Antivirus XP Pro, comment l'enlever !? Résolu

Question

Bonjour,
je laisse lordi sans surveillance et le lendemain...
BANG Antivirus XP Pro me dit que mon ordi neuf, avec Nod32 et tout le tralala, est infecté....
mais avant tout..... C'EST QUOI ANTIVIRUS XP PRO loll

ALERTE !? =­ http://img264.imageshack.us/img264/7041/sanstitre2ub3.jpg

ha oui... aussi ce qui me dérange au plus haut point c'est que Vista me dit qu'il n'est plus capable de s'auto-valider...! mais j'ai les cléfs originales et tout!
merci!!

IMAGE VISTA NON LÉGAL !? = http://img264.imageshack.us/img264/7864/sanstitre1ax0.jpg

j'ai aussi remarqué que quand je cherche sur google, il m'amene sur des sites comme Search20 et etc...

donc voila le rapport de HiJackThis ;)

----------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 17:24:36, on 2009-01-25
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)

Running processes:
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Eset
od32krn.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Realtek\8192U Wireless LAN Utility\RtlService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Realtek\8192U Wireless LAN Utility\RtWlan.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32	wex.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Program Files\ESET
od32kui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\frmwrk32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DNA\btdna.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Northstar\SmartCopy\SmartCopy.exe
C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\PhotoFiltre\PhotoFiltre.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\So\Desktop\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0c0c&s=1&o=vp32&d=1208&m=aspire_m1201
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0c0c&s=1&o=vp32&d=1208&m=aspire_m1201
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,C:\Windows\system32	wex.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: isoHunt Toolbar - {a6e4a4eb-d169-4e99-8988-250fcbafe767} - C:\Program Files\isoHunt	bisoH.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: isoHunt Toolbar - {a6e4a4eb-d169-4e99-8988-250fcbafe767} - C:\Program Files\isoHunt	bisoH.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer\Acer Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Steam] "d:\jeux\steam\steam.exe" -silent
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: SmartCopy.lnk = C:\Program Files\Northstar\SmartCopy\SmartCopy.exe
O4 - Global Startup: SmartLauncher.lnk = C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - d:\jeux\Party Poker\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - d:\jeux\Party Poker\PartyPoker\RunApp.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
laapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
apinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International
O13 - Gopher Prefix: 
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_1_0_4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: NameServer = 24.200.243.189,24.201.245.77,24.200.241.37
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Windows\system32\c00517F2.mat
O20 - Winlogon Notify: c00517F2 - C:\Windows\SYSTEM32\c00517F2.mat
O20 - Winlogon Notify: sys32 - sys32.dll (file missing)
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Realtek92U - Realtek - C:\Program Files\Realtek\8192U Wireless LAN Utility\RtlService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

je suis quand même bon en ordi mais la je m'y perd loll! :P

Merci

geoffrey5 · Answer

Bonsoir,

Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection): 

&#x25B6; Va dans démarrer puis panneau de configuration 
&#x25B6; Double Clique sur l'icône "Comptes d'utilisateurs" 
&#x25B6; Clique ensuite sur désactiver et valide. 


ensuite :


Option 1 - Recherche :


&#x25B6; télécharge smitfraudfix et enregistre le sur le bureau 
 
&#x25B6; Ensuite double clique sur smitfraudfix puis exécuter

&#x25B6; Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

(attention : N utilises pas l option 2 si je ne te l ai pas demandé !!)

&#x25B6; copier/coller le rapport dans la réponse.


Voici un tutoriel sonore et animé en cas de problème d'utilisation



(Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool". 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, 
cet utilitaire pourrait arrêter des logiciels de sécurité.)

bobbyseguin · Answer

SmitFraudFix v2.391

Scan done at 17:50:01,55, 2009-01-25
Run from C:\Users\So\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is 
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Eset
od32krn.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Realtek\8192U Wireless LAN Utility\RtlService.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32	wex.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Realtek\8192U Wireless LAN Utility\RtWlan.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Program Files\ESET
od32kui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\frmwrk32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DNA\btdna.exe
C:\Windows\ehome\ehtray.exe
D:\Jeux\Steam\Steam.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Northstar\SmartCopy\SmartCopy.exe
C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Common Files\Steam\SteamService.exe
C:\Program Files\Eset
od32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Bobby


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Bobby\AppData\Local\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Bobby\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Bobby\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
 
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\system32\c00517F2.mat"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\Windows\system32\userinit.exe,C:\Windows\system32\twex.exe,"


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Marvell Yukon 88E8071 PCI-E Gigabit Ethernet Controller
DNS Server Search Order: 24.200.243.189
DNS Server Search Order: 24.201.245.77
DNS Server Search Order: 24.200.241.37

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5CC6C5DE-C04A-4F2E-BE28-0868B32686F8}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CCS\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: NameServer=24.200.243.189,24.201.245.77,24.200.241.37
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5CC6C5DE-C04A-4F2E-BE28-0868B32686F8}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: NameServer=24.200.243.189,24.201.245.77,24.200.241.37
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5CC6C5DE-C04A-4F2E-BE28-0868B32686F8}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: NameServer=24.200.243.189,24.201.245.77,24.200.241.37
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

Voila ! :)

geoffrey5 · Answer

Option 2 - Nettoyage :


&#x25B6; redémarre le PC en mode sans échec

&#x25B6; Double cliquer sur smitfraudfix

&#x25B6; Sélectionner 2 pour supprimer les fichiers responsables de l'infection.

&#x25B6; A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.

Le fix déterminera si le fichier wininet.dll est infecté. A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.

&#x25B6; Enregistre le rapport sur ton bureau


&#x25B6; Redémarrer en mode normal et poster le rapport.

bobbyseguin · Answer

SmitFraudFix v2.391

Rapport fait à 18:00:05,89, 2009-01-25
Executé à partir de C:\Users\So\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
Le type du système de fichiers est 
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost
::1             localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5CC6C5DE-C04A-4F2E-BE28-0868B32686F8}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CCS\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: NameServer=24.200.243.189,24.201.245.77,24.200.241.37
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5CC6C5DE-C04A-4F2E-BE28-0868B32686F8}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: NameServer=24.200.243.189,24.201.245.77,24.200.241.37
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5CC6C5DE-C04A-4F2E-BE28-0868B32686F8}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: NameServer=24.200.243.189,24.201.245.77,24.200.241.37
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

geoffrey5 · Answer

&#x25B6; Télécharge malwarebyte's anti-malware 

&#x25B6; Un tutoriel sera à ta disposition pour l'installer et l'utiliser correctement.
 
