014 "SWInjuryPronenessCoef"=dword:fffffff6 "SWJumpingCoef"=dword:00000050 "SWNaturalFitnessCoef"=dword:0000000a "SWPaceCoef"=dword:00000019 "SWStaminaCoef"=dword:0000000f "SWStrengthCoef"=dword:0000003c "SWVersatilityCoef"=dword:00000005 "SWAerialAbilityCoef"=dword:00000000 "SWCommandOfAreaCoef"=dword:00000000 "SWCommunicationCoef"=dword:00000000 "SWEccentricityCoef"=dword:00000000 "SWHandlingCoef"=dword:00000000 "SWKickingCoef"=dword:00000000 "SWOneOnOnesCoef"=dword:00000005 "SWReflexesCoef"=dword:00000005 "SWRushingOutCoef"=dword:00000000 "SWTendencyToPunchCoef"=dword:00000000 "SWThrowingCoef"=dword:00000000 "SWAdaptabilityCoef"=dword:0000000a "SWAmbitionCoef"=dword:00000014 "SWControversyCoef"=dword:fffffffb "SWLoyalityCoef"=dword:0000000a "SWPressureCoef"=dword:00000014 "SWProfessionalismCoef"=dword:0000000f "SWSportsmanshipCoef"=dword:0000000a "SWTemperamentCoef"=dword:00000005 "CBPositionCoef"=dword:00000000 "CBCurrentAbilityCoef"=dword:00000000 "CBCornersCoef"=dword:00000014 "CBCrossingCoef"=dword:0000000a "CBDribblingCoef"=dword:00000005 "CBFinishingCoef"=dword:00000005 "CBFirstTouchCoef"=dword:00000014 "CBFreeKicksCoef"=dword:00000014 "CBHeadingCoef"=dword:00000064 "CBLongShotsCoef"=dword:00000005 "CBLongThrowsCoef"=dword:00000005 "CBMarkingCoef"=dword:00000050 "CBPassingCoef"=dword:0000001e "CBPenaltiesCoef"=dword:00000005 "CBTacklingCoef"=dword:00000064 "CBTechniqueCoef"=dword:0000000f "CBLeftFootCoef"=dword:0000000a "CBRightFootCoef"=dword:0000000a "CBAggressionCoef"=dword:0000000f "CBAnticipationCoef"=dword:00000014 "CBBraveryCoef"=dword:00000028 "CBComposureCoef"=dword:0000001e "CBConcentrationCoef"=dword:0000001e "CBConsistencyCoef"=dword:00000014 "CBCreativityCoef"=dword:00000005 "CBDecisionsCoef"=dword:0000001e "CBDeterminationCoef"=dword:00000014 "CBDirtinessCoef"=dword:ffffffec "CBFlairCoef"=dword:00000005 "CBImportantMatchesCoef"=dword:00000014 "CBInfluenceCoef"=dword:0000000f "CBOffTheBallCoef"=dword:0000000a "CBPositioningCoef"=dword:00000050 "CBTeamworkCoef"=dword:00000028 "CBWorkRateCoef"=dword:0000000a "CBAccelerationCoef"=dword:00000023 "CBAgilityCoef"=dword:00000005 "CBBalanceCoef"=dword:00000014 "CBInjuryPronenessCoef"=dword:fffffff6 "CBJumpingCoef"=dword:00000050 "CBNaturalFitnessCoef"=dword:0000000a "CBPaceCoef"=dword:00000023 "CBStaminaCoef"=dword:00000014 "CBStrengthCoef"=dword:00000032 "CBVersatilityCoef"=dword:00000005 "CBAerialAbilityCoef"=dword:00000000 "CBCommandOfAreaCoef"=dword:00000000 "CBCommunicationCoef"=dword:00000000 "CBEccentricityCoef"=dword:00000000 "CBHandlingCoef"=dword:00000000 "CBKickingCoef"=dword:00000000 "CBOneOnOnesCoef"=dword:00000005 "CBReflexesCoef"=dword:00000005 "CBRushingOutCoef"=dword:00000000 "CBTendencyToPunchCoef"=dword:00000000 "CBThrowingCoef"=dword:00000000 "CBAdaptabilityCoef"=dword:0000000a "CBAmbitionCoef"=dword:00000014 "CBControversyCoef"=dword:fffffffb "CBLoyalityCoef"=dword:0000000a "CBPressureCoef"=dword:00000014 "CBProfessionalismCoef"=dword:0000000f "CBSportsmanshipCoef"=dword:0000000a "CBTemperamentCoef"=dword:00000005 "FBPositionCoef"=dword:00000000 "FBCurrentAbilityCoef"=dword:00000000 "FBCornersCoef"=dword:00000014 "FBCrossingCoef"=dword:00000023 "FBDribblingCoef"=dword:0000001e "FBFinishingCoef"=dword:0000000a "FBFirstTouchCoef"=dword:00000014 "FBFreeKicksCoef"=dword:00000014 "FBHeadingCoef"=dword:0000003c "FBLongShotsCoef"=dword:0000000a "FBLongThrowsCoef"=dword:0000000a "FBMarkingCoef"=dword:00000050 "FBPassingCoef"=dword:00000023 "FBPenaltiesCoef"=dword:00000005 "FBTacklingCoef"=dword:00000064 "FBTechniqueCoef"=dword:0000001e "FBLeftFootCoef"=dword:0000000a "FBRightFootCoef"=dword:0000000a "FBAggressionCoef"=dword:0000000f "FBAnticipationCoef"=dword:0000003c "FBBraveryCoef"=dword:00000019 "FBComposureCoef"=dword:00000019 "FBConcentrationCoef"=dword:0000001e "FBConsistencyCoef"=dword:00000014 "FBCreativityCoef"=dword:0000000a "FBDecisionsCoef"=dword:00000019 "FBDeterminationCoef"=dword:00000014 "FBDirtinessCoef"=dword:fffffff1 "FBFlairCoef"=dword:00000005 "FBImportantMatchesCoef"=dword:00000014 "FBInfluenceCoef"=dword:0000000f "FBOffTheBallCoef"=dword:0000000f "FBPositioningCoef"=dword:00000050 "FBTeamworkCoef"=dword:00000014 "FBWorkRateCoef"=dword:00000014 "FBAccelerationCoef"=dword:00000032 "FBAgilityCoef"=dword:00000005 "FBBalanceCoef"=dword:00000014 "FBInjuryPronenessCoef"=dword:fffffff6 "FBJumpingCoef"=dword:0000003c "FBNaturalFitnessCoef"=dword:0000000a "FBPaceCoef"=dword:00000032 &

plopus · Answer

ok reposte un hijackthis stp

danicrome · Answer

voila le nouveau rapport


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:48:39, on 22/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PVSW\Bin\WGE_SRV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Dani\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5060905
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=MQ-vaq6YtqM1DocvPPgF6YSkQOg
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\GhostSurf 2006 Platinum\SCActiveBlock.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [CTSVolFE.exe] "C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by126w.bay126.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://bellerock.microgaming.com/freeplayfrench/FlashAX2.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EBP Pervasive.SQL - Unknown owner - C:\PVSW\Bin\WGE_SRV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

plopus · Answer

relance hijackthis choisit "do a scan only" et coche les cases a gauche des lignes : O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE puis clic sur fix checked puis telecharge genproc GENPROC Ouvre ce lien d'aide < < http://www.alt-shift-return.org/Info/GenProc-HowTo.html > , et le téléchargement est dedans < http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip >. repond oui à la question à la fin et poste le rapport stp

danicrome · Answer

J'ai fait la manip et voici le rapport de genproc


Rapport GenProc 2.346 [1] - 22/01/2009 - Windows XP 
 
Dans CCleaner, clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures".
Par la suite, laisse-le avec ses réglages par défaut. C'est tout. 


# Etape 1/ Télécharge :
 
- Lop S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 (Eric 71 & Angeldark) sur ton Bureau.

- Toolbar-S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 (Team IDN) sur ton Bureau.

- MSNFix http://sosvirus.changelog.fr/MSNFix.zip (!aur3n7) et décompresse-le sur le Bureau.


 Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ ; pour retrouver le rapport, clique sur le raccourci "GenProc" sur ton bureau. Choisis ta session courante *** Dani ***  

 
# Etape 2/ 
 
 Lance Toolbar-S&D situé sur le Bureau.
 Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 3/ 
 
Lance le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le bureau.
- Exécute l'option R.
- Si l'infection est détectée, exécute l'option N.
- Sauvegarde ce rapport sur ton bureau.


# Etape 4/ 
 
 Double-clique sur Lop S&D pour lancer l'installation, séléctionne la langue souhaitée, puis choisis l'Option 2 - Suppression - et patiente jusqu'à ce qu'il ait terminé.

# Etape 5/ 
 
 Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.
 
# Etape 6/ 
 
 Redémarre normalement et poste, dans la même réponse : 
 
- Le contenu du rapport MSNfix situé sur le Bureau ; 
- Le contenu du rapport C:\TB.txt ; 
- Le contenu du rapport C:\lopR.txt ; 
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ; 

 Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.
 
____________________________________________________________________________________________________________
 
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com

plopus · Answer

fait ce qui est dit et poste les rapports

danicrome · Answer

Je n'ai pas eu de rapport pour msnfix, mais il n'a indiqué aucune infection. 


Voici le rapport de TB :


   -----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2250  @ 1.73GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A08
   USER : Dani ( Administrator )
   BOOT : Fail-safe boot
   Antivirus :   (Not Activated)
   Firewall  :   (Not Activated)
   C:\ (Local Disk) - NTFS - Total:105 Go (Free:15 Go)
   E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   G:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   H:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   I:\ (CD or DVD) - CDFS - Total:1 Go (Free:0 Go)
   J:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   X:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 22/01/2009|21:45 )

   -----------\ SUPPRESSION

   Supprime! - C:\Program Files\BitLord\BitLord.exe
   Supprime! - C:\Program Files\BitLord\BitLord.url
   Supprime! - C:\Program Files\BitLord\BitLord.xml
   Supprime! - C:\Program Files\BitLord\Downloads
   Supprime! - C:\Program Files\BitLord\Downloads.xml
   Supprime! - C:\Program Files\BitLord\lang
   Supprime! - C:\Program Files\BitLord\License.txt
   Supprime! - C:\Program Files\BitLordules
   Supprime! - C:\Program Files\BitLord\Torrents
   Supprime! - C:\Program Files\BitLord\uninst.exe
   Supprime! - C:\DOCUME~1\Dani\Bureau\BitLord.lnk
   Supprime! - C:\WINDOWS\Prefetch\BITLORD.EXE-00346D1D.pf
   Supprime! - C:\DOCUME~1\Dani\MENUDM~1\PROGRA~1\BitLord
   Supprime! - C:\Program Files\BitLord

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"
   "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"
   "Home_Page"="https://www.dell.com/fr-fr?c=fr&l=fr&s=gen&redirect=1"
   "Help_Page"="http://support.euro.dell.com/segment.asp?country=FR&language=FR"


   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TDSSserv]

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Dani\Bureau\Nouveau dossier\alcohol 120%\crack.exe
   C:\DOCUME~1\Dani\Bureau\Nouveau dossier
ero 7\keygen.exe
   C:\DOCUME~1\Dani\Bureau\Nouveau dossier
ero 7\Nero_712_KeyGen_Only-ORiON.rar
   C:\DOCUME~1\Dani\Favoris\cours de cracking
   C:\DOCUME~1\Dani\Favoris\crack wep
   C:\DOCUME~1\Dani\Favoris\cracks and serials
   C:\DOCUME~1\Dani\Favoris\I-Hacked.com Taking Advantage Of Technology - Cracking Wifi with BackTrack.url
   C:\DOCUME~1\Dani\Favoris\cours de cracking\Attila Warez Hack - E-Zines Cracking - Shmeitcorp.url
   C:\DOCUME~1\Dani\Favoris\cours de cracking\Attila Warez Hack - E-Zines Cracking.url
   C:\DOCUME~1\Dani\Favoris\crack wep\Tuto fr tutoriaux francophone.url
   C:\DOCUME~1\Dani\Favoris\cracks and serials\Serials & keys - unlocks the world.url
   C:\DOCUME~1\Dani\Favoris\hacking\aircrack ptw — la mont pagnotte familly.url
   C:\DOCUME~1\Dani\Favoris\hacking\aircrack ptw.url
   C:\DOCUME~1\Dani\Favoris\hacking\Aircrack-ng, aireplay-ng, airodump-ng, Tutorial crack cle wep.url
   C:\DOCUME~1\Dani\Favoris\hacking\AIRCRACK-PTW le wifi debian linux download aircrack-ptw,telecharger aircrack-ptw, airodump, aireplay (suite aircrack-ng).url
   C:\DOCUME~1\Dani\Favoris\hacking\Crackpark.org - Votre portail d’infomations sur le thème cracks serials. Ce site est en vente!.url
   C:\DOCUME~1\Dani\Mes documents\EBP.Comptes.Bancaires.2006.v6.0.1.34.FR.Incl-Crack.rar
   C:\DOCUME~1\Dani\Mes documents\guitare\Guitar Pro 5.2 (Win)\Keygen.exe
   C:\DOCUME~1\Dani\Mes documents\guitare\Tablature\F\Faith No More - Crack Hitler.gp3
   C:\DOCUME~1\Dani\Mes documents\guitare\Tablature\L\Limp Bizkit - Crack Addict.gp4
   C:\DOCUME~1\Dani\Mes documents\guitare\Tablature\P\Pixies - Crackity Jones.gp3
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\AsianDynasties
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD1
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD2
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD3
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Lisez-Moi.txt
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\WarChiefs
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\AsianDynasties\AsianDinasties.iso
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD1\AOE III DISC 1.iso
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD2\AOE III DISC 2.bin
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD2\AOE III DISC 2.cue
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD3\AOE III DISC 3.bin
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD3\AOE III DISC 3.cue
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AoE III Cd Keys.txt
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_AsianDynasties
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_WarChiefs
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.105.919.3236
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.107.803.3365
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.105.919.3236\age3.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.105.919.3236\Lisez-moi.txt
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.107.803.3365\age3.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.107.803.3365\Lisez-moi.txt
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_AsianDynasties\age3y.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_WarChiefs\age3x.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_WarChiefs\mgspidx.dll
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\WarChiefs\WarChiefs.iso
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Football Manager 2008 (PC) + crack
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED.rar
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED\fm.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED\hatred.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Football Manager 2008 (PC) + crack\fm.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD1.daa
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD2.daa
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD3.daa
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD4.daa
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS.txt
   C:\DOCUME~1\Dani\Mes documents\Ma musique\HIP HOP\Kanye West - Late Registration (2005) - Rap [www.torrentazos.com]\08. Kanye West - Crack Music (ft.The Game) - www.torrentazos.com.mp3
   C:\DOCUME~1\Dani\Mes documents\Ma musique\Rap français - albums\Alibi Montana - T'as Ma Parole\02. Le Monde A Crack'.mp3
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0.tar.gz
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw.exe
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw_win32.rar
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR
   C:\DOCUME~1\Dani\Mes documents\programmes\acd see\Crack
   C:\DOCUME~1\Dani\Mes documents\programmes\acd see\Crack\FFF.NFO
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\aircrack-ptw-lib.c
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\aircrack-ptw-lib.h
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\aircrack-ptw.c
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\attacksim.c
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\Makefile
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\README
   C:\DOCUME~1\Dani\Mes documents\programmes\src\aircrack-ptw-lib.c
   C:\DOCUME~1\Dani\Mes documents\programmes\src\aircrack-ptw-lib.h
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Keygen
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Patch FR
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\winamp531_pro.exe
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Keygen\KeyMaker.exe
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Patch FR\french_translated.exe