&#x25B6; Fais la mise à jour du logiciel (elle se fait normalement à l'installation) 

&#x25B6; Lance une analyse complète en cliquant sur "Exécuter un examen complet"

&#x25B6; Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"

&#x25B6; L'analyse peut durer un bon moment.....

&#x25B6; Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"

&#x25B6; Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"

&#x25B6; Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum


* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée

bobbyseguin · Answer

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1693
Windows 6.0.6001 Service Pack 1

2009-01-25 20:23:43
mbam-log-2009-01-25 (20-23-41).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 185299
Temps écoulé: 1 hour(s), 15 minute(s), 27 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 12
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 11

Processus mémoire infecté(s):
C:\Windows\System32	wex.exe (Backdoor.Bot) -> No action taken.
C:\Windows\System32\frmwrk32.exe (Trojan.FakeAlert) -> No action taken.

Module(s) mémoire infecté(s):
C:\Windows\System32\c00517F2.mat (Trojan.Agent) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sys32 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\c00517f2 (Trojan.Agent) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Framework Windows (Trojan.FakeAlert) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: c:\windows\system32\c00517f2.mat -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: system32\c00517f2.mat -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Backdoor.Bot) -> Data: c:\windows\system32	wex.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Backdoor.Bot) -> Data: system32	wex.exe -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\Windows\system32\userinit.exe,C:\Windows\system32	wex.exe,) Good: (userinit.exe) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\isoHunt\isoHuntToolbarHelper.exe (Adware.NetPumper) -> No action taken.
C:\Users\Bobby\AppData\Roaming\Microsoft\Windows\lsass.exe (Trojan.Agent) -> No action taken.
C:\Windows\System32
tdll64.exe (Trojan.Agent) -> No action taken.
C:\Windows\System32\c00517F2.mat (Trojan.Agent) -> No action taken.
C:\Users\Bobby\AppData\Roaming\Microsoft\Windows\sys32.dll (Trojan.Agent) -> No action taken.
C:\Windows\System32	wex.exe (Backdoor.Bot) -> No action taken.
C:\Windows\System32\warning.gif (Trojan.FakeAlert) -> No action taken.
C:\Windows\System32\ahtn.htm (Trojan.FakeAlert) -> No action taken.
C:\Windows\System32\frmwrk32.exe (Trojan.FakeAlert) -> No action taken.
C:\Windows\Temp
tdll64.dll (Trojan.FakeAlert) -> No action taken.
C:\Windows\Temp\mousehook.dll (Trojan.FakeAlert) -> No action taken.

geoffrey5 · Answer

Après ce rapport, est-ce que tu as affiché le résultat et supprimé la sélection ??

bobbyseguin · Answer

j'atendait les ordres... malwarebytes est toujours ouvert a la fenetre des résultats des examens

bobbyseguin · Answer

après la suppression voila le nouveau rapport

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1693
Windows 6.0.6001 Service Pack 1

2009-01-25 20:57:35
mbam-log-2009-01-25 (20-57-35).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 185299
Temps écoulé: 1 hour(s), 15 minute(s), 27 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 12
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 11

Processus mémoire infecté(s):
C:\Windows\System32	wex.exe (Backdoor.Bot) -> Unloaded process successfully.
C:\Windows\System32\frmwrk32.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Windows\System32\c00517F2.mat (Trojan.Agent) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sys32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\c00517f2 (Trojan.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Framework Windows (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: c:\windows\system32\c00517f2.mat -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: system32\c00517f2.mat -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Backdoor.Bot) -> Data: c:\windows\system32	wex.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Backdoor.Bot) -> Data: system32	wex.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\Windows\system32\userinit.exe,C:\Windows\system32	wex.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\isoHunt\isoHuntToolbarHelper.exe (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Users\Bobby\AppData\Roaming\Microsoft\Windows\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32
tdll64.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\c00517F2.mat (Trojan.Agent) -> Delete on reboot.
C:\Users\Bobby\AppData\Roaming\Microsoft\Windows\sys32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32	wex.exe (Backdoor.Bot) -> Delete on reboot.
C:\Windows\System32\warning.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\ahtn.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\frmwrk32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\Temp
tdll64.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\Temp\mousehook.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.



donc je redémarre!

geoffrey5 · Answer

Tu dois cliquer sur afficher les résultats, ensuite vérifie si tout est bien coché et cliques sur Supprimer la sélection

geoffrey5 · Answer

Oui redémarre pour terminer la suppression...

Ensuite vas vider la quarantaine de Malwarebytes et refais un nouveau rapport hijackthis stp

bobbyseguin · Answer

daccord sa s'en vien ;)

bobbyseguin · Answer

voila le rapport

Logfile of HijackThis v1.99.1
Scan saved at 21:03:01, on 2009-01-25
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ESET
od32kui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DNA\btdna.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Northstar\SmartCopy\SmartCopy.exe
C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\conime.exe
C:\Users\So\Desktop\HiJackThis\HijackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: isoHunt Toolbar - {a6e4a4eb-d169-4e99-8988-250fcbafe767} - C:\Program Files\isoHunt	bisoH.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: isoHunt Toolbar - {a6e4a4eb-d169-4e99-8988-250fcbafe767} - C:\Program Files\isoHunt	bisoH.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer\Acer Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Steam] "d:\jeux\steam\steam.exe" -silent
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: SmartCopy.lnk = C:\Program Files\Northstar\SmartCopy\SmartCopy.exe
O4 - Global Startup: SmartLauncher.lnk = C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - d:\jeux\Party Poker\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - d:\jeux\Party Poker\PartyPoker\RunApp.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
laapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
apinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International
O13 - Gopher Prefix: 
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_1_0_4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: NameServer = 24.200.243.189,24.201.245.77,24.200.241.37
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Realtek92U - Realtek - C:\Program Files\Realtek\8192U Wireless LAN Utility\RtlService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

geoffrey5 · Answer

relance hijackthis en cliquant sur scan only et coches ces lignes stp :

O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file) 
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file) 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime     
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"     
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime     
O4 - HKCU\..\Run: [Steam] "d:\jeux\steam\steam.exe" -silent     

puis tu cliques sur fix checked.


ensuite :


&#x25B6; Télécharge RegCleaner

&#x25B6; Une fois installé, double-clique sur son icône pour l'exécuter

&#x25B6; Dans la barre de menu, clique sur Options puis sélectionne Language => Select language

&#x25B6; recherche French.rlg et double-clique dessus pour appliquer la langue

&#x25B6; Clique ensuite sur Outils dans la barre de menu

&#x25B6; Sélectionne Nettoyage du registre => Nettoyeur de registre automatique

&#x25B6; RegCleaner va alors lancer le nettoyage automatiquement

&#x25B6; Coche ensuite les entrées invalides qui sont apparues dans la fenêtre et clique sur Supprimer sélections => Terminer => Quitter