   1 - "C:\ToolBar SD\TB_1.txt" - 22/01/2009|21:50 - Option : [2]

   -----------\  Fin du rapport a 21:50:01,56


Le rapport de lopR :



   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2250  @ 1.73GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A08
   USER : Dani ( Administrator )
   BOOT : Fail-safe boot
   Antivirus :   (Not Activated)
   Firewall  :   (Not Activated)
   C:\ (Local Disk) - NTFS - Total:105 Go (Free:15 Go)
   E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   G:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   H:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   I:\ (CD or DVD) - CDFS - Total:1 Go (Free:0 Go)
   J:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   X:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 22/01/2009|21:54 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\Program Files\Circle Developement
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [05/09/2006|18:00] C:\DOCUME~1\ADMINI~1\APPLIC~1\ATI
   [05/09/2006|17:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\Corel
   [15/09/2008|22:18] C:\DOCUME~1\ADMINI~1\APPLIC~1\Grisoft
   [14/09/2006|21:01] C:\DOCUME~1\ADMINI~1\APPLIC~1\GTek
   [01/09/2005|06:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [05/09/2006|17:49] C:\DOCUME~1\ADMINI~1\APPLIC~1\Intel
   [15/09/2008|21:41] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [05/09/2006|17:56] C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec

   [29/09/2008|15:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{4F0BAFD2-4250-4D62-9237-E4C5E88071D9}
   [29/09/2008|15:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{B33CBE2B-A739-401D-A5E0-041195C4A17B}
   [05/09/2006|17:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [08/10/2008|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Age of Empires 3
   [28/07/2007|16:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [28/07/2007|16:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [29/09/2008|15:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EBP
   [20/01/2009|20:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [06/07/2007|21:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
   [16/12/2007|17:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [05/09/2006|17:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [05/09/2006|17:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intel
   [16/09/2008|17:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [05/09/2006|17:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
   [05/09/2006|17:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
   [14/09/2006|19:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com Personal Firewall
   [21/09/2008|22:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [18/08/2008|18:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MGS
   [18/08/2008|17:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microgaming
   [02/06/2008|02:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [10/12/2008|03:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [09/09/2006|11:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Otto
   [05/09/2006|17:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [18/09/2007|00:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Tenebril
   [25/12/2007|13:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
   [23/12/2006|11:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [17/10/2007|17:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!

   [11/02/2007|22:13] C:\DOCUME~1\Dani\APPLIC~1\ACD Systems
   [10/02/2008|15:57] C:\DOCUME~1\Dani\APPLIC~1\Adobe
   [25/09/2006|20:51] C:\DOCUME~1\Dani\APPLIC~1\AdobeUM
   [21/05/2007|19:59] C:\DOCUME~1\Dani\APPLIC~1\Ahead
   [28/07/2007|16:21] C:\DOCUME~1\Dani\APPLIC~1\Apple Computer
   [05/09/2006|18:00] C:\DOCUME~1\Dani\APPLIC~1\ATI
   [18/10/2006|21:04] C:\DOCUME~1\Dani\APPLIC~1\Corel Photo Album
   [29/09/2008|15:16] C:\DOCUME~1\Dani\APPLIC~1\EBP
   [10/01/2007|18:39] C:\DOCUME~1\Dani\APPLIC~1\FotoWire
   [31/10/2006|23:10] C:\DOCUME~1\Dani\APPLIC~1\Google
   [06/07/2007|21:52] C:\DOCUME~1\Dani\APPLIC~1\Grisoft
   [14/09/2006|21:01] C:\DOCUME~1\Dani\APPLIC~1\Gtek
   [16/12/2007|16:44] C:\DOCUME~1\Dani\APPLIC~1\HP
   [17/09/2007|00:52] C:\DOCUME~1\Dani\APPLIC~1\ICQ
   [01/09/2005|06:25] C:\DOCUME~1\Dani\APPLIC~1\Identities
   [17/09/2007|00:45] C:\DOCUME~1\Dani\APPLIC~1\InstallShield
   [05/09/2006|17:49] C:\DOCUME~1\Dani\APPLIC~1\Intel
   [18/12/2006|19:15] C:\DOCUME~1\Dani\APPLIC~1\Leadertech
   [14/09/2006|20:14] C:\DOCUME~1\Dani\APPLIC~1\Macromedia
   [16/09/2008|17:56] C:\DOCUME~1\Dani\APPLIC~1\Malwarebytes
   [08/09/2006|18:39] C:\DOCUME~1\Dani\APPLIC~1\McAfee.com Personal Firewall
   [06/02/2008|22:38] C:\DOCUME~1\Dani\APPLIC~1\Microsoft
   [28/08/2008|17:26] C:\DOCUME~1\Dani\APPLIC~1\Mozilla
   [11/10/2008|17:36] C:\DOCUME~1\Dani\APPLIC~1\My Games
   [09/09/2006|11:06] C:\DOCUME~1\Dani\APPLIC~1\Otto
   [17/09/2007|20:11] C:\DOCUME~1\Dani\APPLIC~1\Samsung
   [25/06/2007|14:29] C:\DOCUME~1\Dani\APPLIC~1\Screenshot Sender
   [26/07/2008|12:26] C:\DOCUME~1\Dani\APPLIC~1\SecuROM
   [18/12/2006|19:15] C:\DOCUME~1\Dani\APPLIC~1\Sonic
   [23/12/2007|14:53] C:\DOCUME~1\Dani\APPLIC~1\Sports Interactive
   [29/10/2006|19:14] C:\DOCUME~1\Dani\APPLIC~1\Sun
   [05/09/2006|17:56] C:\DOCUME~1\Dani\APPLIC~1\Symantec
   [26/10/2007|11:53] C:\DOCUME~1\Dani\APPLIC~1\Talkback
   [28/10/2006|15:37] C:\DOCUME~1\Dani\APPLIC~1\Winamp
   [21/11/2008|22:39] C:\DOCUME~1\Dani\APPLIC~1\X-Projects