Est-ce que tu as encore des problèmes ??

bobbyseguin · Answer

mon internet explorer va très mal depuis l'incident, j'ai du ouvrir par un fichier d'aide de Diablo II pour l'ouvrir, il me demande toujours si je veux ouvrir par la page de démarrage ou par la page d'acceuil, peu importe le choix, il redémarre... mais j'ai constaté qu'au démarrage il commence avec 2 onglets... et j'ai du passer par le site Macecraft Software pour télécharger RegCleaner. donc je mapprète a faire le scann demandé


P.S. je téléchargeait la mauvaise chose et RegCleaner n'est pas disponible sur le site officiel (celui selon Téléchargé.com)

geoffrey5 · Answer

&#x25B6; Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection): 

&#x25B6; Va dans démarrer puis panneau de configuration 
&#x25B6; Double Clique sur l'icône "Comptes d'utilisateurs" 
&#x25B6; Clique ensuite sur désactiver et valide. 




&#x25B6; Télécharge Combofix de sUBs 


&#x25B6; et enregistre le sur le Bureau. 

  
&#x25B6; désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware) 


Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


&#x25B6; Je te conseille d'installer la console de récupération !!
 

ensuite envois le rapport et refais un nouveau rapport hijackthis stp

bobbyseguin · Answer

en lancant comboFix, je ferme Nod32 mais au redémarrage Nod32 redémarre et je n'y ai aucunement accès apres le redémarrage... comment le fermer définitivement!?

Nod32 V.2.70.39

geoffrey5 · Answer

Tu désactives ton antivirus puis tu lances combofix, c est tout

bobbyseguin · Answer

c'est ce que je fait mais il se réactive au redémarrage automatiquement

geoffrey5 · Answer

quel redémarrage automatique ??

bobbyseguin · Answer

COMBOFIX ComboFix 09-01-21.04 - So 2009-01-25 21:57:32.1 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.3070.2164 [GMT -5:00] Lancé depuis: c:\users\So\Desktop\ComboFix.exe AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) . [i] ADS - Windows: deleted 48 bytes in 1 streams. /i (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\Bobby\AppData\Roaming\.# c:\windows\System32\303350.exe c:\windows\system32\404Fix.exe c:\windows\system32\Agent.OMZ.Fix.exe c:\windows\system32\drivers\senekawupbyvid.sys c:\windows\system32\dumphive.exe c:\windows\system32\IEDFix.C.exe c:\windows\system32\IEDFix.exe c:\windows\system32\o4Patch.exe c:\windows\system32\Process.exe c:\windows\system32\senekaftcotbed.dll c:\windows\system32\senekaihvoegow.dll c:\windows\system32\senekamoccdpft.dat c:\windows\system32\senekavgiuiicn.dat c:\windows\system32\SrchSTS.exe c:\windows\system32 est.ttt c:\windows\system32 mp.reg c:\windows\system32\uniq.tll c:\windows\system32\VACFix.exe c:\windows\system32\VCCLSID.exe c:\windows\system32\win32hlp.cnf c:\windows\system32\WS2Fix.exe c:\programdata\Microsoft\Network\Downloader\qmgr0.dat . . . . impossible à supprimer c:\programdata\Microsoft\Network\Downloader\qmgr1.dat . . . . impossible à supprimer ----- BITS: Il y a peut-être des sites infectés ----- hxxp://kakoitodomen.com . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_SENEKA -------\Service_SENEKA ((((((((((((((((((((((((((((( Fichiers créés du 2008-12-26 au 2009-01-26 )))))))))))))))))))))))))))))))))))) . 2009-01-25 22:01 . 2009-01-25 22:01 1,006 --a------ c:\windows\System32\senekahcptnsrf.dat 2009-01-25 22:01 . 2009-01-25 22:01 414 --a------ c:\windows\System32\senekalog.dat 2009-01-25 22:00 . 2009-01-25 22:00 0 --a------ c:\windows\System32\senekapop.dll 2009-01-25 22:00 . 2009-01-25 22:00 0 --a------ c:\windows\System32\drivers\seneka.sys 2009-01-25 21:07 . 2009-01-25 21:07 d-------- c:\users\All Users\Windows Genuine Advantage 2009-01-25 18:11 . 2009-01-25 18:11 d-------- c:\users\So\AppData\Roaming\Malwarebytes 2009-01-25 18:11 . 2009-01-25 18:11 d-------- c:\users\All Users\Malwarebytes 2009-01-25 18:11 . 2009-01-25 18:11 d-------- c:\programdata\Malwarebytes 2009-01-25 18:11 . 2009-01-25 18:11 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-25 18:11 . 2009-01-14 16:11 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-01-25 18:11 . 2009-01-14 16:11 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2009-01-25 18:00 . 2009-01-25 18:00 691 --a------ c:\users\So\AppData\Roaming\GetValue.vbs 2009-01-25 18:00 . 2009-01-25 18:00 35 --a------ c:\users\So\AppData\Roaming\SetValue.bat 2009-01-24 12:57 . 2009-01-25 20:03 d--hs---- c:\windows\System32 wain32 2009-01-24 12:57 . 2009-01-24 12:57 94,208 --a------ c:\windows\System32\winlogon2.exe 2009-01-23 16:56 . 2009-01-23 16:56 0 --a------ c:\windows\System32\drivers\senekannplmype.sys 2009-01-23 13:05 . 2009-01-23 13:05 41,472 --a------ c:\windows\System32\chert6-303350.exe 2009-01-23 13:05 . 2009-01-23 13:05 41,472 --a------ c:\windows\Jnabexemexiz.dll 2009-01-23 13:02 . 2009-01-23 13:03 d-------- c:\users\Bobby\AppData\Roaming\ForgottenRiddles 2009-01-20 00:05 . 2009-01-20 00:05 d-------- c:\users\All Users\Awem 2009-01-20 00:05 . 2009-01-20 00:05 d-------- c:\programdata\Awem 2009-01-18 17:43 . 2009-01-18 17:43 d-------- c:\windows\System32\REALTEK RTL8192U Wireless LAN Driver and Utility 2009-01-18 17:43 . 2009-01-18 17:43 d-------- c:\windows\OPTIONS 2009-01-18 17:43 . 2008-06-30 08:14 410,624 -ra------ c:\windows\System32\drivers tl8192u.sys 2009-01-18 17:43 . 2007-04-23 10:50 25,896 --a------ c:\windows\System32\drivers\RtlProt.sys 2009-01-17 23:26 . 2009-01-17 23:26 d-------- c:\users\Jeux\Gros jeux 2009-01-17 23:26 . 2009-01-18 21:59 dr------- c:\users\Jeux 2009-01-17 21:42 . 2009-01-17 21:42 d-------- c:\users\Bobby\AppData\Roaming\Incredible Ink 2009-01-17 21:28 . 2005-11-07 19:14 802,816 --a------ c:\windows\FeedingFrenzy.scr 2009-01-17 20:59 . 2009-01-17 20:59 d-------- c:\users\Bobby\AppData\Roaming\EA 2009-01-17 20:58 . 2009-01-17 20:58 d-------- c:\users\All Users\EA 2009-01-17 20:58 . 2009-01-17 20:58 d-------- c:\programdata\EA 2009-01-17 20:55 . 2009-01-17 20:55 d-------- c:\users\Bobby\AppData\Roaming\funkitron 2009-01-17 20:40 . 2009-01-17 20:40 16 --a------ c:\windows\popcinfo.dat 2009-01-17 20:35 . 2009-01-17 21:30 d-------- c:\program files\GameHouse 2009-01-17 20:35 . 2005-08-03 13:48 389,120 --a------ c:\windows\System32\Adventure Inlay.scr 2009-01-17 20:31 . 2009-01-17 20:31 d-------- c:\windows\The Tuttles - Madcap Misadventures 2009-01-17 20:28 . 2009-01-17 20:28 d--hs---- c:\windows\ftpcache 2009-01-17 20:24 . 2009-01-17 20:24 d-------- c:\windows\Snowy Treasure Hunter 3 2009-01-17 20:23 . 2009-01-17 20:23 d-------- c:\windows\Sir Arthur in the Dragonland 2009-01-17 20:22 . 2009-01-17 20:22 d-------- c:\windows\Secrets Of Great Art 2009-01-17 20:19 . 2009-01-17 20:19 d-------- c:\windows\Paradise Pet Salon 2009-01-17 20:17 . 2009-01-17 20:17 d-------- c:\windows\The Treasures Of Montezuma 2009-01-17 20:17 . 2009-01-17 20:17 d-------- c:\windows\Mysteryville 2009-01-17 20:13 . 2009-01-17 20:13 d-------- c:\windows\Mystery in London 2009-01-17 19:57 . 2009-01-17 19:57 d-------- c:\windows\Little Shop - Big City 2009-01-17 19:55 . 2009-01-17 19:55 d-------- c:\windows\Hidden Secrets - The Nightmare 2009-01-17 19:50 . 2009-01-17 19:50 d-------- c:\windows\Hidden Expedition - Everest 2009-01-17 19:49 . 2009-01-17 19:49 d-------- c:\users\Bobby\AppData\Roaming\GameHouse 2009-01-17 19:47 . 2009-01-17 19:47 d-------- c:\windows\Forgotten Riddles - The Mayan Princess 2009-01-17 19:42 . 2009-01-17 19:42 d-------- c:\windows\Dream Day - First Home 2009-01-17 19:40 . 2009-01-17 19:40 125 --a------ C:\ioSpecial.ini 2009-01-17 19:39 . 2009-01-17 19:39 d-------- c:\windows\Dream Chronicles 2009-01-17 19:37 . 2009-01-17 19:37 d-------- c:\users\Bobby\AppData\Roaming\CaribbeanHideaway 2009-01-17 19:36 . 2009-01-17 19:36 4,096 --a------ c:\windows\d3dx.dat 2009-01-17 19:05 . 2009-01-17 19:05 d-------- c:\users\All Users\SpinTop Games 2009-01-17 19:05 . 2009-01-17 19:05 d-------- c:\programdata\SpinTop Games 2009-01-17 19:02 . 2009-01-17 19:02 d-------- c:\users\All Users\Trymedia 2009-01-17 19:02 . 2009-01-17 19:02 d-------- c:\programdata\Trymedia 2009-01-15 22:36 . 2009-01-15 22:36 d-------- c:\users\Bobby\AppData\Roaming\PlayFirst 2009-01-15 22:36 . 2009-01-15 22:36 d-------- c:\users\All Users\PlayFirst 2009-01-15 22:36 . 2009-01-15 22:36 d-------- c:\programdata\PlayFirst 2009-01-15 22:34 . 2009-01-15 22:34 d-------- c:\program files\ReflexiveArcade 2009-01-15 22:28 . 2009-01-15 22:28 d-------- c:\windows\Mahjong Fortuna 2 Deluxe 2009-01-15 22:22 . 2009-01-15 22:22 d-------- c:\windows\Build A Lot 2009-01-15 22:17 . 2009-01-17 19:11 d-------- c:\program files\BFG 2009-01-14 19:18 . 2009-01-14 19:18 d-------- c:\program files\MSECache 2009-01-14 19:18 . 2009-01-14 19:18 d-------- c:\program files\Microsoft Office Outlook Connector 2009-01-14 18:12 . 2009-01-14 18:12 d-------- c:\users\Bobby\AppData\Roaming\eSobi 2009-01-14 16:30 . 2009-01-14 16:30 d-------- c:\users\Bobby\AppData\Roaming\FloodLightGames 2009-01-14 16:16 . 2009-01-14 16:16 d-------- c:\users\Public\MediaServer 2009-01-14 13:15 . 2008-12-15 21:42 288,768 --a------ c:\windows\System32\drivers\srv.sys 2009-01-13 20:25 . 2009-01-13 20:26 d-------- c:\program files\SopCast 2009-01-13 20:23 . 2009-01-13 20:24 d-------- c:\users\Bobby\AppData\Roaming\vlc 2009-01-13 20:23 . 2009-01-13 20:23 d-------- c:\program files\VideoLAN 2009-01-11 20:21 . 2009-01-11 20:21 d-------- c:\windows\Prefs 2009-01-09 21:05 . 