   [05/09/2006|18:00] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
   [05/09/2006|17:53] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Corel
   [14/09/2006|21:01] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Gtek
   [01/09/2005|06:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [05/09/2006|17:49] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intel
   [05/09/2006|17:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [05/09/2006|17:56] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec

   [09/09/2006|10:40] C:\DOCUME~1\LOCALS~1\APPLIC~1\McAfee.com Personal Firewall
   [01/09/2005|06:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [09/09/2006|11:16] C:\DOCUME~1\NETWOR~1\APPLIC~1\Intel
   [18/09/2007|00:04] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [05/09/2006|18:00] C:\DOCUME~1\Suzy\APPLIC~1\ATI
   [05/09/2006|17:53] C:\DOCUME~1\Suzy\APPLIC~1\Corel
   [01/11/2006|16:46] C:\DOCUME~1\Suzy\APPLIC~1\Google
   [22/04/2008|20:29] C:\DOCUME~1\Suzy\APPLIC~1\Grisoft
   [14/09/2006|21:01] C:\DOCUME~1\Suzy\APPLIC~1\Gtek
   [01/09/2005|06:25] C:\DOCUME~1\Suzy\APPLIC~1\Identities
   [05/09/2006|17:49] C:\DOCUME~1\Suzy\APPLIC~1\Intel
   [14/09/2006|19:18] C:\DOCUME~1\Suzy\APPLIC~1\Macromedia
   [09/09/2006|11:16] C:\DOCUME~1\Suzy\APPLIC~1\McAfee.com Personal Firewall
   [29/11/2006|20:50] C:\DOCUME~1\Suzy\APPLIC~1\Microsoft
   [29/10/2006|14:36] C:\DOCUME~1\Suzy\APPLIC~1\Sun
   [05/09/2006|17:56] C:\DOCUME~1\Suzy\APPLIC~1\Symantec
   [22/04/2008|20:29] C:\DOCUME~1\Suzy\APPLIC~1\Tenebril
   [01/06/2007|18:53] C:\DOCUME~1\Suzy\APPLIC~1\Winamp
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [17/01/2009 22:23][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [22/01/2009 21:34][--ah-----] C:\WINDOWS	asks\SA.DAT
   [10/08/2004 12:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [05/09/2006|17:50] C:\Program Files\Adobe
   [09/09/2006|23:36] C:\Program Files\alcohol 120
   [09/09/2006|23:37] C:\Program Files\Alcohol Soft
   [14/09/2006|19:52] C:\Program Files\Alwil Software
   [13/09/2007|22:15] C:\Program Files\Apple Software Update
   [05/09/2006|17:47] C:\Program Files\ATI Technologies
   [30/07/2007|22:50] C:\Program Files\Automate unDRM
   [30/07/2008|23:47] C:\Program Files\BAE
   [05/09/2006|17:47] C:\Program Files\Broadcom
   [10/01/2009|01:40] C:\Program Files\bwin
   [18/06/2007|18:16] C:\Program Files\CamStudio
   [07/07/2007|08:17] C:\Program Files\CCleaner
   [03/07/2007|19:16] C:\Program Files\CEDP Stealer 6.0 for Messenger
   [28/10/2006|16:19] C:\Program Files\Cole2k Media Toolbar
   [01/09/2005|06:13] C:\Program Files\ComPlus Applications
   [05/09/2006|17:44] C:\Program Files\CONEXANT
   [18/10/2006|21:11] C:\Program Files\Corel
   [05/09/2006|17:52] C:\Program Files\Corel Corporation
   [05/09/2006|17:49] C:\Program Files\Creative
   [05/09/2006|17:49] C:\Program Files\CyberLink
   [05/09/2006|17:47] C:\Program Files\Dell
   [13/06/2007|18:53] C:\Program Files\Dial-Messenger
   [05/09/2006|17:48] C:\Program Files\Digital Line Detect
   [10/01/2007|18:41] C:\Program Files\directx
   [10/04/2007|20:09] C:\Program Files\eBay
   [29/09/2008|15:15] C:\Program Files\EBP
   [05/01/2009|01:53] C:\Program Files\eMule
   [13/01/2009|22:31] C:\Program Files\Everest Poker
   [01/11/2006|16:26] C:\Program Files\FairUse Wizard 2
   [22/01/2009|20:25] C:\Program Files\Fichiers communs
   [11/11/2007|12:39] C:\Program Files\Firaxis Games
   [04/01/2008|21:18] C:\Program Files\FM Modifier 2.2
   [01/11/2006|16:28] C:\Program Files\Free Audio Pack
   [13/01/2009|22:30] C:\Program Files\Full Tilt Poker
   [01/09/2005|06:27] C:\Program Files\GemMasterFrench
   [17/09/2007|23:54] C:\Program Files\GhostSurf 2006 Platinum
   [20/01/2009|20:54] C:\Program Files\Google
   [06/07/2007|21:52] C:\Program Files\Grisoft
   [10/11/2008|15:57] C:\Program Files\Guitar Pro 5
   [16/12/2007|17:02] C:\Program Files\Hewlett-Packard
   [16/12/2007|17:05] C:\Program Files\HP
   [17/09/2007|00:52] C:\Program Files\ICQ6
   [28/10/2006|16:22] C:\Program Files\Illustrate
   [10/01/2009|02:32] C:\Program Files\InstallShield Installation Information
   [05/09/2006|17:48] C:\Program Files\Intel
   [05/09/2006|17:49] C:\Program Files\Intel, Inc
   [10/12/2008|03:08] C:\Program Files\Internet Explorer
   [10/01/2009|01:49] C:\Program Files\Java
   [10/01/2007|18:39] C:\Program Files\Logitech
   [21/01/2009|20:06] C:\Program Files\Malwarebytes' Anti-Malware
   [23/07/2008|21:00] C:\Program Files\Maxis
   [24/11/2008|18:33] C:\Program Files\Messenger
   [14/08/2008|21:15] C:\Program Files\Messenger Plus! Live
   [18/06/2007|18:21] C:\Program Files\MessengerDiscovery
   [14/02/2008|22:34] C:\Program Files\Microsoft ActiveSync
   [07/02/2008|19:18] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [01/09/2005|06:18] C:\Program Files\microsoft frontpage
   [08/10/2008|21:23] C:\Program Files\Microsoft Games
   [25/12/2007|12:37] C:\Program Files\Microsoft Office
   [10/07/2008|02:07] C:\Program Files\Microsoft SQL Server
   [25/12/2007|14:58] C:\Program Files\Microsoft Visual Studio
   [17/09/2007|23:59] C:\Program Files\Microsoft Visual Studio 8
   [10/09/2008|22:22] C:\Program Files\Microsoft Works
   [17/09/2007|23:54] C:\Program Files\Microsoft.NET
   [05/09/2006|17:48] C:\Program Files\Modem Helper
   [24/11/2008|18:26] C:\Program Files\Movie Maker
   [22/01/2009|21:51] C:\Program Files\Mozilla Firefox
   [29/10/2007|14:04] C:\Program Files\mozilla.org
   [01/09/2005|06:12] C:\Program Files\MSN
   [01/09/2005|06:12] C:\Program Files\MSN Gaming Zone
   [25/11/2008|19:02] C:\Program Files\MSN Messenger
   [04/02/2007|23:30] C:\Program Files\MSN Reaper
   [17/11/2006|20:05] C:\Program Files\MSXML 4.0
   [18/09/2007|00:03] C:\Program Files\MSXML 6.0
   [11/04/2007|22:01] C:\Program Files
erazzurri.net
   [21/05/2007|19:37] C:\Program Files\Nero
   [24/11/2008|18:22] C:\Program Files\NetMeeting
   [05/09/2006|17:48] C:\Program Files\NetWaiting
   [17/09/2007|01:35] C:\Program Files\No-IP
   [01/09/2005|06:13] C:\Program Files\Online Services
   [24/11/2008|18:22] C:\Program Files\Outlook Express
   [15/10/2006|20:07] C:\Program Files\Phantom EFX
   [06/02/2008|22:41] C:\Program Files\PhotoFiltre
   [29/10/2008|00:03] C:\Program Files\Picasa2
   [14/01/2008|21:15] C:\Program Files\Plaxo
   [23/07/2008|19:14] C:\Program Files\Pollux Gamelabs
   [09/09/2006|23:24] C:\Program Files\PowerArchiver
   [07/04/2008|14:44] C:\Program Files\QuickTime
   [10/01/2007|18:38] C:\Program Files\Real
   [07/07/2007|08:14] C:\Program Files\RegCleaner
   [17/09/2007|20:05] C:\Program Files\Samsung
   [01/07/2008|23:07] C:\Program Files\Secrets du Jeu
   [10/05/2008|12:27] C:\Program Files\SEGA
   [01/09/2005|06:15] C:\Program Files\Services en ligne
   [05/09/2006|17:44] C:\Program Files\Sigmatel
   [28/10/2006|16:10] C:\Program Files\SLD Codec Pack
   [05/09/2006|17:51] C:\Program Files\Sonic
   [23/12/2007|14:52] C:\Program Files\Sports Interactive
   [11/09/2007|22:11] C:\Program Files\SuperScan
   [05/09/2006|17:56] C:\Program Files\Symantec
   [05/09/2006|17:46] C:\Program Files\Synaptics
   [11/09/2007|19:15] C:\Program Files\The Cleaner
   [31/12/2007|17:33] C:\Program Files\TomTom HOME
   [01/09/2005|06:25] C:\Program Files\Uninstall Information
   [17/12/2006|20:44] C:\Program Files\VideoEgg
   [05/10/2006|21:30] C:\Program Files\VideoLAN
   [10/01/2009|02:19] C:\Program Files\WinamaxPoker
   [28/10/2006|15:37] C:\Program Files\Winamp
   [10/06/2007|21:57] C:\Program Files\Windows Live
   [27/10/2008|23:14] C:\Program Files\Windows Live Safety Center
   [10/01/2007|18:38] C:\Program Files\Windows Media Components
   [31/12/2007|13:48] C:\Program Files\Windows Media Connect 2
   [24/11/2008|18:22] C:\Program Files\Windows Media Player
   [24/11/2008|18:22] C:\Program Files\Windows NT
   [01/09/2005|06:12] C:\Program Files\Windows Plus
   [01/09/2005|06:15] C:\Program Files\WindowsUpdate
   [01/09/2005|06:18] C:\Program Files\xerox
   [17/10/2007|17:23] C:\Program Files\Yahoo!
   [23/12/2007|12:24] C:\Program Files\Zero G Registry