2009-01-09 21:05 d-------- c:\users\So\AppData\Roaming\Atari 2009-01-09 05:10 . 2008-12-13 01:23 1,659,392 --a------ c:\windows\System32\mshtml.tlb 2009-01-09 00:28 . 2009-01-09 00:28 d-------- c:\windows\System32\briblo dir 2009-01-09 00:28 . 2009-01-09 00:29 2,841,342 --a------ c:\windows\Bacura.exe 2009-01-09 00:28 . 2009-01-09 00:28 532,480 --a------ c:\windows\System32\briblo.scr 2009-01-09 00:28 . 2009-01-09 00:29 402,208 --a------ c:\windows\Bacura.scr 2009-01-09 00:28 . 2009-01-09 00:29 29,696 --a------ c:\windows\mickey32.dll 2009-01-09 00:25 . 2009-01-09 00:25 d-------- c:\program files\Mickey Mouse 2009-01-08 23:45 . 2009-01-08 23:45 102,400 --a------ c:\windows\DreamAquarium.scr 2009-01-08 23:27 . 2009-01-09 00:25 d-------- c:\windows\System32\FLIQLO dir 2009-01-08 23:27 . 2009-01-08 23:27 d-------- c:\program files\Liquid Screen Saver 2009-01-08 23:27 . 2009-01-09 00:21 d-------- c:\program files\Dream Aquarium 2009-01-08 23:27 . 2009-01-08 23:27 532,480 --a------ c:\windows\System32\FLIQLO.scr 2009-01-07 20:01 . 2009-01-25 22:33 d-------- c:\users\So\AppData\Roaming\DNA 2009-01-06 20:06 . 2009-01-06 20:06 d-------- c:\users\All Users\ma-config.com 2009-01-06 20:06 . 2009-01-06 20:06 d-------- c:\programdata\ma-config.com 2009-01-06 20:06 . 2009-01-06 20:07 d-------- c:\program files\ma-config.com 2009-01-06 19:34 . 2007-11-14 15:18 553 --a------ c:\windows\USetup.iss 2009-01-06 19:33 . 2009-01-06 19:33 d-------- c:\windows\System32\RTCOM 2009-01-06 19:32 . 2009-01-18 17:43 d-------- c:\program files\Realtek 2009-01-06 19:22 . 2009-01-06 19:37 d--h----- c:\program files\Temp 2009-01-06 18:02 . 2009-01-06 18:02 d-------- c:\users\All Users\NetZero 2009-01-06 18:02 . 2009-01-06 18:02 d-------- c:\programdata\NetZero 2009-01-06 13:43 . 2009-01-06 13:43 d-------- c:\users\All Users\Recisio 2009-01-06 13:43 . 2009-01-06 13:43 d-------- c:\programdata\Recisio 2009-01-06 13:43 . 2009-01-06 13:43 d-------- c:\program files\KaraFun 2009-01-06 00:10 . 2009-01-06 00:10 d-------- c:\program files\GXTranscoderv5 2009-01-04 17:04 . 2009-01-04 17:27 d-------- c:\program files\Audacity 2009-01-02 15:12 . 2009-01-02 16:03 d-------- c:\users\Bobby\AppData\Roaming\Vso 2009-01-02 15:12 . 2009-01-02 15:12 d-------- c:\program files\vso 2009-01-02 15:12 . 2009-01-02 15:12 81,920 --a------ c:\users\Bobby\AppData\Roaming\ezpinst.exe 2009-01-02 15:12 . 2009-01-02 15:12 47,360 --a------ c:\windows\System32\drivers\pcouffin.sys 2009-01-02 15:12 . 2009-01-02 15:12 47,360 --a------ c:\users\Bobby\AppData\Roaming\pcouffin.sys 2008-12-30 16:48 . 2008-12-30 16:48 d-------- c:\users\All Users\SlySoft 2008-12-30 16:48 . 2008-12-30 16:48 d-------- c:\programdata\SlySoft 2008-12-30 16:45 . 2008-12-30 16:45 d-------- c:\program files\SlySoft 2008-12-29 18:08 . 2008-12-29 18:08 d-------- c:\users\All Users\Elaborate Bytes 2008-12-29 18:08 . 2008-12-29 18:08 d-------- c:\programdata\Elaborate Bytes 2008-12-29 16:06 . 2008-12-29 16:06 103,360 --a------ c:\windows\System32\drivers\AnyDVD.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-26 03:33 --------- d-----w c:\program files\DNA 2009-01-26 02:56 35,840 ------w c:\windows\System32\senekaihvoegow.dll 2009-01-26 01:57 --------- d-----w c:\program files\isoHunt 2009-01-24 23:52 --------- d-----w c:\users\Bobby\AppData\Roaming\DNA 2009-01-23 18:01 --------- d---a-w c:\programdata\TEMP 2009-01-20 07:31 --------- d-----w c:\users\Bobby\AppData\Roaming\LimeWire 2009-01-19 22:21 --------- d-----w c:\program files\Common Files\Steam 2009-01-18 22:43 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-16 15:26 --------- d-----w c:\users\Bobby\AppData\Roaming\BitTorrent 2009-01-14 23:22 --------- d-----w c:\programdata\Microsoft Help 2009-01-14 23:22 --------- d-----w c:\program files\Windows Mail 2009-01-14 23:12 --------- d-----w c:\programdata\eSobi 2009-01-07 00:32 319,456 ----a-w c:\windows\DIFxAPI.dll 2009-01-06 18:35 --------- d-----w c:\program files\MediaCoder 2008-12-29 23:08 --------- d-----w c:\program files\Elaborate Bytes 2008-12-26 23:13 965,664 ----a-w c:\windows\System32\RtkPgExt.dll 2008-12-26 23:13 44,064 ----a-w c:\windows\System32\RtkCoInst.dll 2008-12-26 23:12 322,080 ----a-w c:\windows\System32\RtkApoApi.dll 2008-12-26 23:12 2,510,368 ----a-w c:\windows\System32\RtkAPO.dll 2008-12-26 22:26 2,259,296 ----a-w c:\windows\system32\drivers\RTKVHDA.sys 2008-12-26 04:05 --------- d-----w c:\program files\Microsoft Silverlight 2008-12-20 02:07 --------- d-----w c:\program files\Chuzzle Deluxe 2008-12-20 01:39 --------- d-----w c:\users\So\AppData\Roaming\Leadertech 2008-12-20 01:39 --------- d-----w c:\users\So\AppData\Roaming\ATI 2008-12-20 01:39 --------- d-----w c:\users\So\AppData\Roaming\Acer 2008-12-18 14:13 --------- d-----w c:\program files\LimeWire 2008-12-18 13:06 --------- d-----w c:\program files\Google 2008-12-16 23:15 --------- d-----w c:\program files\Bonjour 2008-12-16 21:55 --------- d-----w c:\program files\MagicISO 2008-12-15 21:14 --------- d-----w c:\program files\Conduit 2008-12-13 02:08 --------- d-----w c:\users\Bobby\AppData\Roaming\PeerNetworking 2008-12-12 16:33 --------- d-----w c:\programdata\TrackMania United 2008-12-12 16:18 87,336 ----a-w c:\windows\System32\dns-sd.exe 2008-12-12 16:11 61,440 ----a-w c:\windows\System32\dnssd.dll 2008-12-12 08:03 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2 2008-12-11 14:51 --------- d-----w c:\program files\Xvid 2008-12-11 14:40 --------- d-----w c:\program files\Windows Live Safety Center 2008-12-11 13:23 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf 2008-12-10 17:54 410,984 ----a-w c:\windows\System32\deploytk.dll 2008-12-10 17:54 --------- d-----w c:\program files\Java 2008-12-10 06:47 --------- d-----w c:\users\Bobby\AppData\Roaming\Atari 2008-12-10 06:18 --------- d-----w c:\program files\ESET 2008-12-10 05:51 --------- d-----w c:\program files\Common Files\Java 2008-12-10 01:09 --------- d-----w c:\users\Bobby\AppData\Roaming\My Games 2008-12-09 23:14 --------- d-----w c:\program files\PowerISO 2008-12-09 22:58 --------- d-----w c:\program files\Common Files\PocketSoft 2008-12-09 21:07 --------- d-----w c:\program files\Alcohol Soft 2008-12-09 21:05 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-12-09 21:04 --------- d-----w c:\program files\Common Files\Adobe 2008-12-08 06:03 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-08 04:08 --------- d-----w c:\program files\Common Files\Motorola Shared 2008-12-08 00:41 2,829 ----a-w c:\windows\DIIUnin.pif 2008-12-08 00:41 102,400 ----a-w c:\windows\DIIUnin.exe 2008-12-07 23:55 --------- d-----w c:\program files\MSBuild 2008-12-07 23:52 --------- d-----w c:\program files\Microsoft Visual Studio 8 2008-12-07 21:29 --------- d-----w c:\users\Bobby\AppData\Roaming\CyberLink 2008-12-07 21:29 --------- d-----w c:\programdata\CyberLink 2008-12-07 21:29 --------- d-----w c:\program files\Common Files\SWF Studio 2008-12-07 21:17 --------- d-----w c:\program files\BitTorrent 2008-12-07 20:38 --------- d-----w c:\programdata\Messenger Plus! 2008-12-07 03:25 --------- d-----w c:\program files\Microsoft Works 2008-12-07 03:08 --------- d-----w c:\program files\PhotoFiltre 2008-12-07 02:47 --------- d-----w c:\program files\Windows Live 2008-12-07 02:47 --------- d-----w c:\program files\Messenger Plus! Live 2008-12-07 02:46 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2008-12-07 02:45 --------- d-----w c:\programdata\WLInstaller 2008-12-07 02:01 --------- d-----w c:\users\Bobby\AppData\Roaming\Apple Computer 2008-12-07 02:00 --------- d-----w c:\programdata\Apple Computer 2008-12-07 02:00 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-12-07 02:00 --------- d-----w c:\program files\iTunes 