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [21/10/2007|19:36] C:\Program Files\Fichiers communs\ACD Systems
   [05/09/2006|17:50] C:\Program Files\Fichiers communs\Adobe
   [21/05/2007|19:39] C:\Program Files\Fichiers communs\Ahead
   [28/07/2007|16:19] C:\Program Files\Fichiers communs\Apple
   [29/09/2008|15:15] C:\Program Files\Fichiers communs\Borland Shared
   [25/12/2007|14:58] C:\Program Files\Fichiers communs\DESIGNER
   [29/09/2008|15:15] C:\Program Files\Fichiers communs\EBP
   [10/01/2007|18:39] C:\Program Files\Fichiers communs\FotoWire
   [16/12/2007|17:01] C:\Program Files\Fichiers communs\Hewlett-Packard
   [16/12/2007|17:05] C:\Program Files\Fichiers communs\HP
   [24/11/2006|23:12] C:\Program Files\Fichiers communs\InstallShield
   [05/09/2006|17:39] C:\Program Files\Fichiers communs\Java
   [10/01/2007|18:40] C:\Program Files\Fichiers communs\Logitech
   [08/10/2008|21:50] C:\Program Files\Fichiers communs\Microsoft Games
   [28/08/2008|23:11] C:\Program Files\Fichiers communs\Microsoft Shared
   [01/09/2005|06:15] C:\Program Files\Fichiers communs\MSSoap
   [01/09/2005|06:08] C:\Program Files\Fichiers communs\ODBC
   [10/01/2007|18:38] C:\Program Files\Fichiers communs\Real
   [01/09/2005|06:15] C:\Program Files\Fichiers communs\Services
   [05/09/2006|17:51] C:\Program Files\Fichiers communs\Sonic Shared
   [01/09/2005|06:08] C:\Program Files\Fichiers communs\SpeechEngines
   [24/09/2006|19:43] C:\Program Files\Fichiers communs\Symantec Shared
   [24/11/2008|18:22] C:\Program Files\Fichiers communs\System
   [05/09/2006|17:50] C:\Program Files\Fichiers communs\TiVo Shared