2008-12-07 02:00 --------- d-----w c:\program files\iPod 2008-12-07 02:00 --------- d-----w c:\program files\Common Files\Apple 2008-12-07 01:59 --------- d-----w c:\programdata\Apple 2008-12-07 01:59 --------- d-----w c:\program files\QuickTime 2008-12-07 01:59 --------- d-----w c:\program files\Apple Software Update 2008-12-07 01:54 --------- d-----w c:\programdata\McAfee 2008-12-07 01:45 --------- d-----w c:\programdata\SiteAdvisor 2008-12-07 01:40 512,096 ----a-w c:\windows\system32\drivers\amon.sys 2008-12-07 01:40 298,104 ----a-w c:\windows\System32\imon.dll 2008-12-07 01:40 15,424 ----a-w c:\windows\system32\drivers od32drv.sys 2008-12-07 01:11 --------- d-----w c:\program files\MSXML 4.0 2008-12-07 01:10 --------- d-----w c:\programdata\{174892B1-CBE7-44F5-86FF-AB555EFD73A3} 2008-12-07 01:09 --------- d-----w c:\program files\Acer Incorporated 2008-12-07 01:08 --------- d-----w c:\program files\Northstar 2008-12-07 01:06 --------- d-----w c:\users\Bobby\AppData\Roaming\InstallShield 2008-12-07 01:04 --------- d-----w c:\program files\DIFX 2008-12-07 01:03 --------- d-----w c:\users\Bobby\AppData\Roaming\ATI 2008-12-07 01:03 --------- d-----w c:\users\Bobby\AppData\Roaming\Acer 2008-12-07 01:03 --------- d-----w c:\programdata\ATI 2008-12-07 01:03 --------- d-----w c:\program files\YUAN 2008-12-07 01:02 --------- d-----w c:\users\Bobby\AppData\Roaming\Leadertech 2008-12-07 00:57 --------- d-----w c:\program files\Acer 2008-12-07 00:53 --------- d-sh--w c:\programdata\Modèles 2008-12-07 00:53 --------- d-sh--w c:\programdata\Menu Démarrer 2008-12-07 00:53 --------- d-sh--w c:\programdata\Favoris 2008-12-07 00:53 --------- d-sh--w c:\programdata\Bureau 2008-12-07 00:53 --------- d-sh--w c:\program files\Fichiers communs 2008-12-06 20:47 --------- d-----w c:\program files\ATI Technologies 2008-12-06 20:46 --------- d-----w c:\program files\ATI 2008-12-06 20:45 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a6e4a4eb-d169-4e99-8988-250fcbafe767}] 2008-11-23 23:03 1784856 --a------ c:\program files\isoHunt bisoH.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{a6e4a4eb-d169-4e99-8988-250fcbafe767}"= "c:\program files\isoHunt bisoH.dll" [2008-11-23 1784856] [HKEY_CLASSES_ROOT\clsid\{a6e4a4eb-d169-4e99-8988-250fcbafe767}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{A6E4A4EB-D169-4E99-8988-250FCBAFE767}"= "c:\program files\isoHunt bisoH.dll" [2008-11-23 1784856] [HKEY_CLASSES_ROOT\clsid\{a6e4a4eb-d169-4e99-8988-250fcbafe767}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-20 1233920] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-15 342848] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-20 125952] "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-11-22 203720] "AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-12-29 2489280] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-20 202240] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-06 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PCMMediaSharing"="c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" [2008-05-20 204908] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-25 28672] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "Acer Product Registration"="c:\program files\Acer\Acer Registration\ACE1.exe" [2007-11-26 3387392] "Acer Assist Launcher"="c:\program files\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568] "nod32kui"="c:\program files\Eset od32kui.exe" [2008-12-06 949376] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2008-06-29 52168] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-10 136600] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2008-12-26 6707744] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ SmartCopy.lnk - c:\program files\Northstar\SmartCopy\SmartCopy.exe [2008-12-06 319488] SmartLauncher.lnk - c:\program files\Northstar\SmartLauncher\SmartLauncher.exe [2008-12-06 335872] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSetActiveDesktop"= 1 (0x1) "NoActiveDesktopChanges"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.mkdmp3enc"= c:\progra~1\ACERAR~1\ACERVI~1\Kernel\Burner\MKDMP3Enc.ACM [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"="0x00000000" "UpdatesDisableNotify"="0x00000000" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{97131409-7267-47F7-A01C-175F514F0AEA}"= c:\program files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live "{C476C174-0822-43AB-A0DB-F4775F70C806}"= c:\program files\Acer Arcade Live\Acer DV Magician\Acer DV Magician.exe:Acer DV Magician "{D8D07BA7-CBAD-47CF-9758-5928BBEC2634}"= c:\program files\Acer Arcade Live\Acer SlideShow DVD\Acer SlideShow DVD.exe:Acer SlideShow DVD "{D4920BF4-1F12-49CB-827B-DC05B760F7F4}"= c:\program files\Acer Arcade Live\Acer VideoMagician\Acer VideoMagician.exe:Acer VideoMagician "{E9C6389F-CA52-4A11-B521-FD68D9D53C16}"= c:\program files\Acer Arcade Live\Acer DVDivine\Acer DVDivine.exe:Acer DVDivine "{BDDE978D-324E-4920-A3B6-B145E9AA7E55}"= c:\program files\Acer Arcade Live\Acer HomeMedia\Acer HomeMedia.exe:Acer HomeMedia "{1FD570ED-38D8-4D88-BDD9-CAA6F909D85C}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Acer HomeMedia Connect.exe:Acer HomeMedia Connect "{8AE22B3C-2666-4D3C-A275-B060F02B19F9}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:Acer HomeMedia Connect Service "{8AC9FA06-A713-4F72-8A82-2AA054715D28}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{4903336C-D69C-4292-9B06-6A930E36E932}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{E75465E3-8DEB-4317-A7AA-0698188A85E9}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{E1D148F8-035E-48CF-8C18-577BFEF73578}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{15BFA03F-08AE-4AD5-BE4D-32B9AEFE1FD5}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{344F6738-CC79-4EF2-B795-D493399AC38D}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{39F41C93-0425-4E4C-807E-30AE6939389F}"= c:\program files\Acer Arcade Live\Acer HomeMedia Trial Creator\Acer HomeMedia Trial Creator.exe:Acer HomeMedia Trial Creator "{E9BF821B-028E-4E19-B55C-8A52DCC46E32}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{EA2B0365-5F5C-4194-860E-7A9CFFE9F8A7}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{725D1786-4C49-4D88-83A8-608FC1C17F59}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{BEC730BE-0CA7-4021-B35C-BAFBAC0B1DE0}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{37EDD29B-FC53-4FC8-B3FD-DB47396C547A}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{24237328-5D95-40DD-9058-71F88431F8B7}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In) "{393DB1C7-0008-42B5-AE37-83826A8D8D71}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In) "{68FA0931-5D66-4CA5-9883-D23CBD769BF2}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent (TCP-In) "{84CCB58C-3517-412D-BAA2-E8B833E19E33}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent (UDP-In) "{956CCF47-F1A8-49C2-835C-87E3EB4B1928}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{540ECB0F-E0BD-457C-B48B-D68FBD19A1D3}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{036CC320-1183-4B1F-B453-FE3A1C193417}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{A46FAEC8-2AF7-45FD-A08D-6C7BA643D4FA}d:\jeux\steam\steamapps\bobbyseguin\counter-strike source\hl2.exe"= UDP:d:\jeux\steam\steamapps\bobbyseguin\counter-strike source\hl2.exe:hl2 "UDP Query User{B193A30A-0E33-4641-8295-7C6D0912D27C}d:\jeux\steam\steamapps\bobbyseguin\counter-strike source\hl2.exe"= TCP:d:\jeux\steam\steamapps\bobbyseguin\counter-strike source\hl2.exe:hl2 "{34D0FE7F-919F-45F4-A782-975D047E0A70}"= UDP:d:\jeux\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4 "{5F94CBD8-9B1A-4440-B99A-91A4AC5781F7}"= TCP:d:\jeux\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4 "TCP Query User{DBF9BD83-1BE8-48F1-912C-44CB5D53E56E}d:\jeux\trackmania united\tmunited.exe"= UDP:d:\jeux rackmania united munited.exe:TmUnited "UDP Query User{B05F55F8-7074-4787-8394-256F9F90ABC1}d:\jeux\trackmania united\tmunited.exe"= TCP:d:\jeux rackmania united munited.exe:TmUnited "{CEC4F8FF-08E1-43E6-9B29-59BBFED9392D}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{FF547C1F-4AC6-4AFB-B151-28A537AA270F}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{42BC2104-EBA0-4311-B293-B69CD331F569}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{E7CF281A-7252-4549-85C4-BD9B9E79C63B}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire "TCP Query User{F4055F0F-FCDC-4F98-BC48-3F02CC04B57D}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{93A34AA9-26F3-43F1-A5FA-81A3D42D8630}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "{BEBBA3AA-0275-4AFE-AE9E-86165DD7F525}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp "{E0315D0E-A714-49A9-82B3-D326654E99ED}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp "{39656600-3496-4852-B673-E6D3F91C9D96}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice "{227632AE-9D9F-462F-AC51-A5E5D48F3488}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice "TCP Query User{0847679A-C093-46F2-B267-7C4A6E424FBF}c:\program files\sopcast\adv\sopadver.exe"= UDP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver "UDP Query User{734693EF-C188-4B8F-9A23-169DEAF97F9A}c:\program files\sopcast\adv\sopadver.exe"= TCP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver "TCP Query User{4467C229-CF11-4652-A5A1-B93037A85E58}c:\program files\sopcast\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "UDP Query User{33CC879C-3DBD-43F1-A101-34E12D53EC6F}c:\program files\sopcast\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "{9A3EDDB8-E73F-4E08-99D0-C2A5ED0C0389}"= UDP:c:\program files\Realtek\8192U Wireless LAN Utility\RtWLan.exe:RtWlan "{EB85DE8F-5605-4ED7-9702-6CE4B963B984}"= TCP:c:\program files\Realtek\8192U Wireless LAN Utility\RtWLan.exe:RtWlan "{B34D67A7-A960-4B75-A5F0-0E83F6953A8F}"= UDP:1542:Realtek WPS TCP Prot "{EA5F6B7A-94E6-4936-A161-3BED93AFBC61}"= TCP:1542:Realtek WPS UDP Prot [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) "DoNotAllowExceptions"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\Program Files\BitTorrent\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent R1 nod32drv;nod32drv;c:\windows\System32\drivers od32drv.sys [2008-12-06 15424] R1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\System32\drivers\RtlProt.sys [2009-01-18 25896] R4 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2008-08-20 269448] R4 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384] R4 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-25 45056] R4 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-25 131072] R4 Realtek92U;Realtek92U;c:\program files\Realtek\8192U Wireless LAN Utility\RtlService.exe [2009-01-18 36864] S3 CrystalSysInfo;CrystalSysInfo;c:\program files\MediaCoder\SysInfo.sys [2007-09-25 15152] S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-12-19 195752] S3 MotDev;Motorola Inc. USB Device;c:\windows\System32\drivers\motodrv.sys [2006-12-14 40832] S3 RTL8192U;Realtek RTL8192u 802.11n Wireless LAN USB 2.0 Network Adapter;c:\windows\System32\drivers tl8192u.sys [2009-01-18 410624] --- Autres Services/Pilotes en mémoire --- *Deregistered* - sptd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c5b0947-c635-11dd-a5fb-002268054185}] \shell\AutoRun\command - Z:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4c5b1019-c3d6-11dd-8fd2-806e6f6e6963}] \shell\AutoRun\command - E:\CdAutoRun.exe . Contenu du dossier 'Tâches planifiées' 2009-01-26 c:\windows\Tasks\User_Feed_Synchronization-{C237E80D-5B3C-4342-8DC8-D04FE6BB0076}.job - c:\windows\system32\msfeedssync.exe [2008-08-22 05:05] . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-P2kAutostart - (no file) . ------- Examen supplémentaire ------- . uInternet Settings,ProxyOverride = *.local IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 LSP: c:\windows\system32\imon.dll TCP: {FBAE113B-CFC0-424D-909A-A2A23B821FBF} = 24.200.243.189,24.201.245.77,24.200.241.37 DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://ma-config.com/activex/hardwaredetection_3_1_0_4.cab . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-25 22:34:01 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... c:\users\So\AppData\Local\Temp\catchme.dll 53248 bytes executable Scan terminé avec succès Fichiers cachés: 1 ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . c:\windows\System32\Ati2evxx.exe c:\windows\System32\audiodg.exe c:\windows\System32\Ati2evxx.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Common Files\microsoft shared\VS7DEBUG\mdm.exe c:\program files\ESET od32krn.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\program files\Realtek\8192U Wireless LAN Utility\RtWLan.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe c:\windows\System32\WUDFHost.exe c:\windows\System32\conime.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\windows\ehome\ehmsas.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\program files\iPod\bin\iPodService.exe c:\windows\System32\wbem\unsecapp.exe c:\windows\System32\dllhost.exe . ************************************************************************** . Heure de fin: 2009-01-25 22:35:53 - La machine a redémarré [So] ComboFix-quarantined-files.txt 2009-01-26 03:35:50 Avant-CF: 11,576,070,144 octets libres Après-CF: 11,623,665,664 octets libres 440 --- E O F --- 2009-01-22 21:10:38 HIJACKTHIS Logfile of HijackThis v1.99.1 Scan saved at 22:38:33, on 2009-01-25 Platform: Unknown Windows (WinNT 6.00.1905 SP1) MSIE: Internet Explorer v8.00 (8.00.6001.18241) Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\conime.exe C:\Windows\system32 askeng.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\DNA\btdna.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Northstar\SmartCopy\SmartCopy.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\Explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\So\Desktop\HiJackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: isoHunt Toolbar - {a6e4a4eb-d169-4e99-8988-250fcbafe767} - C:\Program Files\isoHunt bisoH.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: isoHunt Toolbar - {a6e4a4eb-d169-4e99-8988-250fcbafe767} - C:\Program Files\isoHunt bisoH.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer\Acer Registration\ACE1.exe" /startup O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset od32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: SmartCopy.lnk = C:\Program Files\Northstar\SmartCopy\SmartCopy.exe O4 - Global Startup: SmartLauncher.lnk = C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - d:\jeux\Party Poker\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - d:\jeux\Party Poker\PartyPoker\RunApp.exe O10 - Unknown file in Winsock LSP: c:\windows\system32 laapi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32 apinsp.dll O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O11 - Options group: [INTERNATIONAL] International O13 - Gopher Prefix: O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_1_0_4.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FBAE113B-CFC0-424D-909A-A2A23B821FBF}: NameServer = 24.200.243.189,24.201.245.77,24.200.241.37 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset od32krn.exe O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: Realtek92U - Realtek - C:\Program Files\Realtek\8192U Wireless LAN Utility\RtlService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

bobbyseguin · Answer

a première vue tout semble bien aller, mon IE 8 va déja comme avant et l'ordi a repris de la vitesse et Antivirus XP Pro 2009 n'est plus la a me narguer

bobbyseguin · Answer

alors pour moi tout semble reglé...
alors un grand merci a toi Geoffrey5, merci pour ta patience, ton travail professionnel, ton support soutenu et compréhensif!

s'il y a quoi que ce soit dans ces rapport, laisse moi un message, je ne metterais pas mon topic Résolu au cas où!

MERCI ;)

geoffrey5 · Answer

Bonjour,

Pour s'assurer, fais quand même ceci stp :

&#x25B6; Télécharge Toolbar-S&D (de Team IDN) sur ton Bureau
  
&#x25B6; Lance l'installation du programme en exécutant le fichier téléchargé. 

&#x25B6; Double-clique maintenant sur le raccourci de Toolbar-S&D. 

&#x25B6; Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 

&#x25B6; Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 

&#x25B6; Poste le rapport généré. (C:\TB.txt)

Ghazig · Answer

bonjour

est il possible que ce méchant virus ai été supprimé directement avec le scan du logiciel Malwarebytes?
ou est ce seulement une impression et faut il quandmême que je continue a suivre les conseils d'après ?

merci d'avance :)

geoffrey5 · Answer

Bonsoir Ghazig,

Merci de créer ton propre topic en cliquant sur le lien ci-dessous pour ne pas avoir de conflit entres les réponses de celui qui a crée celui ci...Tout en bas de la page, tu pourras créer ton propre sujet et y exposer ton problème : 

http://www.commentcamarche.net/forum/forum 7 virus securite

merci pour ta compréhension  ;-)

Antivirus XP Pro, comment l'enlever !?

26 réponses

Discussions similaires

Newsletters