   --------------------\  Process

   ( 16 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-01-22 21:56:24
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 99
 
   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TDSSserv]

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Dani\Bureau\Nouveau dossier\alcohol 120%\crack.exe
   C:\DOCUME~1\Dani\Bureau\Nouveau dossier
ero 7\keygen.exe
   C:\DOCUME~1\Dani\Bureau\Nouveau dossier
ero 7\Nero_712_KeyGen_Only-ORiON.rar
   C:\DOCUME~1\Dani\Favoris\cours de cracking
   C:\DOCUME~1\Dani\Favoris\crack wep
   C:\DOCUME~1\Dani\Favoris\cracks and serials
   C:\DOCUME~1\Dani\Favoris\I-Hacked.com Taking Advantage Of Technology - Cracking Wifi with BackTrack.url
   C:\DOCUME~1\Dani\Favoris\cours de cracking\Attila Warez Hack - E-Zines Cracking - Shmeitcorp.url
   C:\DOCUME~1\Dani\Favoris\cours de cracking\Attila Warez Hack - E-Zines Cracking.url
   C:\DOCUME~1\Dani\Favoris\crack wep\Tuto fr tutoriaux francophone.url
   C:\DOCUME~1\Dani\Favoris\cracks and serials\Serials & keys - unlocks the world.url
   C:\DOCUME~1\Dani\Favoris\hacking\aircrack ptw — la mont pagnotte familly.url
   C:\DOCUME~1\Dani\Favoris\hacking\aircrack ptw.url
   C:\DOCUME~1\Dani\Favoris\hacking\Aircrack-ng, aireplay-ng, airodump-ng, Tutorial crack cle wep.url
   C:\DOCUME~1\Dani\Favoris\hacking\AIRCRACK-PTW le wifi debian linux download aircrack-ptw,telecharger aircrack-ptw, airodump, aireplay (suite aircrack-ng).url
   C:\DOCUME~1\Dani\Favoris\hacking\Crackpark.org - Votre portail d’infomations sur le thème cracks serials. Ce site est en vente!.url
   C:\DOCUME~1\Dani\Mes documents\EBP.Comptes.Bancaires.2006.v6.0.1.34.FR.Incl-Crack.rar
   C:\DOCUME~1\Dani\Mes documents\guitare\Guitar Pro 5.2 (Win)\Keygen.exe
   C:\DOCUME~1\Dani\Mes documents\guitare\Tablature\F\Faith No More - Crack Hitler.gp3
   C:\DOCUME~1\Dani\Mes documents\guitare\Tablature\L\Limp Bizkit - Crack Addict.gp4
   C:\DOCUME~1\Dani\Mes documents\guitare\Tablature\P\Pixies - Crackity Jones.gp3
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\AsianDynasties
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD1
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD2
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD3
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Lisez-Moi.txt
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\WarChiefs
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\AsianDynasties\AsianDinasties.iso
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD1\AOE III DISC 1.iso
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD2\AOE III DISC 2.bin
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD2\AOE III DISC 2.cue
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD3\AOE III DISC 3.bin
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD3\AOE III DISC 3.cue
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AoE III Cd Keys.txt
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_AsianDynasties
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_WarChiefs
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.105.919.3236
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.107.803.3365
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.105.919.3236\age3.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.105.919.3236\Lisez-moi.txt
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.107.803.3365\age3.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.107.803.3365\Lisez-moi.txt
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_AsianDynasties\age3y.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_WarChiefs\age3x.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_WarChiefs\mgspidx.dll
   C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\WarChiefs\WarChiefs.iso
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Football Manager 2008 (PC) + crack
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED.rar
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED\fm.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED\hatred.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Football Manager 2008 (PC) + crack\fm.exe
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD1.daa
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD2.daa
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD3.daa
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD4.daa
   C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS.txt
   C:\DOCUME~1\Dani\Mes documents\Ma musique\HIP HOP\Kanye West - Late Registration (2005) - Rap [www.torrentazos.com]\08. Kanye West - Crack Music (ft.The Game) - www.torrentazos.com.mp3
   C:\DOCUME~1\Dani\Mes documents\Ma musique\Rap français - albums\Alibi Montana - T'as Ma Parole\02. Le Monde A Crack'.mp3
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0.tar.gz
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw.exe
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw_win32.rar
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR
   C:\DOCUME~1\Dani\Mes documents\programmes\acd see\Crack
   C:\DOCUME~1\Dani\Mes documents\programmes\acd see\Crack\FFF.NFO
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\aircrack-ptw-lib.c
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\aircrack-ptw-lib.h
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\aircrack-ptw.c
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\attacksim.c
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\Makefile
   C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\README
   C:\DOCUME~1\Dani\Mes documents\programmes\src\aircrack-ptw-lib.c
   C:\DOCUME~1\Dani\Mes documents\programmes\src\aircrack-ptw-lib.h
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Keygen
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Patch FR
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\winamp531_pro.exe
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Keygen\KeyMaker.exe
   C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Patch FR\french_translated.exe


   [F:6][D:3]-> C:\DOCUME~1\Dani\LOCALS~1\Temp
   [F:23][D:0]-> C:\DOCUME~1\Dani\Cookies
   [F:63][D:4]-> C:\DOCUME~1\Dani\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 22/01/2009|21:58 - Option : [2]

   --------------------\  Fin du rapport a 21:58:02


et le rapport de hijackthis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:07:45, on 22/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PVSW\Bin\WGE_SRV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Dani\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5060905
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=MQ-vaq6YtqM1DocvPPgF6YSkQOg
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\GhostSurf 2006 Platinum\SCActiveBlock.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [CTSVolFE.exe] "C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by126w.bay126.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://bellerock.microgaming.com/freeplayfrench/FlashAX2.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EBP Pervasive.SQL - Unknown owner - C:\PVSW\Bin\WGE_SRV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

plopus · Answer

re

supprime tout sa des fichiers et autres bizarre:

C:\DOCUME~1\Dani\Bureau\Nouveau dossier\alcohol 120%\crack.exe
C:\DOCUME~1\Dani\Bureau\Nouveau dossier
ero 7\keygen.exe
C:\DOCUME~1\Dani\Bureau\Nouveau dossier
ero 7\Nero_712_KeyGen_Only-ORiON.rar
C:\DOCUME~1\Dani\Favoris\cours de cracking
C:\DOCUME~1\Dani\Favoris\crack wep
C:\DOCUME~1\Dani\Favoris\cracks and serials
C:\DOCUME~1\Dani\Favoris\I-Hacked.com Taking Advantage Of Technology - Cracking Wifi with BackTrack.url
C:\DOCUME~1\Dani\Favoris\cours de cracking\Attila Warez Hack - E-Zines Cracking - Shmeitcorp.url
C:\DOCUME~1\Dani\Favoris\cours de cracking\Attila Warez Hack - E-Zines Cracking.url
C:\DOCUME~1\Dani\Favoris\crack wep\Tuto fr tutoriaux francophone.url
C:\DOCUME~1\Dani\Favoris\cracks and serials\Serials & keys - unlocks the world.url
C:\DOCUME~1\Dani\Favoris\hacking\aircrack ptw — la mont pagnotte familly.url
C:\DOCUME~1\Dani\Favoris\hacking\aircrack ptw.url
C:\DOCUME~1\Dani\Favoris\hacking\Aircrack-ng, aireplay-ng, airodump-ng, Tutorial crack cle wep.url
C:\DOCUME~1\Dani\Favoris\hacking\AIRCRACK-PTW le wifi debian linux download aircrack-ptw,telecharger aircrack-ptw, airodump, aireplay (suite aircrack-ng).url
C:\DOCUME~1\Dani\Favoris\hacking\Crackpark.org - Votre portail d’infomations sur le thème cracks serials. Ce site est en vente!.url
C:\DOCUME~1\Dani\Mes documents\EBP.Comptes.Bancaires.2006.v6.0.1.34.FR.Incl-Crack.rar
C:\DOCUME~1\Dani\Mes documents\guitare\Guitar Pro 5.2 (Win)\Keygen.exe
C:\DOCUME~1\Dani\Mes documents\guitare\Tablature\F\Faith No More - Crack Hitler.gp3
C:\DOCUME~1\Dani\Mes documents\guitare\Tablature\L\Limp Bizkit - Crack Addict.gp4
C:\DOCUME~1\Dani\Mes documents\guitare\Tablature\P\Pixies - Crackity Jones.gp3
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys
C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\AsianDynasties
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD1
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD2
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD3
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Lisez-Moi.txt
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\WarChiefs
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\AsianDynasties\AsianDinasties.iso
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD1\AOE III DISC 1.iso
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD2\AOE III DISC 2.bin
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD2\AOE III DISC 2.cue
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD3\AOE III DISC 3.bin
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\CD3\AOE III DISC 3.cue
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AoE III Cd Keys.txt
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_AsianDynasties
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_WarChiefs
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.105.919.3236
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.107.803.3365
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.105.919.3236\age3.exe
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.105.919.3236\Lisez-moi.txt
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.107.803.3365\age3.exe
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\AgeOfEmpiresIII_NoCD\age3.exe v4.107.803.3365\Lisez-moi.txt
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_AsianDynasties\age3y.exe
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_WarChiefs\age3x.exe
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\Crack and keys Age Of Empires III + Warchiefs & Asian Expansion\CRACK_NoCD_WarChiefs\mgspidx.dll
C:\DOCUME~1\Dani\Mes documents\jeux\AGE.OF.EMPIRES.III.FRENCH+Warchieps+AsianDynasties+Crack+Keys\WarChiefs\WarChiefs.iso
C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Football Manager 2008 (PC) + crack
C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK
C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED
C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED.rar
C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED\fm.exe
C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Fm2008\Football Manager 2008 - CRACK\HATRED\hatred.exe
C:\DOCUME~1\Dani\Mes documents\jeux\FM 2008\Football Manager 2008 (PC) + crack\fm.exe
C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD1.daa
C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD2.daa
C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD3.daa
C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS CD4.daa
C:\DOCUME~1\Dani\Mes documents\jeux\RISE.OF.NATIONS.RISE.OF.LEGENDS-NoCd Crack\RISE.OF.NATIONS.RISE.OF.LEGENDS.txt
C:\DOCUME~1\Dani\Mes documents\Ma musique\HIP HOP\Kanye West - Late Registration (2005) - Rap [www.torrentazos.com]\08. Kanye West - Crack Music (ft.The Game) - www.torrentazos.com.mp3
C:\DOCUME~1\Dani\Mes documents\Ma musique\Rap français - albums\Alibi Montana - T'as Ma Parole\02. Le Monde A Crack'.mp3
C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0
C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0.tar.gz
C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw.exe
C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw_win32.rar
C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR
C:\DOCUME~1\Dani\Mes documents\programmes\acd see\Crack
C:\DOCUME~1\Dani\Mes documents\programmes\acd see\Crack\FFF.NFO
C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\aircrack-ptw-lib.c
C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\aircrack-ptw-lib.h
C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\aircrack-ptw.c
C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\attacksim.c
C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\Makefile
C:\DOCUME~1\Dani\Mes documents\programmes\aircrack-ptw-1.0.0\README
C:\DOCUME~1\Dani\Mes documents\programmes\src\aircrack-ptw-lib.c
C:\DOCUME~1\Dani\Mes documents\programmes\src\aircrack-ptw-lib.h
C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Keygen
C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Patch FR
C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\winamp531_pro.exe
C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Keygen\KeyMaker.exe
C:\DOCUME~1\Dani\Mes documents\programmes\WinAmp.Pro.v5.3.1.Incl-Keygen.et.Patch.FR\Patch FR\french_translated.exe 


puis fait SDfix et poste le rapport tu as le telechargement et le tuto dans ce lien
https://www.malekal.com/slenfbot-still-an-other-irc-bot/

Lit bien l'explication et poste le rapport puis après reposte un hijackthis

danicrome · Answer

Rapport SDFIX :



[b]SDFix: Version 1.240 [/b]
Run by Dani on 22/01/2009 at 23:04

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-22 23:30:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\000272b36fad]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40]
"ujdew"=hex:20,02,00,00,3b,1a,bb,6b,c9,27,97,e7,07,7a,1b,db,01,0a,46,3a,43,..
"ljej40"=hex:75,1f,4c,e0,a8,27,0d,af,e6,46,51,4e,d7,4e,b6,ab,75,3b,95,67,fc,..
"ljej41"=hex:89,1f,4c,e0,d0,27,0d,af,e7,46,50,4e,d6,4e,b6,ab,75,3b,95,67,4c,..
"ljej42"=hex:89,1f,4c,e0,d0,27,0d,af,e7,46,50,4e,d6,4e,b6,ab,75,3b,95,67,4c,..
"ljej43"=hex:89,1f,4c,e0,d0,27,0d,af,e7,46,50,4e,d6,4e,b6,ab,75,3b,95,67,4c,..
"ljej44"=hex:89,1f,4c,e0,d0,27,0d,af,e7,46,50,4e,d6,4e,b6,ab,75,3b,95,67,4c,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg41]
"ujdew"=hex:20,02,00,00,3b,1a,bb,6b,4f,ba,59,22,07,7a,1b,db,cb,1a,46,3a,43,..
"ljej40"=hex:73,1e,4c,e0,b8,26,0d,af,e6,46,51,4e,d7,4e,b6,ab,75,3b,95,67,c2,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg42]
"ujdew"=hex:20,02,00,00,3b,1a,bb,6b,cd,34,6a,7c,07,7a,1b,db,cb,1a,46,3a,43,..
"ljej40"=hex:73,1e,4c,e0,b8,26,0d,af,e6,46,51,4e,d7,4e,b6,ab,75,3b,95,67,a0,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg43]
"ujdew"=hex:20,02,00,00,3b,1a,bb,6b,97,3e,78,09,07,7a,1b,db,23,0a,46,3a,43,..
"ljej40"=hex:57,1f,4c,e0,a8,27,0d,af,e6,46,51,4e,d7,4e,b6,ab,75,3b,95,67,2f,..
"ljej41"=hex:89,1f,4c,e0,d0,27,0d,af,e7,46,50,4e,d6,4e,b6,ab,75,3b,95,67,4c,..
"ljej42"=hex:89,1f,4c,e0,d0,27,0d,af,e7,46,50,4e,d6,4e,b6,ab,75,3b,95,67,4c,..
"ljej43"=hex:89,1f,4c,e0,d0,27,0d,af,e7,46,50,4e,d6,4e,b6,ab,75,3b,95,67,4c,..
"ljej44"=hex:89,1f,4c,e0,d0,27,0d,af,e7,46,50,4e,d6,4e,b6,ab,75,3b,95,67,4c,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg44]
"ujdew"=hex:20,02,00,00,2c,1a,bb,6b,60,2b,41,88,7c,2e,af,8b,73,91,eb,01,4c,..
"ljej40"=hex:cb,a1,e9,d8,c3,72,b9,ff,4b,cd,fc,75,d8,cc,ac,86,e0,3a,f6,03,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000272b36fad]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\000272b36fad]

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"DisplayName"="Alcohol 120% (Trial Version)"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000209

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Python25\pythonw.exe"="C:\Python25\pythonw.exe:*:Enabled:pythonw"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe"="C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe:*:Enabled:Football Manager 2008"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\PVSW\Bin\w3dbsmgr.exe"="C:\PVSW\Bin\w3dbsmgr.exe:*:Enabled:Database Service Manager"
"C:\Program Files\EBP\Paye13.0\WinPaye.exe"="C:\Program Files\EBP\Paye13.0\WinPaye.exe:*:Enabled:Paye"
"C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe"="C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
"C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe"="C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe:*:Enabled:Sid Meier's Civilization 4 Warlords"
"C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords_PitBoss.exe"="C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords_PitBoss.exe:*:Enabled:Sid Meier's Civilization 4 Pitboss"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Alwil Software\Avast4\ashServ.exe"="C:\Program Files\Alwil Software\Avast4\ashServ.exe:*:Enabled:ashServ"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\PVSW\Bin\w3dbsmgr.exe"="C:\PVSW\Bin\w3dbsmgr.exe:*:Enabled:Database Service Manager"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Tue 28 Oct 2008     6,108,728 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Wed 18 Oct 2006            88 ..SHR --- "C:\WINDOWS\system32\0DB961A707.sys"
Tue 13 Jan 2009     1,334,171 ..SH. --- "C:\WINDOWS\system32\ivumises.tmp"
Wed 18 Oct 2006         3,766 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Wed 21 Jan 2009         2,724 ..SH. --- "C:\WINDOWS\system32\zunubodu.exe"
Sat  9 Sep 2006         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed  9 Jan 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Sat  9 Sep 2006         4,348 A.SH. --- "C:\Documents and Settings\Dani\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Sun 22 Jul 2007        11,115 A.SH. --- "C:\Documents and Settings\Dani\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

[b]Finished![/b]

danicrome · Answer

rapport hijackthis



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:40:12, on 22/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PVSW\Bin\WGE_SRV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Dani\Bureau\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5060905
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=MQ-vaq6YtqM1DocvPPgF6YSkQOg
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\GhostSurf 2006 Platinum\SCActiveBlock.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [CTSVolFE.exe] "C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by126w.bay126.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://bellerock.microgaming.com/freeplayfrench/FlashAX2.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EBP Pervasive.SQL - Unknown owner - C:\PVSW\Bin\WGE_SRV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

plopus · Answer

relance hijackthis choisit do a scan only et coche les cases a gauches des lignes :

 R3 - Default URLSearchHook is missing 
 O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background     
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe     
 O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab 

puis clic sur fix checked


ensuite

telecharge GMER ici

https://www.01net.com/telecharger/windows/Utilitaire/optimiseurs_et_tests/fiches/33654.html

lance le puis selectionne tous tes disques C et D...puis clic sur scan cela peut durer un moment et toutes les lignes rouges à la fin tu clic droit dessus et tu les supprimes mais avant de les supprimes copie les et colle les ici stp

danicrome · Answer

J'ai lancé GMER mais aucune ligne n'apparait en rouge. 

C'est bon signe ça normalement?

plopus · Answer

oui si tu as pas de ligne en rouge c'est bon, mais tu as bien reclic sur scan après l'ouverture et selectionné tout tes disques si oui c'est bon (le scan dur au moins 10min en general)


puis après conseil :

essaye ceci 

desactive antivirus et antispyware puis tu va telechargé simtfraudfix, il est detecté a tort :

clic http://www.malekal.com/tutorial_SmitFraudfix.php le telechargement et le tuto et dedans, tu dois lancer simtfraud faire l'option 1 et poste le rapport stp

danicrome · Answer

Voici le rapport


SmitFraudFix v2.391

Rapport fait à 18:36:46,84, 24/01/2009
Executé à partir de C:\Documents and Settings\Dani\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PVSW\Bin\WGE_SRV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BitLord\BitLord.exe
C:\Documents and Settings\Dani\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wscntfy.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Dani


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Dani\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Dani\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Dani\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A3B24CD1-81DB-41BD-B3AB-C56C4D0E2F59}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A3B24CD1-81DB-41BD-B3AB-C56C4D0E2F59}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A3B24CD1-81DB-41BD-B3AB-C56C4D0E2F59}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

plopus · Answer

il te reste encore un rootkit assez mechant

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TDSSserv]

refait une analyse RAPIDE avec malwarebyte et poste le rapport stp

danicrome · Answer

En sans échec?

plopus · Answer

oui fait la en sans echec

danicrome · Answer

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1675
Windows 5.1.2600 Service Pack 3

24/01/2009 19:22:17
mbam-log-2009-01-24 (19-22-10).txt

Type de recherche: Examen rapide
Eléments examinés: 60125
Temps écoulé: 13 minute(s), 48 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\svchost.MSNFix (Heuristics.Reserved.Word.Exploit) -> No action taken.

plopus · Answer

ok as tu supprimer l'infection trouvées par malwarebyte ?

bon ecoute la jsuis pas assez calé, je pense qu'il faut que quelqu'un te fasse un script de desinfection avec sa :


:driver
Legacy_PACKET
Legacy_TDSSSERV
Service_TDSSserv  


:reg
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TDSSserv] 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command

et d'autres je pense

jvé demander

Virus Win32:Trojan-gen. {Other}

33 réponses

Votre réponse

Discussions similaires

Newsletters